Cleaning up the software folder.

diff --git a/Code/Projects/PacketLevelSignatureExtractor/execute_ip_detection.sh b/Code/Projects/PacketLevelSignatureExtractor/execute_ip_detection.sh
new file mode 100755 (executable)
index 0000000..45b83e1
--- /dev/null
+++ b/Code/Projects/PacketLevelSignatureExtractor/execute_ip_detection.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+# TODO: This script was used to look for certain IP addresses in the YourThings public dataset.
+# TODO: https://yourthings.info/
+
+# Arg1 should point to the folder with YourThings traces (PCAP files w/o any expected events).
+# There are 3 overlap devices:
+# 1) Belkin WeMo switch: https://yourthings.info/devices/belkin_switch.html
+# 2) Roomba iRobot 690: https://yourthings.info/devices/roomba.html
+# 3) TP-Link Bulb LB130: https://yourthings.info/devices/tplink_bulb.html
+YT_TRACES_DIR=$1
+
+# Arg2 should contain the IP address that we are looking for in a certain PCAP file
+IP_ADDRESS=$2
+
+# Arg3 should point to output file that has the list of PCAP files that contain a certain IP address.
+# Subfolders will be created for each individual pcap file in YT_TRACES_DIR.
+OUTPUT_FILE=$3
+
+# Download and untar the public data set https://yourthings.info/data/
+# Then everything should be untarred/unzipped into /.../2018/
+# YT_TRACES_DIR path should be something like /.../2018/
+# Then there are subfolders inside 2018/ such as 2018/03/20/
+for SUBFOLDER1 in $YT_TRACES_DIR/*; do
+       for SUBFOLDER2 in $SUBFOLDER1/*; do
+               for PCAP_FILE in $SUBFOLDER2/*; do
+                       # skip non pcap files
+                       [ -e "$PCAP_FILE" ] || continue
+                       RESULT=`tshark -r $PCAP_FILE | grep $IP_ADDRESS`
+                       echo $PCAP_FILE
+                       # make an output sub dir in the base output dir that is the filename minus extension
+                       if [ -n "$RESULT" ]; then
+                #OUTPUT_SUB_DIR=$(basename "$PCAP_FILE" .pcap)
+                echo "$IP_ADDRESS is found in this PCAP file!"
+                echo $PCAP_FILE >> $OUTPUT_FILE
+            fi
+               done
+       done
+done

diff --git a/base_gexf_generator.py b/base_gexf_generator.py
deleted file mode 100644 (file)
index ad677ec..0000000
--- a/base_gexf_generator.py
+++ /dev/null
@@ -1,349 +0,0 @@
-#!/usr/bin/python
-
-"""
-Script that constructs a graph in which hosts are nodes.
-An edge between two hosts indicate that the hosts communicate.
-Hosts are labeled and identified by their IPs.
-The graph is written to a file in Graph Exchange XML format for later import and visual inspection in Gephi.
-
-Update per February 2, 2018:
-Extension of base_gefx_generator.py.
-This script constructs a bipartite graph with IoT devices on one side and Internet hosts on the other side.
-As a result, this graph does NOT show inter IoT device communication.
-
-The input to this script is the JSON output by extract_from_tshark.py by Anastasia Shuba.
-
-This script is a simplification of Milad Asgari's parser_data_to_gephi.py script.
-It serves as a baseline for future scripts that want to include more information in the graph.
-"""
-
-import socket
-import json
-import tldextract
-import networkx as nx
-import sys
-import csv
-import re
-import parser.parse_dns
-from decimal import *
-from networkx.algorithms import bipartite
-
-# List of devices
-DEVICE_MAC_LIST = "devicelist.dat"
-EXCLUSION_MAC_LIST = "exclusion.dat"
-COLUMN_MAC = "MAC_address"
-COLUMN_DEVICE_NAME = "device_name"
-# Fields
-JSON_KEY_SOURCE = "_source"
-JSON_KEY_LAYERS = "layers"
-JSON_KEY_FRAME = "frame"
-JSON_KEY_FRAME_PROTOCOLS = "frame.protocols"
-JSON_KEY_FRAME_TIME_EPOCH = "frame.time_epoch"
-JSON_KEY_FRAME_LENGTH = "frame.len"
-JSON_KEY_ETH = "eth"
-JSON_KEY_ETH_SRC = "eth.src"
-JSON_KEY_ETH_DST = "eth.dst"
-JSON_KEY_IPV6 = "ipv6"
-JSON_KEY_IP = "ip"
-JSON_KEY_IP_SRC = "ip.src"
-JSON_KEY_IP_DST = "ip.dst"
-# Checked protocols
-JSON_KEY_UDP = "udp"
-JSON_KEY_TCP = "tcp"
-# List of checked protocols
-listchkprot = [ "arp",
-                "bootp",
-                "dhcpv6",
-                "dns",
-                "llmnr",
-                "mdns",
-                "ssdp" ]
-
-# Switch to generate graph that only shows local communication
-ONLY_INCLUDE_LOCAL_COMMUNICATION = False
-
-
-def create_device_list(dev_list_file):
-    """ Create list for smart home devices from a CSV file
-        Args:
-            dev_list_file: CSV file path that contains list of device MAC addresses
-    """
-    # Open the device MAC list file
-    with open(dev_list_file) as csvfile:
-        mac_list = csv.DictReader(csvfile, (COLUMN_MAC, COLUMN_DEVICE_NAME))
-        crude_list = list()
-        for item in mac_list:
-            crude_list.append(item)
-    # Create key-value dictionary
-    dev_list = dict()
-    for item in crude_list:
-        dev_list[item[COLUMN_MAC]] = item[COLUMN_DEVICE_NAME]
-        #print item["MAC_address"] + " => " + item["device_name"]
-    #for key, value in devlist.iteritems():
-    #    print key + " => " + value
-
-    return dev_list
-
-
-def traverse_and_merge_nodes(G, dev_list_file):
-    """ Merge nodes that have similar properties, e.g. same protocols
-        But, we only do this for leaves (outer nodes), and not for
-        nodes that are in the middle/have many neighbors.
-        The pre-condition is that the node:
-        (1) only has one neighbor, and
-        (2) not a smarthome device.
-        then we compare the edges, whether they use the same protocols
-        or not. If yes, then we collapse that node and we attach
-        it to the very first node that uses that set of protocols.
-        Args:
-            G: a complete networkx graph
-            dev_list_file: CSV file path that contains list of device MAC addresses
-    """
-    nodes = G.nodes()
-    #print "Nodes: ", nodes
-    node_to_merge = dict()
-    # Create list of smarthome devices
-    dev_list = create_device_list(DEVICE_MAC_LIST)
-    # Traverse every node
-    # Check that the node is not a smarthome device
-    for node in list(nodes):
-        neighbors = G[node] #G.neighbors(node)
-        #print "Neighbors: ", neighbors, "\n"
-        # Skip if the node is a smarthome device
-        if node in dev_list:
-            continue
-        # Skip if the node has many neighbors (non-leaf) or no neighbor at all
-        if len(neighbors) is not 1:
-            continue
-        #print "Node: ", node
-        neighbor = neighbors.keys()[0] #neighbors[0]
-        #print "Neighbor: ", neighbors
-        protocols = G[node][neighbor]['Protocol']
-        #print "Protocol: ", protocols
-        # Store neighbor-protocol as key in dictionary
-        neigh_proto = neighbor + "-" + protocols
-        if neigh_proto not in node_to_merge:
-            node_to_merge[neigh_proto] = node
-        else:
-        # Merge this node if there is already an entry
-            # First delete
-            G.remove_node(node)
-            node_to_merge_with = node_to_merge[neigh_proto]
-            merged_nodes = G.node[node_to_merge_with]['Merged']
-            # Check if this is the first node
-            if merged_nodes is '':
-                merged_nodes = node
-            else:
-            # Put comma if there is already one or more nodes
-                merged_nodes += ", " + node
-            # Then attach as attribute
-            G.node[node_to_merge_with]['Merged'] = merged_nodes
-
-    return G
-
-
-def place_in_graph(G, eth_src, eth_dst, device_dns_mappings, dev_list, layers, 
-        edge_to_prot, edge_to_vol):
-    """ Place nodes and edges on the graph
-        Args:
-            G: the complete graph
-            eth_src: MAC address of source
-            eth_dst: MAC address of destination
-            device_dns_mappings: device to DNS mappings (data structure)
-            dev_list: list of existing smarthome devices
-            layers: layers of JSON file structure
-            edge_to_prot: edge to protocols mappings
-            edge_to_vol: edge to traffic volume mappings
-    """
-    # Get timestamp of packet (router's timestamp)
-    timestamp = Decimal(layers[JSON_KEY_FRAME][JSON_KEY_FRAME_TIME_EPOCH])
-    # Get packet length
-    packet_len = Decimal(layers[JSON_KEY_FRAME][JSON_KEY_FRAME_LENGTH])
-    # Get the protocol and strip just the name of it
-    long_protocol = layers[JSON_KEY_FRAME][JSON_KEY_FRAME_PROTOCOLS]
-    # Split once starting from the end of the string and get it
-    split_protocol = long_protocol.split(':')
-    protocol = None
-    if len(split_protocol) < 5:
-        last_index = len(split_protocol) - 1
-        protocol = split_protocol[last_index]
-    else:
-        protocol = split_protocol[3] + ":" + split_protocol[4]
-    #print "timestamp: ", timestamp, " - new protocol added: ", protocol, "\n"
-    # And source and destination IPs
-    ip_src = layers[JSON_KEY_IP][JSON_KEY_IP_SRC]
-    ip_dst = layers[JSON_KEY_IP][JSON_KEY_IP_DST]
-    # Categorize source and destination IP addresses: local vs. non-local
-    #ip_re = re.compile(r'\b192.168.[0-9.]+')
-    ip_re = re.compile(r'\b192.168.1.[0-9.]+')
-    src_is_local = ip_re.search(ip_src) 
-    dst_is_local = ip_re.search(ip_dst)
-    # Store protocol into the set (source)
-    protocols = None
-    # Key to search in the dictionary is <src-mac-address>-<dst-mac_address>
-    dict_key = ip_src + "-" + ip_dst
-    #print "Key: ", dict_key
-    if dict_key not in edge_to_prot:
-        edge_to_prot[dict_key] = set()
-    protocols = edge_to_prot[dict_key]
-    protocols.add(protocol)
-    protocols_str = ', '.join(protocols)
-    #print "protocols: ", protocols_str, "\n"
-    # Check packet length and accumulate to get traffic volume
-    if dict_key not in edge_to_vol:
-        edge_to_vol[dict_key] = 0;
-    edge_to_vol[dict_key] = edge_to_vol[dict_key] + packet_len
-    volume = str(edge_to_vol[dict_key])
-
-    # Skip device to cloud communication if we are interested in the local graph.
-    # TODO should this go before the protocol dict is changed?
-    if ONLY_INCLUDE_LOCAL_COMMUNICATION and not (src_is_local and dst_is_local):
-        return
-
-    #print "ip.src =", ip_src, "ip.dst =", ip_dst, "\n"
-    # Place nodes and edges
-    src_node = None
-    dst_node = None
-    # Integer values used for tagging nodes, indicating to Gephi if they are local IoT devices or web servers.
-    remote_node = 0
-    local_node = 1
-    # Values for the 'bipartite' attribute of a node when constructing the bipartite graph
-    bipartite_iot = 0
-    bipartite_web_server = 1
-    if src_is_local:
-        G.add_node(eth_src, Name=dev_list[eth_src], islocal=local_node, bipartite=bipartite_iot)
-        src_node = eth_src
-    else:
-        hostname = None
-        # Check first if the key (eth_dst) exists in the dictionary
-        if eth_dst in device_dns_mappings:
-            # If the source is not local, then it's inbound traffic, and hence the eth_dst is the MAC of the IoT device.
-            hostname = device_dns_mappings[eth_dst].hostname_for_ip_at_time(ip_src, timestamp)                   
-        if hostname is None:
-            # Use IP if no hostname mapping
-            hostname = ip_src
-        # Non-smarthome devices can be merged later
-        G.add_node(hostname, Merged='', islocal=remote_node, bipartite=bipartite_web_server)
-        src_node = hostname
-
-    if dst_is_local:
-        G.add_node(eth_dst, Name=dev_list[eth_dst], islocal=local_node, bipartite=bipartite_iot)
-        dst_node = eth_dst
-    else:
-        hostname = None
-        # Check first if the key (eth_dst) exists in the dictionary
-        if eth_src in device_dns_mappings:
-            # If the destination is not local, then it's outbound traffic, and hence the eth_src is the MAC of the IoT device.
-            hostname = device_dns_mappings[eth_src].hostname_for_ip_at_time(ip_dst, timestamp)
-        if hostname is None:
-            # Use IP if no hostname mapping
-            hostname = ip_dst
-        # Non-smarthome devices can be merged later
-        G.add_node(hostname, Merged='', islocal=remote_node, bipartite=bipartite_web_server)
-        dst_node = hostname
-    G.add_edge(src_node, dst_node, Protocol=protocols_str, Volume=volume)
-
-
-def parse_json(file_path):
-    """ Parse JSON file and create graph
-        Args:
-            file_path: path to the JSON file
-    """
-    # Create a smart home device list
-    dev_list = create_device_list(DEVICE_MAC_LIST)
-    # Create an exclusion list
-    exc_list = create_device_list(EXCLUSION_MAC_LIST)
-    # First parse the file once, constructing a map that contains information about individual devices' DNS resolutions.
-    device_dns_mappings = parser.parse_dns.parse_json_dns(file_path)
-    # Init empty graph
-    G = nx.DiGraph()
-    # Mapping from edge to a set of protocols
-    edge_to_prot = dict()
-    # Mapping from edge to traffic volume
-    edge_to_vol = dict()
-    # Parse file again, this time constructing a graph of device<->server and device<->device communication.
-    i = 0
-    with open(file_path) as jf:
-        # Read JSON; data becomes reference to root JSON object (or in our case json array)
-        data = json.load(jf)
-        # Loop through json objects (packets) in data
-        for p in data:
-            # p is a JSON object, not an index - drill down to object containing data from the different layers
-            layers = p[JSON_KEY_SOURCE][JSON_KEY_LAYERS]
-
-            iscontinue = False
-            for prot in listchkprot:
-                if prot in layers:
-                    iscontinue = True
-            if iscontinue:
-                continue            
-
-            # Skip any non udp/non tcp traffic
-            if JSON_KEY_UDP not in layers and JSON_KEY_TCP not in layers:
-                continue
-
-            # Fetch source and destination MACs
-            eth = layers.get(JSON_KEY_ETH, None)
-            if eth is None:
-                print "[ WARNING: eth data not found ]"
-                continue
-            eth_src = eth.get(JSON_KEY_ETH_SRC, None)
-            eth_dst = eth.get(JSON_KEY_ETH_DST, None)
-            # Exclude devices in the exclusion list
-            if eth_src in exc_list:
-                print "[ WARNING: Source ", eth_src, " is excluded from graph! ]"
-                continue
-            if eth_dst in exc_list:
-                print "[ WARNING: Destination ", eth_dst, " is excluded from graph! ]"
-                continue
-            # Exclude if IP does not exist in layers - this means IPv6
-            if JSON_KEY_IP not in layers and JSON_KEY_IPV6 in layers:
-                continue
-            
-            # Place nodes and edges in graph
-            place_in_graph(G, eth_src, eth_dst, device_dns_mappings, dev_list, layers, 
-                edge_to_prot, edge_to_vol)
-
-    # Print DNS mapping for reference
-       #for mac in device_dns_mappings:
-       #       ddm = device_dns_mappings[mac]
-       #       ddm.print_mappings()
-    
-    return G
-
-
-# ------------------------------------------------------
-# Not currently used.
-# Might be useful later on if we wish to resolve IPs.
-def get_domain(host):
-    ext_result = tldextract.extract(str(host))
-    # Be consistent with ReCon and keep suffix
-    domain = ext_result.domain + "." + ext_result.suffix
-    return domain
-
-def is_IP(addr):
-    try:
-        socket.inet_aton(addr)
-        return True
-    except socket.error:
-        return False
-# ------------------------------------------------------
-
-
-if __name__ == '__main__':
-    if len(sys.argv) < 3:
-        print "Usage:", sys.argv[0], "input_file output_file"
-        print "outfile_file should end in .gexf"
-        sys.exit(0)
-    # Input file: Path to JSON file generated from tshark JSON output using Anastasia's script (extract_from_tshark.py).
-    input_file = sys.argv[1]
-    print "[ input_file  =", input_file, "]"
-    # Output file: Path to file where the Gephi XML should be written.
-    output_file = sys.argv[2]
-    print "[ output_file =", output_file, "]"
-    # Construct graph from JSON
-    G = parse_json(input_file)
-    # Contract nodes that have the same properties, i.e. same protocols
-    G = traverse_and_merge_nodes(G, DEVICE_MAC_LIST)
-    # Write Graph in Graph Exchange XML format
-    nx.write_gexf(G, output_file)

diff --git a/devicelist.dat b/devicelist.dat
deleted file mode 100644 (file)
index 77910b8..0000000
--- a/devicelist.dat
+++ /dev/null
@@ -1,33 +0,0 @@
-MAC_address, device_name
-94:10:3e:36:60:09, Switch/Plug_WEMO
-14:91:82:25:10:77, Switch/Plug_WEMO_Insight
-50:c7:bf:33:1f:09, Switch/Plug_TP-Link
-90:8d:78:e3:81:0c, Switch/Plug_D-Link
-3c:ef:8c:6f:79:5a, WebCam_Amcrest              
-40:5d:82:2f:50:2a, WebCam_Netgear_Arlo
-d0:73:d5:12:8e:30, Lightbulb_LiFX
-d0:73:d5:02:41:da, Lightbulb_LiFX
-00:17:88:69:ee:e4, Lightbulb/Bridge_Philips_Hue
-50:c7:bf:59:d5:84, Lightbulb_TP-Link
-ac:cf:23:5a:9c:e2, Sprinkler_Nxeco
-e4:95:6e:b0:20:39, Sprinkler_Blossom
-c4:12:f5:de:38:20, Siren/Alarm_D-Link
-c4:12:f5:e3:dc:17, MotionSensor_D-Link
-18:b4:30:bf:34:7e, Thermostat_Nest
-68:37:e9:d2:26:0d, PersonalAssistant_Amazon_Echo_Dot
-d0:52:a8:a3:60:0f, ZigBeeHub_Samsung_SmartThings
-64:bc:0c:43:3f:40, Smartphone_Nexus_5_White
-64:89:9a:86:a9:7d, Smartphone_Nexus_5_Black
-a8:96:75:2f:0c:9c, Smartphone_Motorola
-60:f1:89:96:45:f6, Samsung_S7_Edge
-60:57:18:8e:aa:94, Laptop_PC_HP
-b0:b9:8a:73:69:8e, RouterPort_Bridge-LAN
-b0:b9:8a:73:69:8f, RouterPort_ETH1
-b0:b9:8a:73:69:90, RouterPort_WLAN0
-b0:b9:8a:73:69:91, RouterPort_WLAN1
-74:da:38:0d:05:55, RaspberryPi_Controller
-74:da:38:68:72:84, RaspberryPi_3_Vigilia
-d4:6a:6a:4f:e2:33, Dell_laptop
-80:e6:50:25:70:72, Apple_MAC
-68:a8:6d:06:e5:5e, Apple_MAC_PLRG
-ff:ff:ff:ff:ff:ff, Broadcast_MAC

diff --git a/exclusion.dat b/exclusion.dat
deleted file mode 100644 (file)
index 99c0556..0000000
--- a/exclusion.dat
+++ /dev/null
@@ -1,10 +0,0 @@
-MAC_address, device_name
-60:f1:89:96:45:f6, Samsung_S7_Edge
-60:57:18:8e:aa:94, Laptop_PC_HP
-74:da:38:0d:05:55, RaspberryPi_Controller
-74:da:38:68:72:84, RaspberryPi_3_Vigilia
-80:e6:50:25:70:72, Apple_MAC
-68:a8:6d:06:e5:5e, Apple_MAC_PLRG
-d4:6a:6a:4f:e2:33, Dell_laptop
-40:5d:82:2f:50:2a, WebCam_Netgear_Arlo
-18:b4:30:bf:34:7e, Thermostat_Nest

diff --git a/gexf/generated-graph-sample.gexf b/gexf/generated-graph-sample.gexf
deleted file mode 100644 (file)
index 33f9f54..0000000
--- a/gexf/generated-graph-sample.gexf
+++ /dev/null
@@ -1,23 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<gexf version="1.2" xmlns="http://www.gexf.net/1.2draft" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2001/XMLSchema-instance">
-  <graph defaultedgetype="directed" mode="static" name="">
-    <meta>
-      <creator>NetworkX 2.0</creator>
-      <lastmodified>05/11/2017</lastmodified>
-    </meta>
-    <nodes>
-      <node id="94:10:3e:36:60:09" label="94:10:3e:36:60:09" />
-      <node id="d0:52:a8:a3:60:0f" label="d0:52:a8:a3:60:0f" />
-      <node id="diagnostics.meethue.com" label="diagnostics.meethue.com" />
-      <node id="68:37:e9:d2:26:0d" label="68:37:e9:d2:26:0d" />
-      <node id="dcp.cpp.philips.com" label="dcp.cpp.philips.com" />
-      <node id="00:17:88:69:ee:e4" label="00:17:88:69:ee:e4" />
-    </nodes>
-    <edges>
-      <edge id="0" source="d0:52:a8:a3:60:0f" target="94:10:3e:36:60:09" />
-      <edge id="1" source="68:37:e9:d2:26:0d" target="00:17:88:69:ee:e4" />
-      <edge id="2" source="00:17:88:69:ee:e4" target="dcp.cpp.philips.com" />
-      <edge id="3" source="00:17:88:69:ee:e4" target="diagnostics.meethue.com" />
-    </edges>
-  </graph>
-</gexf>

diff --git a/json/dns.json b/json/dns.json
deleted file mode 100644 (file)
index 43f3eb5..0000000
--- a/json/dns.json
+++ /dev/null
@@ -1,40632 +0,0 @@
-[
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:07:51.560156000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508458071.560156000",
-          "frame.time_delta": "1.053360000",
-          "frame.time_delta_displayed": "0.000000000",
-          "frame.time_relative": "359.154952000",
-          "frame.number": "380",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000c5d4",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000f2e8",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "35041",
-          "udp.dstport": "53",
-          "udp.port": "35041",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000d04f",
-          "udp.checksum.status": "2",
-          "udp.stream": "19"
-        },
-        "dns": {
-          "dns.response_in": "381",
-          "dns.id": "0x00000487",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:07:51.597999000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508458071.597999000",
-          "frame.time_delta": "0.037843000",
-          "frame.time_delta_displayed": "0.037843000",
-          "frame.time_relative": "359.192795000",
-          "frame.number": "381",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00001e6a",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000989e",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "35041",
-          "udp.port": "53",
-          "udp.port": "35041",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "19"
-        },
-        "dns": {
-          "dns.response_to": "380",
-          "dns.time": "0.037843000",
-          "dns.id": "0x00000487",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "115",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "13313",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.113": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.113"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "485",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "485",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "485",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "485",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "485",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "485",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "485",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "485",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "485",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3795",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2515",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3016",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 165.254.134.241": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3200",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.241"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2106",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.1.137.33": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3857",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.33"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 165.254.16.95": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3654",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.95"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.134.239": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3718",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.239"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2491",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:22:51.607393000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508458971.607393000",
-          "frame.time_delta": "4.029605000",
-          "frame.time_delta_displayed": "900.009394000",
-          "frame.time_relative": "1259.202189000",
-          "frame.number": "1239",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00000103",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b7ba",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "57902",
-          "udp.dstport": "53",
-          "udp.port": "57902",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00007701",
-          "udp.checksum.status": "2",
-          "udp.stream": "36"
-        },
-        "dns": {
-          "dns.response_in": "1240",
-          "dns.id": "0x00000488",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:22:51.678853000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508458971.678853000",
-          "frame.time_delta": "0.071460000",
-          "frame.time_delta_displayed": "0.071460000",
-          "frame.time_relative": "1259.273649000",
-          "frame.number": "1240",
-          "frame.len": "467",
-          "frame.cap_len": "467",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "453",
-          "ip.id": "0x00004f7c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000067ba",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "57902",
-          "udp.port": "53",
-          "udp.port": "57902",
-          "udp.length": "433",
-          "udp.checksum": "0x000083b4",
-          "udp.checksum.status": "2",
-          "udp.stream": "36"
-        },
-        "dns": {
-          "dns.response_to": "1239",
-          "dns.time": "0.071460000",
-          "dns.id": "0x00000488",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "8",
-          "dns.count.add_rr": "8",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "115",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "12413",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.113": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.113"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "587",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "587",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "587",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "587",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "587",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "587",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "587",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "587",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2895",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1615",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2116",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 165.254.134.241": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2300",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.241"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1206",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.1.137.33": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2957",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.33"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 165.254.16.95": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2754",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.95"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.134.239": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2818",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.239"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:33:23.045476000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508459603.045476000",
-          "frame.time_delta": "1.106645000",
-          "frame.time_delta_displayed": "631.366623000",
-          "frame.time_relative": "1890.640272000",
-          "frame.number": "1873",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00001f1b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000999f",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "44067",
-          "udp.dstport": "53",
-          "udp.port": "44067",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00001491",
-          "udp.checksum.status": "2",
-          "udp.stream": "51"
-        },
-        "dns": {
-          "dns.response_in": "1874",
-          "dns.id": "0x00000489",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:33:23.047090000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508459603.047090000",
-          "frame.time_delta": "0.001614000",
-          "frame.time_delta_displayed": "0.001614000",
-          "frame.time_relative": "1890.641886000",
-          "frame.number": "1874",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x00002b52",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00008d2e",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "44067",
-          "udp.port": "53",
-          "udp.port": "44067",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "51"
-        },
-        "dns": {
-          "dns.response_to": "1873",
-          "dns.time": "0.001614000",
-          "dns.id": "0x00000489",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "643",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:33:23.048272000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508459603.048272000",
-          "frame.time_delta": "0.001182000",
-          "frame.time_delta_displayed": "0.001182000",
-          "frame.time_relative": "1890.643068000",
-          "frame.number": "1875",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00001f1c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000999e",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "51510",
-          "udp.dstport": "53",
-          "udp.port": "51510",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000127d",
-          "udp.checksum.status": "2",
-          "udp.stream": "52"
-        },
-        "dns": {
-          "dns.response_in": "1876",
-          "dns.id": "0x0000048a",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:33:23.049516000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508459603.049516000",
-          "frame.time_delta": "0.001244000",
-          "frame.time_delta_displayed": "0.001244000",
-          "frame.time_relative": "1890.644312000",
-          "frame.number": "1876",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x00002b53",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00008c99",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "51510",
-          "udp.port": "53",
-          "udp.port": "51510",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "52"
-        },
-        "dns": {
-          "dns.response_to": "1875",
-          "dns.time": "0.001244000",
-          "dns.id": "0x0000048a",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "644",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "644",
-              "dns.resp.len": "10",
-              "dns.ns": "ns1.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "644",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "644",
-              "dns.resp.len": "6",
-              "dns.ns": "ns3.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "155007",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3438",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3438",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "158626",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "151199",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "151199",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:33:23.470381000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508459603.470381000",
-          "frame.time_delta": "0.000880000",
-          "frame.time_delta_displayed": "0.420865000",
-          "frame.time_relative": "1891.065177000",
-          "frame.number": "1892",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00001f22",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00009998",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "44843",
-          "udp.dstport": "53",
-          "udp.port": "44843",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00001187",
-          "udp.checksum.status": "2",
-          "udp.stream": "53"
-        },
-        "dns": {
-          "dns.response_in": "1893",
-          "dns.id": "0x0000048b",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:33:23.470880000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508459603.470880000",
-          "frame.time_delta": "0.000499000",
-          "frame.time_delta_displayed": "0.000499000",
-          "frame.time_relative": "1891.065676000",
-          "frame.number": "1893",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00002b76",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00008d44",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "44843",
-          "udp.port": "53",
-          "udp.port": "44843",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "53"
-        },
-        "dns": {
-          "dns.response_to": "1892",
-          "dns.time": "0.000499000",
-          "dns.id": "0x0000048b",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:33:23.471684000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508459603.471684000",
-          "frame.time_delta": "0.000804000",
-          "frame.time_delta_displayed": "0.000804000",
-          "frame.time_relative": "1891.066480000",
-          "frame.number": "1894",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00001f23",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00009997",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "40021",
-          "udp.dstport": "53",
-          "udp.port": "40021",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00003f5c",
-          "udp.checksum.status": "2",
-          "udp.stream": "54"
-        },
-        "dns": {
-          "dns.response_in": "1895",
-          "dns.id": "0x0000048c",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:33:23.472192000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508459603.472192000",
-          "frame.time_delta": "0.000508000",
-          "frame.time_delta_displayed": "0.000508000",
-          "frame.time_relative": "1891.066988000",
-          "frame.number": "1895",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x00002b77",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00008d33",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "40021",
-          "udp.port": "53",
-          "udp.port": "40021",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "54"
-        },
-        "dns": {
-          "dns.response_to": "1894",
-          "dns.time": "0.000508000",
-          "dns.id": "0x0000048c",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "644",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:37:51.689099000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508459871.689099000",
-          "frame.time_delta": "0.145237000",
-          "frame.time_delta_displayed": "268.216907000",
-          "frame.time_relative": "2159.283895000",
-          "frame.number": "2153",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x000053f4",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000064c9",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "49510",
-          "udp.dstport": "53",
-          "udp.port": "49510",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x000097c4",
-          "udp.checksum.status": "2",
-          "udp.stream": "60"
-        },
-        "dns": {
-          "dns.response_in": "2154",
-          "dns.id": "0x0000048d",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:37:51.695550000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508459871.695550000",
-          "frame.time_delta": "0.006451000",
-          "frame.time_delta_displayed": "0.006451000",
-          "frame.time_relative": "2159.290346000",
-          "frame.number": "2154",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000851c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000031ec",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "49510",
-          "udp.port": "53",
-          "udp.port": "49510",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "60"
-        },
-        "dns": {
-          "dns.response_to": "2153",
-          "dns.time": "0.006451000",
-          "dns.id": "0x0000048d",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "141",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "13111",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.113": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.113"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2774",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2774",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2774",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2774",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2774",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2774",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2774",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2774",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2774",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "294",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 165.254.134.240": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4838",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.240"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.16.89": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7614",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.89"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 165.254.16.90": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3676",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.90"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 165.254.16.94": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4084",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.94"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 165.254.134.244": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4641",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.244"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 165.254.134.246": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "218",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.246"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.134.232": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2322",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.232"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4774",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:52:51.705423000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508460771.705423000",
-          "frame.time_delta": "3.937809000",
-          "frame.time_delta_displayed": "900.009873000",
-          "frame.time_relative": "3059.300219000",
-          "frame.number": "2958",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000b28e",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000062f",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "59344",
-          "udp.dstport": "53",
-          "udp.port": "59344",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00007159",
-          "udp.checksum.status": "2",
-          "udp.stream": "72"
-        },
-        "dns": {
-          "dns.response_in": "2959",
-          "dns.id": "0x0000048e",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 17:52:51.715857000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508460771.715857000",
-          "frame.time_delta": "0.010434000",
-          "frame.time_delta_displayed": "0.010434000",
-          "frame.time_relative": "3059.310653000",
-          "frame.number": "2959",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000ca5c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000ecab",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "59344",
-          "udp.port": "53",
-          "udp.port": "59344",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "72"
-        },
-        "dns": {
-          "dns.response_to": "2958",
-          "dns.time": "0.010434000",
-          "dns.id": "0x0000048e",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "116",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "10613",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.113": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.113"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2787",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2787",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2787",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2787",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2787",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2787",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2787",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2787",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2787",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1095",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 184.51.200.159": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7816",
-              "dns.resp.len": "4",
-              "dns.a": "184.51.200.159"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "316",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 165.254.134.241": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "500",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.241"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 165.254.134.244": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5409",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.244"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.1.137.33": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1157",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.33"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 165.254.16.95": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "954",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.95"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.134.239": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1018",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.239"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5792",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:07:51.725149000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508461671.725149000",
-          "frame.time_delta": "2.951813000",
-          "frame.time_delta_displayed": "900.009292000",
-          "frame.time_relative": "3959.319945000",
-          "frame.number": "3816",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000ba5a",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000fe62",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "34709",
-          "udp.dstport": "53",
-          "udp.port": "34709",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000d193",
-          "udp.checksum.status": "2",
-          "udp.stream": "84"
-        },
-        "dns": {
-          "dns.response_in": "3817",
-          "dns.id": "0x0000048f",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:07:51.735281000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508461671.735281000",
-          "frame.time_delta": "0.010132000",
-          "frame.time_delta_displayed": "0.010132000",
-          "frame.time_relative": "3959.330077000",
-          "frame.number": "3817",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00004a90",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00006c78",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "34709",
-          "udp.port": "53",
-          "udp.port": "34709",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "84"
-        },
-        "dns": {
-          "dns.response_to": "3816",
-          "dns.time": "0.010132000",
-          "dns.id": "0x0000048f",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "142",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "11311",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.113": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.113"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "974",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "974",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "974",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "974",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "974",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "974",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "974",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "974",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "974",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2496",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 165.254.134.240": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3038",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.240"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.16.89": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5814",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.89"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 165.254.16.90": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1876",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.90"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 165.254.16.94": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2284",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.94"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 165.254.134.244": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2841",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.244"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 165.254.16.93": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2419",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.93"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.134.232": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "522",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.232"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2974",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:12:56.852097000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508461976.852097000",
-          "frame.time_delta": "3.045152000",
-          "frame.time_delta_displayed": "305.116816000",
-          "frame.time_relative": "4264.446893000",
-          "frame.number": "5571",
-          "frame.len": "83",
-          "frame.cap_len": "83",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "69",
-          "ip.id": "0x0000f879",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000c03c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "46881",
-          "udp.dstport": "53",
-          "udp.port": "46881",
-          "udp.port": "53",
-          "udp.length": "49",
-          "udp.checksum": "0x0000d1bd",
-          "udp.checksum.status": "2",
-          "udp.stream": "89"
-        },
-        "dns": {
-          "dns.response_in": "5572",
-          "dns.id": "0x00000490",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "diagnostics.meethue.com: type A, class IN": {
-              "dns.qry.name": "diagnostics.meethue.com",
-              "dns.qry.name.len": "23",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:12:56.936468000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508461976.936468000",
-          "frame.time_delta": "0.084371000",
-          "frame.time_delta_displayed": "0.084371000",
-          "frame.time_relative": "4264.531264000",
-          "frame.number": "5572",
-          "frame.len": "297",
-          "frame.cap_len": "297",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "283",
-          "ip.id": "0x00008c6e",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002b72",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "46881",
-          "udp.port": "53",
-          "udp.port": "46881",
-          "udp.length": "263",
-          "udp.checksum": "0x0000830a",
-          "udp.checksum.status": "2",
-          "udp.stream": "89"
-        },
-        "dns": {
-          "dns.response_to": "5571",
-          "dns.time": "0.084371000",
-          "dns.id": "0x00000490",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "diagnostics.meethue.com: type A, class IN": {
-              "dns.qry.name": "diagnostics.meethue.com",
-              "dns.qry.name.len": "23",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "diagnostics.meethue.com: type A, class IN, addr 130.211.67.12": {
-              "dns.resp.name": "diagnostics.meethue.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "300",
-              "dns.resp.len": "4",
-              "dns.a": "130.211.67.12"
-            }
-          },
-          "Authoritative nameservers": {
-            "meethue.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "meethue.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3600",
-              "dns.resp.len": "18",
-              "dns.ns": "ns2.ext.philips.com"
-            },
-            "meethue.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "meethue.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3600",
-              "dns.resp.len": "6",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "meethue.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "meethue.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3600",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "172800",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "172800",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "172800",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2611",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "62777",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "62777",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:22:51.746902000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508462571.746902000",
-          "frame.time_delta": "2.037142000",
-          "frame.time_delta_displayed": "594.810434000",
-          "frame.time_relative": "4859.341698000",
-          "frame.number": "6175",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000f884",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000c038",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "54444",
-          "udp.dstport": "53",
-          "udp.port": "54444",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000847a",
-          "udp.checksum.status": "2",
-          "udp.stream": "97"
-        },
-        "dns": {
-          "dns.response_in": "6176",
-          "dns.id": "0x00000491",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:22:51.772932000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508462571.772932000",
-          "frame.time_delta": "0.026030000",
-          "frame.time_delta_displayed": "0.026030000",
-          "frame.time_relative": "4859.367728000",
-          "frame.number": "6176",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00004cfa",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00006a0e",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "54444",
-          "udp.port": "53",
-          "udp.port": "54444",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "97"
-        },
-        "dns": {
-          "dns.response_to": "6175",
-          "dns.time": "0.026030000",
-          "dns.id": "0x00000491",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "116",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "8813",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.113": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.113"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "987",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "987",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "987",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "987",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "987",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "987",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "987",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "987",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "987",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3296",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 184.51.200.159": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6016",
-              "dns.resp.len": "4",
-              "dns.a": "184.51.200.159"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 96.17.70.188": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6518",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.188"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.190": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2701",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.190"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 165.254.134.244": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3609",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.244"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 165.254.16.89": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7358",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.89"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 184.51.200.166": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3156",
-              "dns.resp.len": "4",
-              "dns.a": "184.51.200.166"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.16.92": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5219",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.92"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3992",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:33:21.624384000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508463201.624384000",
-          "frame.time_delta": "0.266457000",
-          "frame.time_delta_displayed": "629.851452000",
-          "frame.time_relative": "5489.219180000",
-          "frame.number": "6744",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000bf31",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000f988",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "37292",
-          "udp.dstport": "53",
-          "udp.port": "37292",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00002eff",
-          "udp.checksum.status": "2",
-          "udp.stream": "102"
-        },
-        "dns": {
-          "dns.response_in": "6745",
-          "dns.id": "0x00000492",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:33:21.626468000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508463201.626468000",
-          "frame.time_delta": "0.002084000",
-          "frame.time_delta_displayed": "0.002084000",
-          "frame.time_relative": "5489.221264000",
-          "frame.number": "6745",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x00003f71",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000790f",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "37292",
-          "udp.port": "53",
-          "udp.port": "37292",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "102"
-        },
-        "dns": {
-          "dns.response_to": "6744",
-          "dns.time": "0.002084000",
-          "dns.id": "0x00000492",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3220",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:33:21.627301000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508463201.627301000",
-          "frame.time_delta": "0.000833000",
-          "frame.time_delta_displayed": "0.000833000",
-          "frame.time_relative": "5489.222097000",
-          "frame.number": "6746",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000bf32",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000f987",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "54874",
-          "udp.dstport": "53",
-          "udp.port": "54874",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00000550",
-          "udp.checksum.status": "2",
-          "udp.stream": "103"
-        },
-        "dns": {
-          "dns.response_in": "6747",
-          "dns.id": "0x00000493",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:33:21.628812000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508463201.628812000",
-          "frame.time_delta": "0.001511000",
-          "frame.time_delta_displayed": "0.001511000",
-          "frame.time_relative": "5489.223608000",
-          "frame.number": "6747",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x00003f72",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000787a",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "54874",
-          "udp.port": "53",
-          "udp.port": "54874",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "103"
-        },
-        "dns": {
-          "dns.response_to": "6746",
-          "dns.time": "0.001511000",
-          "dns.id": "0x00000493",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2985",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "413",
-              "dns.resp.len": "10",
-              "dns.ns": "ns1.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "413",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "413",
-              "dns.resp.len": "6",
-              "dns.ns": "ns3.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "171575",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "171575",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "171575",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1386",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "61552",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "61552",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:33:22.044352000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508463202.044352000",
-          "frame.time_delta": "0.001668000",
-          "frame.time_delta_displayed": "0.415540000",
-          "frame.time_relative": "5489.639148000",
-          "frame.number": "6763",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000bf41",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000f978",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "55176",
-          "udp.dstport": "53",
-          "udp.port": "55176",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000e920",
-          "udp.checksum.status": "2",
-          "udp.stream": "104"
-        },
-        "dns": {
-          "dns.response_in": "6764",
-          "dns.id": "0x00000494",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:33:22.044953000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508463202.044953000",
-          "frame.time_delta": "0.000601000",
-          "frame.time_delta_displayed": "0.000601000",
-          "frame.time_relative": "5489.639749000",
-          "frame.number": "6764",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00003f96",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00007924",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "55176",
-          "udp.port": "53",
-          "udp.port": "55176",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "104"
-        },
-        "dns": {
-          "dns.response_to": "6763",
-          "dns.time": "0.000601000",
-          "dns.id": "0x00000494",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:33:22.045769000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508463202.045769000",
-          "frame.time_delta": "0.000816000",
-          "frame.time_delta_displayed": "0.000816000",
-          "frame.time_relative": "5489.640565000",
-          "frame.number": "6765",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000bf42",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000f977",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "60660",
-          "udp.dstport": "53",
-          "udp.port": "60660",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000eeb3",
-          "udp.checksum.status": "2",
-          "udp.stream": "105"
-        },
-        "dns": {
-          "dns.response_in": "6766",
-          "dns.id": "0x00000495",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:33:22.046379000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508463202.046379000",
-          "frame.time_delta": "0.000610000",
-          "frame.time_delta_displayed": "0.000610000",
-          "frame.time_relative": "5489.641175000",
-          "frame.number": "6766",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x00003f97",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00007913",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "60660",
-          "udp.port": "53",
-          "udp.port": "60660",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "105"
-        },
-        "dns": {
-          "dns.response_to": "6765",
-          "dns.time": "0.000610000",
-          "dns.id": "0x00000495",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2984",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:37:51.778249000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508463471.778249000",
-          "frame.time_delta": "3.324074000",
-          "frame.time_delta_displayed": "269.731870000",
-          "frame.time_relative": "5759.373045000",
-          "frame.number": "7048",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00001dd7",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00009ae6",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "36809",
-          "udp.dstport": "53",
-          "udp.port": "36809",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000c958",
-          "udp.checksum.status": "2",
-          "udp.stream": "113"
-        },
-        "dns": {
-          "dns.response_in": "7049",
-          "dns.id": "0x00000496",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:37:51.799436000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508463471.799436000",
-          "frame.time_delta": "0.021187000",
-          "frame.time_delta_displayed": "0.021187000",
-          "frame.time_relative": "5759.394232000",
-          "frame.number": "7049",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000431d",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000073eb",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "36809",
-          "udp.port": "53",
-          "udp.port": "36809",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "113"
-        },
-        "dns": {
-          "dns.response_to": "7048",
-          "dns.time": "0.021187000",
-          "dns.id": "0x00000496",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "116",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7913",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.113": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.113"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "87",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "87",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "87",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "87",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "87",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "87",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "87",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "87",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "87",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2396",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 184.51.200.159": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5116",
-              "dns.resp.len": "4",
-              "dns.a": "184.51.200.159"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 96.17.70.188": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5618",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.188"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.190": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1801",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.190"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 165.254.134.244": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2709",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.244"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 165.254.16.89": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6458",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.89"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 184.51.200.166": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2256",
-              "dns.resp.len": "4",
-              "dns.a": "184.51.200.166"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.16.92": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4319",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.92"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3092",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:52:51.807701000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508464371.807701000",
-          "frame.time_delta": "0.379478000",
-          "frame.time_delta_displayed": "900.008265000",
-          "frame.time_relative": "6659.402497000",
-          "frame.number": "7913",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00009e02",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00001abb",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "47598",
-          "udp.dstport": "53",
-          "udp.port": "47598",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00009f32",
-          "udp.checksum.status": "2",
-          "udp.stream": "123"
-        },
-        "dns": {
-          "dns.response_in": "7914",
-          "dns.id": "0x00000497",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 18:52:51.814443000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508464371.814443000",
-          "frame.time_delta": "0.006742000",
-          "frame.time_delta_displayed": "0.006742000",
-          "frame.time_relative": "6659.409239000",
-          "frame.number": "7914",
-          "frame.len": "467",
-          "frame.cap_len": "467",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "453",
-          "ip.id": "0x0000e205",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000d530",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "47598",
-          "udp.port": "53",
-          "udp.port": "47598",
-          "udp.length": "433",
-          "udp.checksum": "0x000083b4",
-          "udp.checksum.status": "2",
-          "udp.stream": "123"
-        },
-        "dns": {
-          "dns.response_to": "7913",
-          "dns.time": "0.006742000",
-          "dns.id": "0x00000497",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "8",
-          "dns.count.add_rr": "8",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "142",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "8611",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.113": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.113"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "275",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "275",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "275",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "275",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "275",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "275",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "275",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "275",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3797",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 165.254.134.240": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "338",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.240"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.16.89": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3114",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.89"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3177",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.197.192.230": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5586",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.230"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 165.254.134.244": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "141",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.244"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.197.192.234": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3720",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.234"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.16.92": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3824",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.92"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:07:51.823654000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508465271.823654000",
-          "frame.time_delta": "3.748666000",
-          "frame.time_delta_displayed": "900.009211000",
-          "frame.time_relative": "7559.418450000",
-          "frame.number": "8671",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000e910",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000cfac",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "33804",
-          "udp.dstport": "53",
-          "udp.port": "33804",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000d513",
-          "udp.checksum.status": "2",
-          "udp.stream": "132"
-        },
-        "dns": {
-          "dns.response_in": "8672",
-          "dns.id": "0x00000498",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:07:51.884431000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508465271.884431000",
-          "frame.time_delta": "0.060777000",
-          "frame.time_delta_displayed": "0.060777000",
-          "frame.time_relative": "7559.479227000",
-          "frame.number": "8672",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00004cdb",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00006a2d",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "33804",
-          "udp.port": "53",
-          "udp.port": "33804",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "132"
-        },
-        "dns": {
-          "dns.response_to": "8671",
-          "dns.time": "0.060777000",
-          "dns.id": "0x00000498",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "116",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6113",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.73": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.73"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.2": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.2"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2288",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2288",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2288",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2288",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2288",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2288",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2288",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2288",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2288",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "596",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 184.51.200.159": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3316",
-              "dns.resp.len": "4",
-              "dns.a": "184.51.200.159"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 96.17.70.188": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3818",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.188"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.190": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.190"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 165.254.134.244": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "909",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.244"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 165.254.16.89": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4658",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.89"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 184.51.200.166": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "456",
-              "dns.resp.len": "4",
-              "dns.a": "184.51.200.166"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.16.92": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2519",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.92"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1292",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:22:51.895282000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508466171.895282000",
-          "frame.time_delta": "7.109343000",
-          "frame.time_delta_displayed": "900.010851000",
-          "frame.time_relative": "8459.490078000",
-          "frame.number": "9475",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000ffbc",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b900",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "33283",
-          "udp.dstport": "53",
-          "udp.port": "33283",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000d71b",
-          "udp.checksum.status": "2",
-          "udp.stream": "144"
-        },
-        "dns": {
-          "dns.response_in": "9476",
-          "dns.id": "0x00000499",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:22:51.906565000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508466171.906565000",
-          "frame.time_delta": "0.011283000",
-          "frame.time_delta_displayed": "0.011283000",
-          "frame.time_relative": "8459.501361000",
-          "frame.number": "9476",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000a915",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000df3",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "33283",
-          "udp.port": "53",
-          "udp.port": "33283",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "144"
-        },
-        "dns": {
-          "dns.response_to": "9475",
-          "dns.time": "0.011283000",
-          "dns.id": "0x00000499",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "142",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6811",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2475",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2475",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2475",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2475",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2475",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2475",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2475",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2475",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2475",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1997",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6539",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.16.89": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1314",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.89"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1377",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.197.192.230": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3786",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.230"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.1.137.37": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6342",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.37"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.197.192.234": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1920",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.234"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.16.92": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2024",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.92"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4475",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:33:22.239450000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508466802.239450000",
-          "frame.time_delta": "4.788057000",
-          "frame.time_delta_displayed": "630.332885000",
-          "frame.time_relative": "9089.834246000",
-          "frame.number": "10050",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000751c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000439e",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "51418",
-          "udp.dstport": "53",
-          "udp.port": "51418",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000f7c8",
-          "udp.checksum.status": "2",
-          "udp.stream": "151"
-        },
-        "dns": {
-          "dns.response_in": "10051",
-          "dns.id": "0x0000049a",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:33:22.241425000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508466802.241425000",
-          "frame.time_delta": "0.001975000",
-          "frame.time_delta_displayed": "0.001975000",
-          "frame.time_relative": "9089.836221000",
-          "frame.number": "10051",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x000030bf",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000087c1",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "51418",
-          "udp.port": "53",
-          "udp.port": "51418",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "151"
-        },
-        "dns": {
-          "dns.response_to": "10050",
-          "dns.time": "0.001975000",
-          "dns.id": "0x0000049a",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:33:22.242432000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508466802.242432000",
-          "frame.time_delta": "0.001007000",
-          "frame.time_delta_displayed": "0.001007000",
-          "frame.time_relative": "9089.837228000",
-          "frame.number": "10052",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000751d",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000439d",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "60729",
-          "udp.dstport": "53",
-          "udp.port": "60729",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000ee68",
-          "udp.checksum.status": "2",
-          "udp.stream": "152"
-        },
-        "dns": {
-          "dns.response_in": "10053",
-          "dns.id": "0x0000049b",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:33:22.244090000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508466802.244090000",
-          "frame.time_delta": "0.001658000",
-          "frame.time_delta_displayed": "0.001658000",
-          "frame.time_relative": "9089.838886000",
-          "frame.number": "10053",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x000030c0",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000872c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "60729",
-          "udp.port": "53",
-          "udp.port": "60729",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "152"
-        },
-        "dns": {
-          "dns.response_to": "10052",
-          "dns.time": "0.001658000",
-          "dns.id": "0x0000049b",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "10",
-              "dns.ns": "ns1.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "6",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "147808",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "172526",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "172526",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "151427",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144000",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144000",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:33:22.660387000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508466802.660387000",
-          "frame.time_delta": "0.001051000",
-          "frame.time_delta_displayed": "0.416297000",
-          "frame.time_relative": "9090.255183000",
-          "frame.number": "10069",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00007547",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00004373",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "46220",
-          "udp.dstport": "53",
-          "udp.port": "46220",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00000c15",
-          "udp.checksum.status": "2",
-          "udp.stream": "153"
-        },
-        "dns": {
-          "dns.response_in": "10070",
-          "dns.id": "0x0000049c",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:33:22.660954000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508466802.660954000",
-          "frame.time_delta": "0.000567000",
-          "frame.time_delta_displayed": "0.000567000",
-          "frame.time_relative": "9090.255750000",
-          "frame.number": "10070",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x000030d6",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000087e4",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "46220",
-          "udp.port": "53",
-          "udp.port": "46220",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "153"
-        },
-        "dns": {
-          "dns.response_to": "10069",
-          "dns.time": "0.000567000",
-          "dns.id": "0x0000049c",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:33:22.661749000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508466802.661749000",
-          "frame.time_delta": "0.000795000",
-          "frame.time_delta_displayed": "0.000795000",
-          "frame.time_relative": "9090.256545000",
-          "frame.number": "10071",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00007548",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00004372",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "51255",
-          "udp.dstport": "53",
-          "udp.port": "51255",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00001369",
-          "udp.checksum.status": "2",
-          "udp.stream": "154"
-        },
-        "dns": {
-          "dns.response_in": "10072",
-          "dns.id": "0x0000049d",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:33:22.662301000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508466802.662301000",
-          "frame.time_delta": "0.000552000",
-          "frame.time_delta_displayed": "0.000552000",
-          "frame.time_relative": "9090.257097000",
-          "frame.number": "10072",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x000030d7",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000087d3",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "51255",
-          "udp.port": "53",
-          "udp.port": "51255",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "154"
-        },
-        "dns": {
-          "dns.response_to": "10071",
-          "dns.time": "0.000552000",
-          "dns.id": "0x0000049d",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:37:51.914199000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508467071.914199000",
-          "frame.time_delta": "0.065381000",
-          "frame.time_delta_displayed": "269.251898000",
-          "frame.time_relative": "9359.508995000",
-          "frame.number": "10287",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x000089fd",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002ec0",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "41837",
-          "udp.dstport": "53",
-          "udp.port": "41837",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000b5ac",
-          "udp.checksum.status": "2",
-          "udp.stream": "155"
-        },
-        "dns": {
-          "dns.response_in": "10288",
-          "dns.id": "0x0000049e",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:37:51.978100000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508467071.978100000",
-          "frame.time_delta": "0.063901000",
-          "frame.time_delta_displayed": "0.063901000",
-          "frame.time_relative": "9359.572896000",
-          "frame.number": "10288",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00008e7d",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000288b",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "41837",
-          "udp.port": "53",
-          "udp.port": "41837",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "155"
-        },
-        "dns": {
-          "dns.response_to": "10287",
-          "dns.time": "0.063901000",
-          "dns.id": "0x0000049e",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "117",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4313",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "488",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "488",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "488",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "488",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "488",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "488",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "488",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "488",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "488",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2799",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 184.51.200.159": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1516",
-              "dns.resp.len": "4",
-              "dns.a": "184.51.200.159"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 96.17.70.188": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2018",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.188"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 204.1.137.33": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2202",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.33"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.197.192.230": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5110",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.230"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 165.254.16.89": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2858",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.89"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.188": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2660",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.188"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.16.92": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "719",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.92"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5496",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:52:51.985173000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508467971.985173000",
-          "frame.time_delta": "0.373714000",
-          "frame.time_delta_displayed": "900.007073000",
-          "frame.time_relative": "10259.579969000",
-          "frame.number": "11065",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000b24b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000672",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "33682",
-          "udp.dstport": "53",
-          "udp.port": "33682",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000d586",
-          "udp.checksum.status": "2",
-          "udp.stream": "163"
-        },
-        "dns": {
-          "dns.response_in": "11066",
-          "dns.id": "0x0000049f",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 19:52:52.048951000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508467972.048951000",
-          "frame.time_delta": "0.063778000",
-          "frame.time_delta_displayed": "0.063778000",
-          "frame.time_relative": "10259.643747000",
-          "frame.number": "11066",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00008dbf",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002949",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "33682",
-          "udp.port": "53",
-          "udp.port": "33682",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "163"
-        },
-        "dns": {
-          "dns.response_to": "11065",
-          "dns.time": "0.063778000",
-          "dns.id": "0x0000049f",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "117",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3413",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.73": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.73"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.2": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.2"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3589",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3589",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3589",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3589",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3589",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3589",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3589",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3589",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3589",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1898",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 184.51.200.159": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "615",
-              "dns.resp.len": "4",
-              "dns.a": "184.51.200.159"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 96.17.70.188": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1117",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.188"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 204.1.137.33": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1301",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.33"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.197.192.230": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4209",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.230"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 165.254.16.89": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1957",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.89"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.188": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1759",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.188"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 173.197.192.237": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5819",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.237"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4595",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:07:52.060309000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508468872.060309000",
-          "frame.time_delta": "0.486449000",
-          "frame.time_delta_displayed": "900.011358000",
-          "frame.time_relative": "11159.655105000",
-          "frame.number": "11855",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000fdee",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bace",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "49312",
-          "udp.dstport": "53",
-          "udp.port": "49312",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00009877",
-          "udp.checksum.status": "2",
-          "udp.stream": "171"
-        },
-        "dns": {
-          "dns.response_in": "11856",
-          "dns.id": "0x000004a0",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:07:52.067203000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508468872.067203000",
-          "frame.time_delta": "0.006894000",
-          "frame.time_delta_displayed": "0.006894000",
-          "frame.time_relative": "11159.661999000",
-          "frame.number": "11856",
-          "frame.len": "467",
-          "frame.cap_len": "467",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "453",
-          "ip.id": "0x0000b190",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000005a6",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "49312",
-          "udp.port": "53",
-          "udp.port": "49312",
-          "udp.length": "433",
-          "udp.checksum": "0x000083b4",
-          "udp.checksum.status": "2",
-          "udp.stream": "171"
-        },
-        "dns": {
-          "dns.response_to": "11855",
-          "dns.time": "0.006894000",
-          "dns.id": "0x000004a0",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "8",
-          "dns.count.add_rr": "8",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "141",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4110",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "774",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "774",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "774",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "774",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "774",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "774",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "774",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "774",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3298",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3838",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.197.192.233": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6614",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.233"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2677",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.197.192.230": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1085",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.230"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.1.137.37": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3641",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.37"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3220",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.1.137.37": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5325",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.37"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:22:52.076126000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508469772.076126000",
-          "frame.time_delta": "0.590869000",
-          "frame.time_delta_displayed": "900.008923000",
-          "frame.time_relative": "12059.670922000",
-          "frame.number": "12657",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000a2db",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000015e2",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53703",
-          "udp.dstport": "53",
-          "udp.port": "53703",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000874f",
-          "udp.checksum.status": "2",
-          "udp.stream": "177"
-        },
-        "dns": {
-          "dns.response_in": "12658",
-          "dns.id": "0x000004a1",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:22:52.112051000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508469772.112051000",
-          "frame.time_delta": "0.035925000",
-          "frame.time_delta_displayed": "0.035925000",
-          "frame.time_relative": "12059.706847000",
-          "frame.number": "12658",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000ccc6",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000ea41",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "53703",
-          "udp.port": "53",
-          "udp.port": "53703",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "177"
-        },
-        "dns": {
-          "dns.response_to": "12657",
-          "dns.time": "0.035925000",
-          "dns.id": "0x000004a1",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "116",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1612",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.2": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.2"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.73": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.73"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1789",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1789",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1789",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1789",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1789",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1789",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1789",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1789",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1789",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "98",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6816",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7318",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 198.172.88.200": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3503",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.200"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.197.192.230": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2409",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.230"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 165.254.16.89": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "157",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.89"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 198.172.88.205": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3960",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.205"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 173.197.192.237": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4019",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.237"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2795",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:33:22.842206000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508470402.842206000",
-          "frame.time_delta": "0.384116000",
-          "frame.time_delta_displayed": "630.730155000",
-          "frame.time_relative": "12690.437002000",
-          "frame.number": "13303",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000dd6f",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000db4a",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "44754",
-          "udp.dstport": "53",
-          "udp.port": "44754",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x000011c9",
-          "udp.checksum.status": "2",
-          "udp.stream": "184"
-        },
-        "dns": {
-          "dns.response_in": "13304",
-          "dns.id": "0x000004a2",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:33:22.844183000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508470402.844183000",
-          "frame.time_delta": "0.001977000",
-          "frame.time_delta_displayed": "0.001977000",
-          "frame.time_relative": "12690.438979000",
-          "frame.number": "13304",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x00000246",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b63a",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "44754",
-          "udp.port": "53",
-          "udp.port": "44754",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "184"
-        },
-        "dns": {
-          "dns.response_to": "13303",
-          "dns.time": "0.001977000",
-          "dns.id": "0x000004a2",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3219",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:33:22.846468000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508470402.846468000",
-          "frame.time_delta": "0.002285000",
-          "frame.time_delta_displayed": "0.002285000",
-          "frame.time_relative": "12690.441264000",
-          "frame.number": "13305",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000dd70",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000db49",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "35982",
-          "udp.dstport": "53",
-          "udp.port": "35982",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00004f0c",
-          "udp.checksum.status": "2",
-          "udp.stream": "185"
-        },
-        "dns": {
-          "dns.response_in": "13306",
-          "dns.id": "0x000004a3",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:33:22.848081000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508470402.848081000",
-          "frame.time_delta": "0.001613000",
-          "frame.time_delta_displayed": "0.001613000",
-          "frame.time_relative": "12690.442877000",
-          "frame.number": "13306",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x00000247",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b5a5",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "35982",
-          "udp.port": "53",
-          "udp.port": "35982",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "185"
-        },
-        "dns": {
-          "dns.response_to": "13305",
-          "dns.time": "0.001613000",
-          "dns.id": "0x000004a3",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3161",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "645",
-              "dns.resp.len": "10",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "645",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "645",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "856",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "164374",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "164374",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2117",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "54351",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "54351",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:33:23.264573000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508470403.264573000",
-          "frame.time_delta": "0.001337000",
-          "frame.time_delta_displayed": "0.416492000",
-          "frame.time_relative": "12690.859369000",
-          "frame.number": "13322",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000dd71",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000db48",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "56095",
-          "udp.dstport": "53",
-          "udp.port": "56095",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000e579",
-          "udp.checksum.status": "2",
-          "udp.stream": "186"
-        },
-        "dns": {
-          "dns.response_in": "13323",
-          "dns.id": "0x000004a4",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:33:23.265148000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508470403.265148000",
-          "frame.time_delta": "0.000575000",
-          "frame.time_delta_displayed": "0.000575000",
-          "frame.time_relative": "12690.859944000",
-          "frame.number": "13323",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000026e",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b64c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "56095",
-          "udp.port": "53",
-          "udp.port": "56095",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "186"
-        },
-        "dns": {
-          "dns.response_to": "13322",
-          "dns.time": "0.000575000",
-          "dns.id": "0x000004a4",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:33:23.266041000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508470403.266041000",
-          "frame.time_delta": "0.000893000",
-          "frame.time_delta_displayed": "0.000893000",
-          "frame.time_relative": "12690.860837000",
-          "frame.number": "13324",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000dd72",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000db47",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "41786",
-          "udp.dstport": "53",
-          "udp.port": "41786",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000385e",
-          "udp.checksum.status": "2",
-          "udp.stream": "187"
-        },
-        "dns": {
-          "dns.response_in": "13325",
-          "dns.id": "0x000004a5",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:33:23.266579000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508470403.266579000",
-          "frame.time_delta": "0.000538000",
-          "frame.time_delta_displayed": "0.000538000",
-          "frame.time_relative": "12690.861375000",
-          "frame.number": "13325",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x0000026f",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b63b",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "41786",
-          "udp.port": "53",
-          "udp.port": "41786",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "187"
-        },
-        "dns": {
-          "dns.response_to": "13324",
-          "dns.time": "0.000538000",
-          "dns.id": "0x000004a5",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3160",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:37:52.120059000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508470672.120059000",
-          "frame.time_delta": "0.625668000",
-          "frame.time_delta_displayed": "268.853480000",
-          "frame.time_relative": "12959.714855000",
-          "frame.number": "13582",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00002649",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00009274",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "54738",
-          "udp.dstport": "53",
-          "udp.port": "54738",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000833f",
-          "udp.checksum.status": "2",
-          "udp.stream": "188"
-        },
-        "dns": {
-          "dns.response_in": "13583",
-          "dns.id": "0x000004a6",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:37:52.140960000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508470672.140960000",
-          "frame.time_delta": "0.020901000",
-          "frame.time_delta_displayed": "0.020901000",
-          "frame.time_relative": "12959.735756000",
-          "frame.number": "13583",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00004310",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000073f8",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "54738",
-          "udp.port": "53",
-          "udp.port": "54738",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "188"
-        },
-        "dns": {
-          "dns.response_to": "13582",
-          "dns.time": "0.020901000",
-          "dns.id": "0x000004a6",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "116",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "712",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "889",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "889",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "889",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "889",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "889",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "889",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "889",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "889",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "889",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3199",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5916",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6418",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 198.172.88.200": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2603",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.200"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.197.192.230": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1509",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.230"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 198.172.88.206": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7258",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.206"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 198.172.88.205": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3060",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.205"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 173.197.192.237": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3119",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.237"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1895",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:52:52.147811000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508471572.147811000",
-          "frame.time_delta": "0.719415000",
-          "frame.time_delta_displayed": "900.006851000",
-          "frame.time_relative": "13859.742607000",
-          "frame.number": "14361",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000e5bd",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000d2ff",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "55123",
-          "udp.dstport": "53",
-          "udp.port": "55123",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x000081bd",
-          "udp.checksum.status": "2",
-          "udp.stream": "197"
-        },
-        "dns": {
-          "dns.response_in": "14362",
-          "dns.id": "0x000004a7",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 20:52:52.212985000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508471572.212985000",
-          "frame.time_delta": "0.065174000",
-          "frame.time_delta_displayed": "0.065174000",
-          "frame.time_relative": "13859.807781000",
-          "frame.number": "14362",
-          "frame.len": "467",
-          "frame.cap_len": "467",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "453",
-          "ip.id": "0x00004fa4",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00006792",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "55123",
-          "udp.port": "53",
-          "udp.port": "55123",
-          "udp.length": "433",
-          "udp.checksum": "0x000083b4",
-          "udp.checksum.status": "2",
-          "udp.stream": "197"
-        },
-        "dns": {
-          "dns.response_to": "14361",
-          "dns.time": "0.065174000",
-          "dns.id": "0x000004a7",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "8",
-          "dns.count.add_rr": "8",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "117",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "21417",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "989",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "989",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "989",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "989",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "989",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "989",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "989",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "989",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2299",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5016",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5518",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 198.172.88.200": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1703",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.200"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.197.192.230": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "609",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.230"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 198.172.88.206": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6358",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.206"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 198.172.88.205": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2160",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.205"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 173.197.192.237": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2219",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.237"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:07:52.219360000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508472472.219360000",
-          "frame.time_delta": "0.606095000",
-          "frame.time_delta_displayed": "900.006375000",
-          "frame.time_relative": "14759.814156000",
-          "frame.number": "15111",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000c5af",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000f30d",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "44889",
-          "udp.dstport": "53",
-          "udp.port": "44889",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000a9b6",
-          "udp.checksum.status": "2",
-          "udp.stream": "205"
-        },
-        "dns": {
-          "dns.response_in": "15112",
-          "dns.id": "0x000004a8",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:07:52.306389000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508472472.306389000",
-          "frame.time_delta": "0.087029000",
-          "frame.time_delta_displayed": "0.087029000",
-          "frame.time_relative": "14759.901185000",
-          "frame.number": "15112",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000a365",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000013a3",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "44889",
-          "udp.port": "53",
-          "udp.port": "44889",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "205"
-        },
-        "dns": {
-          "dns.response_to": "15111",
-          "dns.time": "0.087029000",
-          "dns.id": "0x000004a8",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "300",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "510",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1174",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1174",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1174",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1174",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1174",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1174",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1174",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1174",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1174",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3699",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "238",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.197.192.233": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3014",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.233"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3078",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 198.172.88.203": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3486",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.203"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.1.137.37": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "41",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.37"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 165.254.16.95": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3621",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.95"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.1.137.37": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1725",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.37"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4177",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:22:52.395472000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508473372.395472000",
-          "frame.time_delta": "3.711619000",
-          "frame.time_delta_displayed": "900.089083000",
-          "frame.time_relative": "15659.990268000",
-          "frame.number": "15884",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x000043a6",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00007517",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53892",
-          "udp.dstport": "53",
-          "udp.port": "53892",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000868a",
-          "udp.checksum.status": "2",
-          "udp.stream": "212"
-        },
-        "dns": {
-          "dns.response_in": "15885",
-          "dns.id": "0x000004a9",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:22:52.423942000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508473372.423942000",
-          "frame.time_delta": "0.028470000",
-          "frame.time_delta_displayed": "0.028470000",
-          "frame.time_relative": "15660.018738000",
-          "frame.number": "15885",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000f1a1",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000c566",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "53892",
-          "udp.port": "53",
-          "udp.port": "53892",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "212"
-        },
-        "dns": {
-          "dns.response_to": "15884",
-          "dns.time": "0.028470000",
-          "dns.id": "0x000004a9",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "142",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "21258",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.2": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.2"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.73": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.73"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "274",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "274",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "274",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "274",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "274",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "274",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "274",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "274",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "274",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2799",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7339",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.197.192.233": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2114",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.233"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2178",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 198.172.88.203": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2586",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.203"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 198.172.88.203": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7142",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.203"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 165.254.16.95": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2721",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.95"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.1.137.37": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "825",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.37"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3277",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:33:23.396307000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508474003.396307000",
-          "frame.time_delta": "4.678140000",
-          "frame.time_delta_displayed": "630.972365000",
-          "frame.time_relative": "16290.991103000",
-          "frame.number": "16442",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x000096a0",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000221a",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "37663",
-          "udp.dstport": "53",
-          "udp.port": "37663",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00002d74",
-          "udp.checksum.status": "2",
-          "udp.stream": "215"
-        },
-        "dns": {
-          "dns.response_in": "16443",
-          "dns.id": "0x000004aa",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:33:23.398249000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508474003.398249000",
-          "frame.time_delta": "0.001942000",
-          "frame.time_delta_displayed": "0.001942000",
-          "frame.time_relative": "16290.993045000",
-          "frame.number": "16443",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x00008616",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000326a",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "37663",
-          "udp.port": "53",
-          "udp.port": "37663",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "215"
-        },
-        "dns": {
-          "dns.response_to": "16442",
-          "dns.time": "0.001942000",
-          "dns.id": "0x000004aa",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:33:23.399079000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508474003.399079000",
-          "frame.time_delta": "0.000830000",
-          "frame.time_delta_displayed": "0.000830000",
-          "frame.time_relative": "16290.993875000",
-          "frame.number": "16444",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x000096a1",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002219",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "33353",
-          "udp.dstport": "53",
-          "udp.port": "33353",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00005949",
-          "udp.checksum.status": "2",
-          "udp.stream": "216"
-        },
-        "dns": {
-          "dns.response_in": "16445",
-          "dns.id": "0x000004ab",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:33:23.400649000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508474003.400649000",
-          "frame.time_delta": "0.001570000",
-          "frame.time_delta_displayed": "0.001570000",
-          "frame.time_relative": "16290.995445000",
-          "frame.number": "16445",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x00008617",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000031d5",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "33353",
-          "udp.port": "53",
-          "udp.port": "33353",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "216"
-        },
-        "dns": {
-          "dns.response_to": "16444",
-          "dns.time": "0.001570000",
-          "dns.id": "0x000004ab",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "10",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "140607",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "165325",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "165325",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144226",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "136799",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "136799",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:33:23.818793000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508474003.818793000",
-          "frame.time_delta": "0.002460000",
-          "frame.time_delta_displayed": "0.418144000",
-          "frame.time_relative": "16291.413589000",
-          "frame.number": "16461",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x000096bd",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000021fd",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "52555",
-          "udp.dstport": "53",
-          "udp.port": "52555",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000f345",
-          "udp.checksum.status": "2",
-          "udp.stream": "217"
-        },
-        "dns": {
-          "dns.response_in": "16462",
-          "dns.id": "0x000004ac",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:33:23.819379000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508474003.819379000",
-          "frame.time_delta": "0.000586000",
-          "frame.time_delta_displayed": "0.000586000",
-          "frame.time_relative": "16291.414175000",
-          "frame.number": "16462",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000861c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000329e",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "52555",
-          "udp.port": "53",
-          "udp.port": "52555",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "217"
-        },
-        "dns": {
-          "dns.response_to": "16461",
-          "dns.time": "0.000586000",
-          "dns.id": "0x000004ac",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:33:23.820220000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508474003.820220000",
-          "frame.time_delta": "0.000841000",
-          "frame.time_delta_displayed": "0.000841000",
-          "frame.time_relative": "16291.415016000",
-          "frame.number": "16463",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x000096be",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000021fc",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "58656",
-          "udp.dstport": "53",
-          "udp.port": "58656",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000f66f",
-          "udp.checksum.status": "2",
-          "udp.stream": "218"
-        },
-        "dns": {
-          "dns.response_in": "16464",
-          "dns.id": "0x000004ad",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:33:23.820779000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508474003.820779000",
-          "frame.time_delta": "0.000559000",
-          "frame.time_delta_displayed": "0.000559000",
-          "frame.time_relative": "16291.415575000",
-          "frame.number": "16464",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x0000861d",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000328d",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "58656",
-          "udp.port": "53",
-          "udp.port": "58656",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "218"
-        },
-        "dns": {
-          "dns.response_to": "16463",
-          "dns.time": "0.000559000",
-          "dns.id": "0x000004ad",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:37:52.430247000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508474272.430247000",
-          "frame.time_delta": "3.692969000",
-          "frame.time_delta_displayed": "268.609468000",
-          "frame.time_relative": "16560.025043000",
-          "frame.number": "16697",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000e609",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000d2b3",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "47128",
-          "udp.dstport": "53",
-          "udp.port": "47128",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000a0f1",
-          "udp.checksum.status": "2",
-          "udp.stream": "221"
-        },
-        "dns": {
-          "dns.response_in": "16698",
-          "dns.id": "0x000004ae",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:37:52.445842000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508474272.445842000",
-          "frame.time_delta": "0.015595000",
-          "frame.time_delta_displayed": "0.015595000",
-          "frame.time_relative": "16560.040638000",
-          "frame.number": "16698",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000be56",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000f8b1",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "47128",
-          "udp.port": "53",
-          "udp.port": "47128",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "221"
-        },
-        "dns": {
-          "dns.response_to": "16697",
-          "dns.time": "0.015595000",
-          "dns.id": "0x000004ae",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "142",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20358",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3374",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3374",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3374",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3374",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3374",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3374",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3374",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3374",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3374",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1899",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6439",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.197.192.233": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1214",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.233"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1278",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 198.172.88.203": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1686",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.203"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 198.172.88.203": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6242",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.203"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 165.254.16.95": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1821",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.95"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 198.172.88.205": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5927",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.205"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2377",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:52:52.450308000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508475172.450308000",
-          "frame.time_delta": "6.313074000",
-          "frame.time_delta_displayed": "900.004466000",
-          "frame.time_relative": "17460.045104000",
-          "frame.number": "17472",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00002b9d",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00008d20",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "58502",
-          "udp.dstport": "53",
-          "udp.port": "58502",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00007482",
-          "udp.checksum.status": "2",
-          "udp.stream": "229"
-        },
-        "dns": {
-          "dns.response_in": "17473",
-          "dns.id": "0x000004af",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 21:52:52.456608000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508475172.456608000",
-          "frame.time_delta": "0.006300000",
-          "frame.time_delta_displayed": "0.006300000",
-          "frame.time_relative": "17460.051404000",
-          "frame.number": "17473",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x000011ad",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000a55b",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "58502",
-          "udp.port": "53",
-          "udp.port": "58502",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "229"
-        },
-        "dns": {
-          "dns.response_to": "17472",
-          "dns.time": "0.006300000",
-          "dns.id": "0x000004af",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "142",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "19458",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2474",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2474",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2474",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2474",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2474",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2474",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2474",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2474",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2474",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "999",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5539",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.197.192.233": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "314",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.233"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.197.192.229": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "378",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.229"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 198.172.88.203": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "786",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.203"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 198.172.88.203": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5342",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.203"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 165.254.16.95": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "921",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.95"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 198.172.88.205": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5027",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.205"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1477",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:07:52.464775000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508476072.464775000",
-          "frame.time_delta": "4.206559000",
-          "frame.time_delta_displayed": "900.008167000",
-          "frame.time_relative": "18360.059571000",
-          "frame.number": "18263",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00005c8a",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00005c33",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "58930",
-          "udp.dstport": "53",
-          "udp.port": "58930",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x000072d5",
-          "udp.checksum.status": "2",
-          "udp.stream": "235"
-        },
-        "dns": {
-          "dns.response_in": "18264",
-          "dns.id": "0x000004b0",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:07:52.473763000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508476072.473763000",
-          "frame.time_delta": "0.008988000",
-          "frame.time_delta_displayed": "0.008988000",
-          "frame.time_relative": "18360.068559000",
-          "frame.number": "18264",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x000052f7",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00006411",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "58930",
-          "udp.port": "53",
-          "udp.port": "58930",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "235"
-        },
-        "dns": {
-          "dns.response_to": "18263",
-          "dns.time": "0.008988000",
-          "dns.id": "0x000004b0",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "142",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "18558",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1574",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1574",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1574",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1574",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1574",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1574",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1574",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1574",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1574",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "99",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4639",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7415",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.129": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3479",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.129"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.223.52.70": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5887",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.70"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 198.172.88.203": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4442",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.203"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 165.254.16.95": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "21",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.95"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 198.172.88.205": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4127",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.205"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "577",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:22:52.482011000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508476972.482011000",
-          "frame.time_delta": "2.079982000",
-          "frame.time_delta_displayed": "900.008248000",
-          "frame.time_relative": "19260.076807000",
-          "frame.number": "19082",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00007f92",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000392b",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "48250",
-          "udp.dstport": "53",
-          "udp.port": "48250",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00009c8c",
-          "udp.checksum.status": "2",
-          "udp.stream": "242"
-        },
-        "dns": {
-          "dns.response_in": "19083",
-          "dns.id": "0x000004b1",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:22:52.488375000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508476972.488375000",
-          "frame.time_delta": "0.006364000",
-          "frame.time_delta_displayed": "0.006364000",
-          "frame.time_relative": "19260.083171000",
-          "frame.number": "19083",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x000024f5",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00009213",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "48250",
-          "udp.port": "53",
-          "udp.port": "48250",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "242"
-        },
-        "dns": {
-          "dns.response_to": "19082",
-          "dns.time": "0.006364000",
-          "dns.id": "0x000004b1",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "143",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "17658",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "674",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "674",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "674",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "674",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "674",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "674",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "674",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "674",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "674",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3200",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3739",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6515",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.129": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2579",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.129"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.223.52.70": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4987",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.70"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 198.172.88.203": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3542",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.203"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 165.254.16.94": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3122",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.94"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 198.172.88.205": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3227",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.205"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5678",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:33:21.968209000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508477601.968209000",
-          "frame.time_delta": "2.368838000",
-          "frame.time_delta_displayed": "629.479834000",
-          "frame.time_relative": "19889.563005000",
-          "frame.number": "19759",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x000048a9",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00007011",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "48476",
-          "udp.dstport": "53",
-          "udp.port": "48476",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000032f",
-          "udp.checksum.status": "2",
-          "udp.stream": "248"
-        },
-        "dns": {
-          "dns.response_in": "19760",
-          "dns.id": "0x000004b2",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:33:21.970113000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508477601.970113000",
-          "frame.time_delta": "0.001904000",
-          "frame.time_delta_displayed": "0.001904000",
-          "frame.time_relative": "19889.564909000",
-          "frame.number": "19760",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x00006934",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00004f4c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "48476",
-          "udp.port": "53",
-          "udp.port": "48476",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "248"
-        },
-        "dns": {
-          "dns.response_to": "19759",
-          "dns.time": "0.001904000",
-          "dns.id": "0x000004b2",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3220",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:33:21.971590000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508477601.971590000",
-          "frame.time_delta": "0.001477000",
-          "frame.time_delta_displayed": "0.001477000",
-          "frame.time_relative": "19889.566386000",
-          "frame.number": "19761",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x000048aa",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00007010",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "60103",
-          "udp.dstport": "53",
-          "udp.port": "60103",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000f0c2",
-          "udp.checksum.status": "2",
-          "udp.stream": "249"
-        },
-        "dns": {
-          "dns.response_in": "19762",
-          "dns.id": "0x000004b3",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:33:21.973429000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508477601.973429000",
-          "frame.time_delta": "0.001839000",
-          "frame.time_delta_displayed": "0.001839000",
-          "frame.time_relative": "19889.568225000",
-          "frame.number": "19762",
-          "frame.len": "269",
-          "frame.cap_len": "269",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "255",
-          "ip.id": "0x00006935",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00004ec7",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "60103",
-          "udp.port": "53",
-          "udp.port": "60103",
-          "udp.length": "235",
-          "udp.checksum": "0x000082ee",
-          "udp.checksum.status": "2",
-          "udp.stream": "249"
-        },
-        "dns": {
-          "dns.response_to": "19761",
-          "dns.time": "0.001839000",
-          "dns.id": "0x000004b3",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "5",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3220",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "689",
-              "dns.resp.len": "10",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "689",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "689",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "157175",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "157175",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2218",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "47152",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "47152",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:33:22.393601000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508477602.393601000",
-          "frame.time_delta": "0.000661000",
-          "frame.time_delta_displayed": "0.420172000",
-          "frame.time_relative": "19889.988397000",
-          "frame.number": "19778",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x000048c9",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00006ff1",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "58716",
-          "udp.dstport": "53",
-          "udp.port": "58716",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000db2c",
-          "udp.checksum.status": "2",
-          "udp.stream": "250"
-        },
-        "dns": {
-          "dns.response_in": "19779",
-          "dns.id": "0x000004b4",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:33:22.394208000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508477602.394208000",
-          "frame.time_delta": "0.000607000",
-          "frame.time_delta_displayed": "0.000607000",
-          "frame.time_relative": "19889.989004000",
-          "frame.number": "19779",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00006951",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00004f69",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "58716",
-          "udp.port": "53",
-          "udp.port": "58716",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "250"
-        },
-        "dns": {
-          "dns.response_to": "19778",
-          "dns.time": "0.000607000",
-          "dns.id": "0x000004b4",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:33:22.395034000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508477602.395034000",
-          "frame.time_delta": "0.000826000",
-          "frame.time_delta_displayed": "0.000826000",
-          "frame.time_relative": "19889.989830000",
-          "frame.number": "19780",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x000048ca",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00006ff0",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "58570",
-          "udp.dstport": "53",
-          "udp.port": "58570",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000f6bd",
-          "udp.checksum.status": "2",
-          "udp.stream": "251"
-        },
-        "dns": {
-          "dns.response_in": "19781",
-          "dns.id": "0x000004b5",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:33:22.395453000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508477602.395453000",
-          "frame.time_delta": "0.000419000",
-          "frame.time_delta_displayed": "0.000419000",
-          "frame.time_relative": "19889.990249000",
-          "frame.number": "19781",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x00006952",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00004f58",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "58570",
-          "udp.port": "53",
-          "udp.port": "58570",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "251"
-        },
-        "dns": {
-          "dns.response_to": "19780",
-          "dns.time": "0.000419000",
-          "dns.id": "0x000004b5",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3219",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:37:52.496004000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508477872.496004000",
-          "frame.time_delta": "7.655864000",
-          "frame.time_delta_displayed": "270.100551000",
-          "frame.time_relative": "20160.090800000",
-          "frame.number": "20012",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00007136",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00004787",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "57235",
-          "udp.dstport": "53",
-          "udp.port": "57235",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000796e",
-          "udp.checksum.status": "2",
-          "udp.stream": "252"
-        },
-        "dns": {
-          "dns.response_in": "20013",
-          "dns.id": "0x000004b6",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:37:52.557890000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508477872.557890000",
-          "frame.time_delta": "0.061886000",
-          "frame.time_delta_displayed": "0.061886000",
-          "frame.time_relative": "20160.152686000",
-          "frame.number": "20013",
-          "frame.len": "467",
-          "frame.cap_len": "467",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "453",
-          "ip.id": "0x00007974",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00003dc2",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "57235",
-          "udp.port": "53",
-          "udp.port": "57235",
-          "udp.length": "433",
-          "udp.checksum": "0x000083b4",
-          "udp.checksum.status": "2",
-          "udp.stream": "252"
-        },
-        "dns": {
-          "dns.response_to": "20012",
-          "dns.time": "0.061886000",
-          "dns.id": "0x000004b6",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "8",
-          "dns.count.add_rr": "8",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "118",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "15117",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 23.67.56.215": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6717",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.215"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7220",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3405",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 165.254.16.92": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "311",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.92"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 198.172.88.206": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "58",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.206"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.223.52.69": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3867",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.69"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 198.172.88.204": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1920",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.204"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:52:52.564075000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508478772.564075000",
-          "frame.time_delta": "2.198143000",
-          "frame.time_delta_displayed": "900.006185000",
-          "frame.time_relative": "21060.158871000",
-          "frame.number": "20790",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000cae0",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000eddc",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "43240",
-          "udp.dstport": "53",
-          "udp.port": "43240",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000b018",
-          "udp.checksum.status": "2",
-          "udp.stream": "258"
-        },
-        "dns": {
-          "dns.response_in": "20791",
-          "dns.id": "0x000004b7",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 22:52:52.600980000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508478772.600980000",
-          "frame.time_delta": "0.036905000",
-          "frame.time_delta_displayed": "0.036905000",
-          "frame.time_relative": "21060.195776000",
-          "frame.number": "20791",
-          "frame.len": "467",
-          "frame.cap_len": "467",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "453",
-          "ip.id": "0x00009731",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002005",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "43240",
-          "udp.port": "53",
-          "udp.port": "43240",
-          "udp.length": "433",
-          "udp.checksum": "0x000083b4",
-          "udp.checksum.status": "2",
-          "udp.stream": "258"
-        },
-        "dns": {
-          "dns.response_to": "20790",
-          "dns.time": "0.036905000",
-          "dns.id": "0x000004b7",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "8",
-          "dns.count.add_rr": "8",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "118",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "14217",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "790",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "790",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "790",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "790",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "790",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "790",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "790",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "790",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3106",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 23.67.56.215": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5817",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.215"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6320",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2505",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 198.172.88.202": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5412",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.202"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 173.223.52.70": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7161",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.70"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.223.52.69": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2967",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.69"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 198.172.88.204": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1020",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.204"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:07:52.606357000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508479672.606357000",
-          "frame.time_delta": "1.385883000",
-          "frame.time_delta_displayed": "900.005377000",
-          "frame.time_relative": "21960.201153000",
-          "frame.number": "21562",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00004d98",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00006b25",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53213",
-          "udp.dstport": "53",
-          "udp.port": "53213",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00008922",
-          "udp.checksum.status": "2",
-          "udp.stream": "264"
-        },
-        "dns": {
-          "dns.response_in": "21563",
-          "dns.id": "0x000004b8",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:07:52.617193000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508479672.617193000",
-          "frame.time_delta": "0.010836000",
-          "frame.time_delta_displayed": "0.010836000",
-          "frame.time_relative": "21960.211989000",
-          "frame.number": "21563",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000db65",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000dba2",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "53213",
-          "udp.port": "53",
-          "udp.port": "53213",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "264"
-        },
-        "dns": {
-          "dns.response_to": "21562",
-          "dns.time": "0.010836000",
-          "dns.id": "0x000004b8",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "118",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "13317",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3890",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3890",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3890",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3890",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3890",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3890",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3890",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3890",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3890",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2206",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 23.67.56.215": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4917",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.215"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5420",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1605",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 198.172.88.202": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4512",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.202"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 173.223.52.70": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6261",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.70"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.223.52.69": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2067",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.69"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 198.172.88.204": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "120",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.204"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5890",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:22:52.625699000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508480572.625699000",
-          "frame.time_delta": "4.403118000",
-          "frame.time_delta_displayed": "900.008506000",
-          "frame.time_relative": "22860.220495000",
-          "frame.number": "22346",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00005937",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00005f86",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "33001",
-          "udp.dstport": "53",
-          "udp.port": "33001",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000d815",
-          "udp.checksum.status": "2",
-          "udp.stream": "268"
-        },
-        "dns": {
-          "dns.response_in": "22347",
-          "dns.id": "0x000004b9",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:22:52.650694000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508480572.650694000",
-          "frame.time_delta": "0.024995000",
-          "frame.time_delta_displayed": "0.024995000",
-          "frame.time_relative": "22860.245490000",
-          "frame.number": "22347",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000d12d",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000e5da",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "33001",
-          "udp.port": "53",
-          "udp.port": "33001",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "268"
-        },
-        "dns": {
-          "dns.response_to": "22346",
-          "dns.time": "0.024995000",
-          "dns.id": "0x000004b9",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "143",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "14058",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1074",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1074",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1074",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1074",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1074",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1074",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1074",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1074",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1074",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3601",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 198.172.88.208": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "139",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.208"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2915",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 165.254.134.239": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2980",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.239"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.223.52.70": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1387",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.70"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 96.17.70.191": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7943",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.191"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.223.52.70": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3523",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.70"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5628",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2078",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:33:22.664730000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508481202.664730000",
-          "frame.time_delta": "2.566341000",
-          "frame.time_delta_displayed": "630.014036000",
-          "frame.time_relative": "23490.259526000",
-          "frame.number": "22859",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00007d2e",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00003b8c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "58340",
-          "udp.dstport": "53",
-          "udp.port": "58340",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000dc9e",
-          "udp.checksum.status": "2",
-          "udp.stream": "271"
-        },
-        "dns": {
-          "dns.response_in": "22860",
-          "dns.id": "0x000004ba",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:33:22.666597000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508481202.666597000",
-          "frame.time_delta": "0.001867000",
-          "frame.time_delta_displayed": "0.001867000",
-          "frame.time_relative": "23490.261393000",
-          "frame.number": "22860",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x00008ce9",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002b97",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "58340",
-          "udp.port": "53",
-          "udp.port": "58340",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "271"
-        },
-        "dns": {
-          "dns.response_to": "22859",
-          "dns.time": "0.001867000",
-          "dns.id": "0x000004ba",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3219",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:33:22.667494000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508481202.667494000",
-          "frame.time_delta": "0.000897000",
-          "frame.time_delta_displayed": "0.000897000",
-          "frame.time_relative": "23490.262290000",
-          "frame.number": "22861",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00007d2f",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00003b8b",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "52564",
-          "udp.dstport": "53",
-          "udp.port": "52564",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00000e2e",
-          "udp.checksum.status": "2",
-          "udp.stream": "272"
-        },
-        "dns": {
-          "dns.response_in": "22862",
-          "dns.id": "0x000004bb",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:33:22.669032000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508481202.669032000",
-          "frame.time_delta": "0.001538000",
-          "frame.time_delta_displayed": "0.001538000",
-          "frame.time_relative": "23490.263828000",
-          "frame.number": "22862",
-          "frame.len": "269",
-          "frame.cap_len": "269",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "255",
-          "ip.id": "0x00008cea",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002b12",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "52564",
-          "udp.port": "53",
-          "udp.port": "52564",
-          "udp.length": "235",
-          "udp.checksum": "0x000082ee",
-          "udp.checksum.status": "2",
-          "udp.stream": "272"
-        },
-        "dns": {
-          "dns.response_to": "22861",
-          "dns.time": "0.001538000",
-          "dns.id": "0x000004bb",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "5",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3220",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "688",
-              "dns.resp.len": "10",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "688",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "688",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "153574",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "153574",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "171829",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "43551",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "43551",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:33:23.087037000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508481203.087037000",
-          "frame.time_delta": "0.001271000",
-          "frame.time_delta_displayed": "0.418005000",
-          "frame.time_relative": "23490.681833000",
-          "frame.number": "22878",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00007d4c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00003b6e",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "37188",
-          "udp.dstport": "53",
-          "udp.port": "37188",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00002f3d",
-          "udp.checksum.status": "2",
-          "udp.stream": "273"
-        },
-        "dns": {
-          "dns.response_in": "22879",
-          "dns.id": "0x000004bc",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:33:23.087591000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508481203.087591000",
-          "frame.time_delta": "0.000554000",
-          "frame.time_delta_displayed": "0.000554000",
-          "frame.time_relative": "23490.682387000",
-          "frame.number": "22879",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00008d00",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002bba",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "37188",
-          "udp.port": "53",
-          "udp.port": "37188",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "273"
-        },
-        "dns": {
-          "dns.response_to": "22878",
-          "dns.time": "0.000554000",
-          "dns.id": "0x000004bc",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:33:23.088490000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508481203.088490000",
-          "frame.time_delta": "0.000899000",
-          "frame.time_delta_displayed": "0.000899000",
-          "frame.time_relative": "23490.683286000",
-          "frame.number": "22880",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00007d4d",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00003b6d",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "57857",
-          "udp.dstport": "53",
-          "udp.port": "57857",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000f97e",
-          "udp.checksum.status": "2",
-          "udp.stream": "274"
-        },
-        "dns": {
-          "dns.response_in": "22881",
-          "dns.id": "0x000004bd",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:33:23.089060000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508481203.089060000",
-          "frame.time_delta": "0.000570000",
-          "frame.time_delta_displayed": "0.000570000",
-          "frame.time_relative": "23490.683856000",
-          "frame.number": "22881",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x00008d01",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002ba9",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "57857",
-          "udp.port": "53",
-          "udp.port": "57857",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "274"
-        },
-        "dns": {
-          "dns.response_to": "22880",
-          "dns.time": "0.000570000",
-          "dns.id": "0x000004bd",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3219",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:37:52.675652000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508481472.675652000",
-          "frame.time_delta": "1.044735000",
-          "frame.time_delta_displayed": "269.586592000",
-          "frame.time_relative": "23760.270448000",
-          "frame.number": "23158",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00009f5f",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000195e",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "41570",
-          "udp.dstport": "53",
-          "udp.port": "41570",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000b697",
-          "udp.checksum.status": "2",
-          "udp.stream": "280"
-        },
-        "dns": {
-          "dns.response_in": "23159",
-          "dns.id": "0x000004be",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:37:52.686467000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508481472.686467000",
-          "frame.time_delta": "0.010815000",
-          "frame.time_delta_displayed": "0.010815000",
-          "frame.time_relative": "23760.281263000",
-          "frame.number": "23159",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000db55",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000dbb2",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "41570",
-          "udp.port": "53",
-          "udp.port": "41570",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "280"
-        },
-        "dns": {
-          "dns.response_to": "23158",
-          "dns.time": "0.010815000",
-          "dns.id": "0x000004be",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "143",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "13158",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "174",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "174",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "174",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "174",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "174",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "174",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "174",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "174",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "174",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2701",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.131": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7242",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.131"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2015",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 165.254.134.239": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2080",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.239"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 173.223.52.70": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "487",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.70"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 96.17.70.191": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7043",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.191"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.223.52.70": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2623",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.70"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4728",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1178",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:52:52.690665000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508482372.690665000",
-          "frame.time_delta": "0.322371000",
-          "frame.time_delta_displayed": "900.004198000",
-          "frame.time_relative": "24660.285461000",
-          "frame.number": "23918",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00009671",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000224c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "42853",
-          "udp.dstport": "53",
-          "udp.port": "42853",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000b193",
-          "udp.checksum.status": "2",
-          "udp.stream": "284"
-        },
-        "dns": {
-          "dns.response_in": "23919",
-          "dns.id": "0x000004bf",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 19, 2017 23:52:52.711241000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508482372.711241000",
-          "frame.time_delta": "0.020576000",
-          "frame.time_delta_displayed": "0.020576000",
-          "frame.time_relative": "24660.306037000",
-          "frame.number": "23919",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00001d6b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000999d",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "42853",
-          "udp.port": "53",
-          "udp.port": "42853",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "284"
-        },
-        "dns": {
-          "dns.response_to": "23918",
-          "dns.time": "0.020576000",
-          "dns.id": "0x000004bf",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "119",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "10617",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1190",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1190",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1190",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1190",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1190",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1190",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1190",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1190",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1190",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3509",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 23.67.56.215": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2217",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.215"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2720",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2912",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 198.172.88.202": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1812",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.202"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 173.223.52.70": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3561",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.70"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3369",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.134.246": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3423",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.246"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3190",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:07:52.715432000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508483272.715432000",
-          "frame.time_delta": "0.798629000",
-          "frame.time_delta_displayed": "900.004191000",
-          "frame.time_relative": "25560.310228000",
-          "frame.number": "24682",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000a08f",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000182e",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53913",
-          "udp.dstport": "53",
-          "udp.port": "53913",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000865e",
-          "udp.checksum.status": "2",
-          "udp.stream": "288"
-        },
-        "dns": {
-          "dns.response_in": "24683",
-          "dns.id": "0x000004c0",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:07:52.722880000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508483272.722880000",
-          "frame.time_delta": "0.007448000",
-          "frame.time_delta_displayed": "0.007448000",
-          "frame.time_relative": "25560.317676000",
-          "frame.number": "24683",
-          "frame.len": "467",
-          "frame.cap_len": "467",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "453",
-          "ip.id": "0x000067fe",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00004f38",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "53913",
-          "udp.port": "53",
-          "udp.port": "53913",
-          "udp.length": "433",
-          "udp.checksum": "0x000083b4",
-          "udp.checksum.status": "2",
-          "udp.stream": "288"
-        },
-        "dns": {
-          "dns.response_to": "24682",
-          "dns.time": "0.007448000",
-          "dns.id": "0x000004c0",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "8",
-          "dns.count.add_rr": "8",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "143",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "11358",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "374",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "374",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "374",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "374",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "374",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "374",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "374",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "374",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "901",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.131": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5442",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.131"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "215",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 165.254.134.239": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "280",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.239"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 96.17.70.177": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4688",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.177"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 96.17.70.191": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5243",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.191"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.223.52.70": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "823",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.70"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2928",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:12:04.696340000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508483524.696340000",
-          "frame.time_delta": "0.145443000",
-          "frame.time_delta_displayed": "251.973460000",
-          "frame.time_relative": "25812.291136000",
-          "frame.number": "24953",
-          "frame.len": "83",
-          "frame.cap_len": "83",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "69",
-          "ip.id": "0x0000a209",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000016ad",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "49770",
-          "udp.dstport": "53",
-          "udp.port": "49770",
-          "udp.port": "53",
-          "udp.length": "49",
-          "udp.checksum": "0x0000cac1",
-          "udp.checksum.status": "2",
-          "udp.stream": "293"
-        },
-        "dns": {
-          "dns.response_in": "24954",
-          "dns.id": "0x00000043",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "diagnostics.meethue.com: type A, class IN": {
-              "dns.qry.name": "diagnostics.meethue.com",
-              "dns.qry.name.len": "23",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:12:04.767719000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508483524.767719000",
-          "frame.time_delta": "0.071379000",
-          "frame.time_delta_displayed": "0.071379000",
-          "frame.time_relative": "25812.362515000",
-          "frame.number": "24954",
-          "frame.len": "297",
-          "frame.cap_len": "297",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "283",
-          "ip.id": "0x00008814",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002fcc",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "49770",
-          "udp.port": "53",
-          "udp.port": "49770",
-          "udp.length": "263",
-          "udp.checksum": "0x0000830a",
-          "udp.checksum.status": "2",
-          "udp.stream": "293"
-        },
-        "dns": {
-          "dns.response_to": "24953",
-          "dns.time": "0.071379000",
-          "dns.id": "0x00000043",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "diagnostics.meethue.com: type A, class IN": {
-              "dns.qry.name": "diagnostics.meethue.com",
-              "dns.qry.name.len": "23",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "diagnostics.meethue.com: type A, class IN, addr 130.211.67.12": {
-              "dns.resp.name": "diagnostics.meethue.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "300",
-              "dns.resp.len": "4",
-              "dns.a": "130.211.67.12"
-            }
-          },
-          "Authoritative nameservers": {
-            "meethue.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "meethue.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1704",
-              "dns.resp.len": "18",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "meethue.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "meethue.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1704",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            },
-            "meethue.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "meethue.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1704",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "131086",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "155804",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "155804",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "134705",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "127278",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "127278",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:22:52.727669000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508484172.727669000",
-          "frame.time_delta": "3.871548000",
-          "frame.time_delta_displayed": "647.959950000",
-          "frame.time_relative": "26460.322465000",
-          "frame.number": "25506",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x000042c9",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000075f4",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "55301",
-          "udp.dstport": "53",
-          "udp.port": "55301",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x000080f1",
-          "udp.checksum.status": "2",
-          "udp.stream": "295"
-        },
-        "dns": {
-          "dns.response_in": "25507",
-          "dns.id": "0x000004c1",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:22:52.765073000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508484172.765073000",
-          "frame.time_delta": "0.037404000",
-          "frame.time_delta_displayed": "0.037404000",
-          "frame.time_relative": "26460.359869000",
-          "frame.number": "25507",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00000318",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b3f0",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "55301",
-          "udp.port": "53",
-          "udp.port": "55301",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "295"
-        },
-        "dns": {
-          "dns.response_to": "25506",
-          "dns.time": "0.037404000",
-          "dns.id": "0x000004c1",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "119",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "8817",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3390",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3390",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3390",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3390",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3390",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3390",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3390",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3390",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3390",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1709",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 23.67.56.215": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "417",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.215"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "920",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1112",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 198.172.88.202": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "12",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.202"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 173.223.52.70": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1761",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.70"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1569",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.134.246": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1623",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.246"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1390",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:33:23.301033000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508484803.301033000",
-          "frame.time_delta": "0.159453000",
-          "frame.time_delta_displayed": "630.535960000",
-          "frame.time_relative": "27090.895829000",
-          "frame.number": "26095",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000aa78",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000e42",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "60609",
-          "udp.dstport": "53",
-          "udp.port": "60609",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000d3b9",
-          "udp.checksum.status": "2",
-          "udp.stream": "299"
-        },
-        "dns": {
-          "dns.response_in": "26096",
-          "dns.id": "0x000004c2",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:33:23.303089000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508484803.303089000",
-          "frame.time_delta": "0.002056000",
-          "frame.time_delta_displayed": "0.002056000",
-          "frame.time_relative": "27090.897885000",
-          "frame.number": "26096",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x0000a9d2",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000eae",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "60609",
-          "udp.port": "53",
-          "udp.port": "60609",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "299"
-        },
-        "dns": {
-          "dns.response_to": "26095",
-          "dns.time": "0.002056000",
-          "dns.id": "0x000004c2",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3219",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:33:23.303940000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508484803.303940000",
-          "frame.time_delta": "0.000851000",
-          "frame.time_delta_displayed": "0.000851000",
-          "frame.time_relative": "27090.898736000",
-          "frame.number": "26097",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000aa79",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000e41",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "45112",
-          "udp.dstport": "53",
-          "udp.port": "45112",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00002b42",
-          "udp.checksum.status": "2",
-          "udp.stream": "300"
-        },
-        "dns": {
-          "dns.response_in": "26098",
-          "dns.id": "0x000004c3",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:33:23.305709000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508484803.305709000",
-          "frame.time_delta": "0.001769000",
-          "frame.time_delta_displayed": "0.001769000",
-          "frame.time_relative": "27090.900505000",
-          "frame.number": "26098",
-          "frame.len": "269",
-          "frame.cap_len": "269",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "255",
-          "ip.id": "0x0000a9d3",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000e29",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "45112",
-          "udp.port": "53",
-          "udp.port": "45112",
-          "udp.length": "235",
-          "udp.checksum": "0x000082ee",
-          "udp.checksum.status": "2",
-          "udp.stream": "300"
-        },
-        "dns": {
-          "dns.response_to": "26097",
-          "dns.time": "0.001769000",
-          "dns.id": "0x000004c3",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "5",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3219",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "689",
-              "dns.resp.len": "10",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "689",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "689",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "149973",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "149973",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "168228",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "39950",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "39950",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:33:23.726935000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508484803.726935000",
-          "frame.time_delta": "0.001538000",
-          "frame.time_delta_displayed": "0.421226000",
-          "frame.time_relative": "27091.321731000",
-          "frame.number": "26114",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000aaa1",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000e19",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "47836",
-          "udp.dstport": "53",
-          "udp.port": "47836",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000059d",
-          "udp.checksum.status": "2",
-          "udp.stream": "301"
-        },
-        "dns": {
-          "dns.response_in": "26115",
-          "dns.id": "0x000004c4",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:33:23.727513000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508484803.727513000",
-          "frame.time_delta": "0.000578000",
-          "frame.time_delta_displayed": "0.000578000",
-          "frame.time_relative": "27091.322309000",
-          "frame.number": "26115",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000a9f1",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000ec9",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "47836",
-          "udp.port": "53",
-          "udp.port": "47836",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "301"
-        },
-        "dns": {
-          "dns.response_to": "26114",
-          "dns.time": "0.000578000",
-          "dns.id": "0x000004c4",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:33:23.728355000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508484803.728355000",
-          "frame.time_delta": "0.000842000",
-          "frame.time_delta_displayed": "0.000842000",
-          "frame.time_relative": "27091.323151000",
-          "frame.number": "26116",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000aaa2",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000e18",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "59436",
-          "udp.dstport": "53",
-          "udp.port": "59436",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000f34b",
-          "udp.checksum.status": "2",
-          "udp.stream": "302"
-        },
-        "dns": {
-          "dns.response_in": "26117",
-          "dns.id": "0x000004c5",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:33:23.728777000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508484803.728777000",
-          "frame.time_delta": "0.000422000",
-          "frame.time_delta_displayed": "0.000422000",
-          "frame.time_relative": "27091.323573000",
-          "frame.number": "26117",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x0000a9f2",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000eb8",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "59436",
-          "udp.port": "53",
-          "udp.port": "59436",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "302"
-        },
-        "dns": {
-          "dns.response_to": "26116",
-          "dns.time": "0.000422000",
-          "dns.id": "0x000004c5",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3219",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:37:52.772955000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508485072.772955000",
-          "frame.time_delta": "1.222355000",
-          "frame.time_delta_displayed": "269.044178000",
-          "frame.time_relative": "27360.367751000",
-          "frame.number": "26369",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000ce92",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000ea2a",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "45574",
-          "udp.dstport": "53",
-          "udp.port": "45574",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000a6eb",
-          "udp.checksum.status": "2",
-          "udp.stream": "304"
-        },
-        "dns": {
-          "dns.response_in": "26370",
-          "dns.id": "0x000004c6",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:37:52.788820000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508485072.788820000",
-          "frame.time_delta": "0.015865000",
-          "frame.time_delta_displayed": "0.015865000",
-          "frame.time_relative": "27360.383616000",
-          "frame.number": "26370",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000cb7f",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000eb88",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "45574",
-          "udp.port": "53",
-          "udp.port": "45574",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "304"
-        },
-        "dns": {
-          "dns.response_to": "26369",
-          "dns.time": "0.015865000",
-          "dns.id": "0x000004c6",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "9558",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2574",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2574",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2574",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2574",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2574",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2574",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2574",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2574",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2574",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3102",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.131": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3642",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.131"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.16.94": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6416",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.94"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.176": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2481",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.176"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 96.17.70.177": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2888",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.177"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 96.17.70.191": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3443",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.191"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.177": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3024",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.177"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1128",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4574",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:52:52.797929000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508485972.797929000",
-          "frame.time_delta": "1.729711000",
-          "frame.time_delta_displayed": "900.009109000",
-          "frame.time_relative": "28260.392725000",
-          "frame.number": "27288",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000fdad",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bb0f",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "57726",
-          "udp.dstport": "53",
-          "udp.port": "57726",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00007772",
-          "udp.checksum.status": "2",
-          "udp.stream": "311"
-        },
-        "dns": {
-          "dns.response_in": "27289",
-          "dns.id": "0x000004c7",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 00:52:52.808637000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508485972.808637000",
-          "frame.time_delta": "0.010708000",
-          "frame.time_delta_displayed": "0.010708000",
-          "frame.time_relative": "28260.403433000",
-          "frame.number": "27289",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000efa6",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000c761",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "57726",
-          "udp.port": "53",
-          "udp.port": "57726",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "311"
-        },
-        "dns": {
-          "dns.response_to": "27288",
-          "dns.time": "0.010708000",
-          "dns.id": "0x000004c7",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "8658",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1674",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1674",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1674",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1674",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1674",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1674",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1674",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1674",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1674",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2202",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.131": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2742",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.131"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.16.94": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5516",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.94"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.176": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1581",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.176"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 96.17.70.177": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1988",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.177"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 96.17.70.191": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2543",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.191"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.177": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2124",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.177"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "228",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3674",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:07:52.814329000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508486872.814329000",
-          "frame.time_delta": "5.472047000",
-          "frame.time_delta_displayed": "900.005692000",
-          "frame.time_relative": "29160.409125000",
-          "frame.number": "28061",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000614d",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00005770",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "39493",
-          "udp.dstport": "53",
-          "udp.port": "39493",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000beaa",
-          "udp.checksum.status": "2",
-          "udp.stream": "315"
-        },
-        "dns": {
-          "dns.response_in": "28062",
-          "dns.id": "0x000004c8",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:07:52.835978000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508486872.835978000",
-          "frame.time_delta": "0.021649000",
-          "frame.time_delta_displayed": "0.021649000",
-          "frame.time_relative": "29160.430774000",
-          "frame.number": "28062",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00000e9b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000a86d",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "39493",
-          "udp.port": "53",
-          "udp.port": "39493",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "315"
-        },
-        "dns": {
-          "dns.response_to": "28061",
-          "dns.time": "0.021649000",
-          "dns.id": "0x000004c8",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "119",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6117",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "690",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3011",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5718",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 204.2.166.155": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6226",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.155"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 23.67.56.207": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2421",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.207"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 96.17.70.174": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3318",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.174"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 23.67.56.215": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7067",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.215"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 23.67.56.213": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2874",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.213"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.2.166.155": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4925",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.155"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4702",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:22:52.843589000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508487772.843589000",
-          "frame.time_delta": "0.601966000",
-          "frame.time_delta_displayed": "900.007611000",
-          "frame.time_relative": "30060.438385000",
-          "frame.number": "28868",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00008683",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000323a",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "60232",
-          "udp.dstport": "53",
-          "udp.port": "60232",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00006da6",
-          "udp.checksum.status": "2",
-          "udp.stream": "322"
-        },
-        "dns": {
-          "dns.response_in": "28869",
-          "dns.id": "0x000004c9",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:22:52.850618000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508487772.850618000",
-          "frame.time_delta": "0.007029000",
-          "frame.time_delta_displayed": "0.007029000",
-          "frame.time_relative": "30060.445414000",
-          "frame.number": "28869",
-          "frame.len": "467",
-          "frame.cap_len": "467",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "453",
-          "ip.id": "0x000032d6",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00008460",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "60232",
-          "udp.port": "53",
-          "udp.port": "60232",
-          "udp.length": "433",
-          "udp.checksum": "0x000083b4",
-          "udp.checksum.status": "2",
-          "udp.stream": "322"
-        },
-        "dns": {
-          "dns.response_to": "28868",
-          "dns.time": "0.007029000",
-          "dns.id": "0x000004c9",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "8",
-          "dns.count.add_rr": "8",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6858",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "874",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "874",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "874",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "874",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "874",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "874",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "874",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "874",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "402",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.131": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "942",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.131"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.16.94": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3716",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.94"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 23.67.56.213": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3782",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.213"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 96.17.70.177": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "188",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.177"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 96.17.70.191": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "743",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.191"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.177": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "324",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.177"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.134.243": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4429",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.243"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:33:21.755985000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508488401.755985000",
-          "frame.time_delta": "1.940613000",
-          "frame.time_delta_displayed": "628.905367000",
-          "frame.time_relative": "30689.350781000",
-          "frame.number": "29396",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00009aad",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00001e0d",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "43519",
-          "udp.dstport": "53",
-          "udp.port": "43519",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00001674",
-          "udp.checksum.status": "2",
-          "udp.stream": "327"
-        },
-        "dns": {
-          "dns.response_in": "29397",
-          "dns.id": "0x000004ca",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:33:21.757930000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508488401.757930000",
-          "frame.time_delta": "0.001945000",
-          "frame.time_delta_displayed": "0.001945000",
-          "frame.time_relative": "30689.352726000",
-          "frame.number": "29397",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x0000a15f",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00001721",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "43519",
-          "udp.port": "53",
-          "udp.port": "43519",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "327"
-        },
-        "dns": {
-          "dns.response_to": "29396",
-          "dns.time": "0.001945000",
-          "dns.id": "0x000004ca",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3221",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:33:21.758751000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508488401.758751000",
-          "frame.time_delta": "0.000821000",
-          "frame.time_delta_displayed": "0.000821000",
-          "frame.time_relative": "30689.353547000",
-          "frame.number": "29398",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00009aae",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00001e0c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "34772",
-          "udp.dstport": "53",
-          "udp.port": "34772",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000539e",
-          "udp.checksum.status": "2",
-          "udp.stream": "328"
-        },
-        "dns": {
-          "dns.response_in": "29399",
-          "dns.id": "0x000004cb",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:33:21.760366000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508488401.760366000",
-          "frame.time_delta": "0.001615000",
-          "frame.time_delta_displayed": "0.001615000",
-          "frame.time_relative": "30689.355162000",
-          "frame.number": "29399",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x0000a160",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000168c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "34772",
-          "udp.port": "53",
-          "udp.port": "34772",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "328"
-        },
-        "dns": {
-          "dns.response_to": "29398",
-          "dns.time": "0.001615000",
-          "dns.id": "0x000004cb",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3221",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1322",
-              "dns.resp.len": "10",
-              "dns.ns": "ns2.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1322",
-              "dns.resp.len": "6",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1322",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "442",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "146375",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "146375",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "164630",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "36352",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "36352",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:33:22.179535000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508488402.179535000",
-          "frame.time_delta": "0.001270000",
-          "frame.time_delta_displayed": "0.419169000",
-          "frame.time_relative": "30689.774331000",
-          "frame.number": "29415",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00009ac2",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00001df8",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "32927",
-          "udp.dstport": "53",
-          "udp.port": "32927",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00003fd2",
-          "udp.checksum.status": "2",
-          "udp.stream": "329"
-        },
-        "dns": {
-          "dns.response_in": "29416",
-          "dns.id": "0x000004cc",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:33:22.180074000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508488402.180074000",
-          "frame.time_delta": "0.000539000",
-          "frame.time_delta_displayed": "0.000539000",
-          "frame.time_relative": "30689.774870000",
-          "frame.number": "29416",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000a17c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000173e",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "32927",
-          "udp.port": "53",
-          "udp.port": "32927",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "329"
-        },
-        "dns": {
-          "dns.response_to": "29415",
-          "dns.time": "0.000539000",
-          "dns.id": "0x000004cc",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:33:22.181272000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508488402.181272000",
-          "frame.time_delta": "0.001198000",
-          "frame.time_delta_displayed": "0.001198000",
-          "frame.time_relative": "30689.776068000",
-          "frame.number": "29417",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00009ac3",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00001df7",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "50502",
-          "udp.dstport": "53",
-          "udp.port": "50502",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000162a",
-          "udp.checksum.status": "2",
-          "udp.stream": "330"
-        },
-        "dns": {
-          "dns.response_in": "29418",
-          "dns.id": "0x000004cd",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:33:22.181706000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508488402.181706000",
-          "frame.time_delta": "0.000434000",
-          "frame.time_delta_displayed": "0.000434000",
-          "frame.time_relative": "30689.776502000",
-          "frame.number": "29418",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x0000a17d",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000172d",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "50502",
-          "udp.port": "53",
-          "udp.port": "50502",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "330"
-        },
-        "dns": {
-          "dns.response_to": "29417",
-          "dns.time": "0.000434000",
-          "dns.id": "0x000004cd",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3220",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:37:52.855829000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508488672.855829000",
-          "frame.time_delta": "3.621068000",
-          "frame.time_delta_displayed": "270.674123000",
-          "frame.time_relative": "30960.450625000",
-          "frame.number": "29698",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000af13",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000009aa",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "51191",
-          "udp.dstport": "53",
-          "udp.port": "51191",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x000090f2",
-          "udp.checksum.status": "2",
-          "udp.stream": "331"
-        },
-        "dns": {
-          "dns.response_in": "29699",
-          "dns.id": "0x000004ce",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:37:52.862182000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508488672.862182000",
-          "frame.time_delta": "0.006353000",
-          "frame.time_delta_displayed": "0.006353000",
-          "frame.time_relative": "30960.456978000",
-          "frame.number": "29699",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000ff8b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b77c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "51191",
-          "udp.port": "53",
-          "udp.port": "51191",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "331"
-        },
-        "dns": {
-          "dns.response_to": "29698",
-          "dns.time": "0.006353000",
-          "dns.id": "0x000004ce",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5958",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3974",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3974",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3974",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3974",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3974",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3974",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3974",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3974",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3974",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3503",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.131": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "42",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.131"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.16.94": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2816",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.94"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 23.67.56.213": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2882",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.213"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 96.17.70.175": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5291",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.175"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7844",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.177": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3426",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.177"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.134.243": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3529",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.243"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "974",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:52:52.869701000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508489572.869701000",
-          "frame.time_delta": "1.064777000",
-          "frame.time_delta_displayed": "900.007519000",
-          "frame.time_relative": "31860.464497000",
-          "frame.number": "30491",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000c558",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000f364",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "43504",
-          "udp.dstport": "53",
-          "udp.port": "43504",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000aef8",
-          "udp.checksum.status": "2",
-          "udp.stream": "337"
-        },
-        "dns": {
-          "dns.response_in": "30492",
-          "dns.id": "0x000004cf",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 01:52:52.875803000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508489572.875803000",
-          "frame.time_delta": "0.006102000",
-          "frame.time_delta_displayed": "0.006102000",
-          "frame.time_relative": "31860.470599000",
-          "frame.number": "30492",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00004e2b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000068dd",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "43504",
-          "udp.port": "53",
-          "udp.port": "43504",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "337"
-        },
-        "dns": {
-          "dns.response_to": "30491",
-          "dns.time": "0.006102000",
-          "dns.id": "0x000004cf",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5058",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3074",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3074",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3074",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3074",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3074",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3074",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3074",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3074",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3074",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2603",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7144",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.16.94": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1916",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.94"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 23.67.56.213": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1982",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.213"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 96.17.70.175": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4391",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.175"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6944",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.177": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2526",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.177"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.134.243": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2629",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.243"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "74",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:07:52.881831000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508490472.881831000",
-          "frame.time_delta": "1.602333000",
-          "frame.time_delta_displayed": "900.006028000",
-          "frame.time_relative": "32760.476627000",
-          "frame.number": "31269",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000ce88",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000ea34",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "38554",
-          "udp.dstport": "53",
-          "udp.port": "38554",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000c24d",
-          "udp.checksum.status": "2",
-          "udp.stream": "343"
-        },
-        "dns": {
-          "dns.response_in": "31270",
-          "dns.id": "0x000004d0",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:07:52.891762000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508490472.891762000",
-          "frame.time_delta": "0.009931000",
-          "frame.time_delta_displayed": "0.009931000",
-          "frame.time_relative": "32760.486558000",
-          "frame.number": "31270",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00000e5c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000a8ac",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "38554",
-          "udp.port": "53",
-          "udp.port": "38554",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "343"
-        },
-        "dns": {
-          "dns.response_to": "31269",
-          "dns.time": "0.009931000",
-          "dns.id": "0x000004d0",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4158",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2174",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2174",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2174",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2174",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2174",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2174",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2174",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2174",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2174",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1703",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6244",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.16.94": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1016",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.16.94"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 23.67.56.213": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1082",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.213"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 96.17.70.175": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3491",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.175"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6044",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.177": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1626",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.177"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.134.243": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1729",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.134.243"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5177",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:22:52.901114000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508491372.901114000",
-          "frame.time_delta": "1.849865000",
-          "frame.time_delta_displayed": "900.009352000",
-          "frame.time_relative": "33660.495910000",
-          "frame.number": "32056",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00004594",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00007329",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "33202",
-          "udp.dstport": "53",
-          "udp.port": "33202",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000d734",
-          "udp.checksum.status": "2",
-          "udp.stream": "348"
-        },
-        "dns": {
-          "dns.response_in": "32057",
-          "dns.id": "0x000004d1",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:22:52.972380000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508491372.972380000",
-          "frame.time_delta": "0.071266000",
-          "frame.time_delta_displayed": "0.071266000",
-          "frame.time_relative": "33660.567176000",
-          "frame.number": "32057",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00002997",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00008d71",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "33202",
-          "udp.port": "53",
-          "udp.port": "33202",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "348"
-        },
-        "dns": {
-          "dns.response_to": "32056",
-          "dns.time": "0.071266000",
-          "dns.id": "0x000004d1",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "120",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1617",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1191",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1191",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1191",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1191",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1191",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1191",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1191",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1191",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1191",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2514",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1218",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 204.2.166.155": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1726",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.155"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 204.2.166.155": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1922",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.155"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 204.2.166.151": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4820",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.151"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 23.67.56.215": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2567",
-              "dns.resp.len": "4",
-              "dns.a": "23.67.56.215"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 204.2.166.151": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2380",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.151"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.2.166.155": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "425",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.155"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "202",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:33:22.349285000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508492002.349285000",
-          "frame.time_delta": "0.837648000",
-          "frame.time_delta_displayed": "629.376905000",
-          "frame.time_relative": "34289.944081000",
-          "frame.number": "32626",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000f99e",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bf1b",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "52881",
-          "udp.dstport": "53",
-          "udp.port": "52881",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000f1d9",
-          "udp.checksum.status": "2",
-          "udp.stream": "352"
-        },
-        "dns": {
-          "dns.response_in": "32627",
-          "dns.id": "0x000004d2",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:33:22.351230000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508492002.351230000",
-          "frame.time_delta": "0.001945000",
-          "frame.time_delta_displayed": "0.001945000",
-          "frame.time_relative": "34289.946026000",
-          "frame.number": "32627",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x0000ba2d",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000fe52",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "52881",
-          "udp.port": "53",
-          "udp.port": "52881",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "352"
-        },
-        "dns": {
-          "dns.response_to": "32626",
-          "dns.time": "0.001945000",
-          "dns.id": "0x000004d2",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3220",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:33:22.352051000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508492002.352051000",
-          "frame.time_delta": "0.000821000",
-          "frame.time_delta_displayed": "0.000821000",
-          "frame.time_relative": "34289.946847000",
-          "frame.number": "32628",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000f99f",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bf1a",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "43337",
-          "udp.dstport": "53",
-          "udp.port": "43337",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00003221",
-          "udp.checksum.status": "2",
-          "udp.stream": "353"
-        },
-        "dns": {
-          "dns.response_in": "32629",
-          "dns.id": "0x000004d3",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:33:22.392543000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508492002.392543000",
-          "frame.time_delta": "0.040492000",
-          "frame.time_delta_displayed": "0.040492000",
-          "frame.time_relative": "34289.987339000",
-          "frame.number": "32629",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x0000ba30",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000fdbb",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "43337",
-          "udp.port": "53",
-          "udp.port": "43337",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "353"
-        },
-        "dns": {
-          "dns.response_to": "32628",
-          "dns.time": "0.040492000",
-          "dns.id": "0x000004d3",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3220",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1411",
-              "dns.resp.len": "10",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1411",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1411",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "171851",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "142774",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "142774",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "161029",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "32751",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "32751",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:33:22.810223000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508492002.810223000",
-          "frame.time_delta": "0.001028000",
-          "frame.time_delta_displayed": "0.417680000",
-          "frame.time_relative": "34290.405019000",
-          "frame.number": "32645",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000f9af",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bf0a",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "54367",
-          "udp.dstport": "53",
-          "udp.port": "54367",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000ec09",
-          "udp.checksum.status": "2",
-          "udp.stream": "354"
-        },
-        "dns": {
-          "dns.response_in": "32646",
-          "dns.id": "0x000004d4",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:33:22.810817000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508492002.810817000",
-          "frame.time_delta": "0.000594000",
-          "frame.time_delta_displayed": "0.000594000",
-          "frame.time_relative": "34290.405613000",
-          "frame.number": "32646",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000ba35",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000fe84",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "54367",
-          "udp.port": "53",
-          "udp.port": "54367",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "354"
-        },
-        "dns": {
-          "dns.response_to": "32645",
-          "dns.time": "0.000594000",
-          "dns.id": "0x000004d4",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:33:22.811626000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508492002.811626000",
-          "frame.time_delta": "0.000809000",
-          "frame.time_delta_displayed": "0.000809000",
-          "frame.time_relative": "34290.406422000",
-          "frame.number": "32647",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000f9b0",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bf09",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "39432",
-          "udp.dstport": "53",
-          "udp.port": "39432",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00004160",
-          "udp.checksum.status": "2",
-          "udp.stream": "355"
-        },
-        "dns": {
-          "dns.response_in": "32648",
-          "dns.id": "0x000004d5",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:33:22.812191000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508492002.812191000",
-          "frame.time_delta": "0.000565000",
-          "frame.time_delta_displayed": "0.000565000",
-          "frame.time_relative": "34290.406987000",
-          "frame.number": "32648",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x0000ba36",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000fe73",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "39432",
-          "udp.port": "53",
-          "udp.port": "39432",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "355"
-        },
-        "dns": {
-          "dns.response_to": "32647",
-          "dns.time": "0.000565000",
-          "dns.id": "0x000004d5",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3220",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:37:53.011030000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508492273.011030000",
-          "frame.time_delta": "0.622307000",
-          "frame.time_delta_displayed": "270.198839000",
-          "frame.time_relative": "34560.605826000",
-          "frame.number": "32884",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000400c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000078b1",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "44772",
-          "udp.dstport": "53",
-          "udp.port": "44772",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000a9fd",
-          "udp.checksum.status": "2",
-          "udp.stream": "356"
-        },
-        "dns": {
-          "dns.response_in": "32885",
-          "dns.id": "0x000004d6",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:37:53.016866000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508492273.016866000",
-          "frame.time_delta": "0.005836000",
-          "frame.time_delta_displayed": "0.005836000",
-          "frame.time_relative": "34560.611662000",
-          "frame.number": "32885",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000c41b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000f2ec",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "44772",
-          "udp.port": "53",
-          "udp.port": "44772",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "356"
-        },
-        "dns": {
-          "dns.response_to": "32884",
-          "dns.time": "0.005836000",
-          "dns.id": "0x000004d6",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "143",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2357",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "373",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "373",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "373",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "373",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "373",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "373",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "373",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "373",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "373",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3904",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4443",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 96.17.70.175": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7217",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.175"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.174": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3284",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.174"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 96.17.70.175": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1690",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.175"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4243",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3827",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5929",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3376",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:52:53.027071000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508493173.027071000",
-          "frame.time_delta": "3.719993000",
-          "frame.time_delta_displayed": "900.010205000",
-          "frame.time_relative": "35460.621867000",
-          "frame.number": "33758",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x000044d0",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000073ed",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "54661",
-          "udp.dstport": "53",
-          "udp.port": "54661",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000835b",
-          "udp.checksum.status": "2",
-          "udp.stream": "360"
-        },
-        "dns": {
-          "dns.response_in": "33759",
-          "dns.id": "0x000004d7",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 02:52:53.101742000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508493173.101742000",
-          "frame.time_delta": "0.074671000",
-          "frame.time_delta_displayed": "0.074671000",
-          "frame.time_relative": "35460.696538000",
-          "frame.number": "33759",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000f93b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bdcc",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "54661",
-          "udp.port": "53",
-          "udp.port": "54661",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "360"
-        },
-        "dns": {
-          "dns.response_to": "33758",
-          "dns.time": "0.074671000",
-          "dns.id": "0x000004d7",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "300",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1457",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3473",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3473",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3473",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3473",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3473",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3473",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3473",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3473",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3473",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3004",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3543",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 96.17.70.175": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6317",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.175"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.174": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2384",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.174"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 96.17.70.175": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "790",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.175"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3343",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2927",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5029",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2476",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:07:53.107570000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508494073.107570000",
-          "frame.time_delta": "7.786097000",
-          "frame.time_delta_displayed": "900.005828000",
-          "frame.time_relative": "36360.702366000",
-          "frame.number": "34517",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000f210",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000c6ac",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "49914",
-          "udp.dstport": "53",
-          "udp.port": "49914",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x000095e5",
-          "udp.checksum.status": "2",
-          "udp.stream": "368"
-        },
-        "dns": {
-          "dns.response_in": "34518",
-          "dns.id": "0x000004d8",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:07:53.114086000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508494073.114086000",
-          "frame.time_delta": "0.006516000",
-          "frame.time_delta_displayed": "0.006516000",
-          "frame.time_relative": "36360.708882000",
-          "frame.number": "34518",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000cccb",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000ea3c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "49914",
-          "udp.port": "53",
-          "udp.port": "49914",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "368"
-        },
-        "dns": {
-          "dns.response_to": "34517",
-          "dns.time": "0.006516000",
-          "dns.id": "0x000004d8",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "143",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "557",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2573",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2573",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2573",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2573",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2573",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2573",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2573",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2573",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2573",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2104",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2643",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 96.17.70.175": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5417",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.175"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.174": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1484",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.174"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 209.18.46.225": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5891",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.225"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2443",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2027",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4129",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1576",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:22:53.123990000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508494973.123990000",
-          "frame.time_delta": "1.660357000",
-          "frame.time_delta_displayed": "900.009904000",
-          "frame.time_relative": "37260.718786000",
-          "frame.number": "35283",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x000001f8",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b6c5",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "44922",
-          "udp.dstport": "53",
-          "udp.port": "44922",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000a964",
-          "udp.checksum.status": "2",
-          "udp.stream": "372"
-        },
-        "dns": {
-          "dns.response_in": "35284",
-          "dns.id": "0x000004d9",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:22:53.134103000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508494973.134103000",
-          "frame.time_delta": "0.010113000",
-          "frame.time_delta_displayed": "0.010113000",
-          "frame.time_relative": "37260.728899000",
-          "frame.number": "35284",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x000006d5",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b033",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "44922",
-          "udp.port": "53",
-          "udp.port": "44922",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "372"
-        },
-        "dns": {
-          "dns.response_to": "35283",
-          "dns.time": "0.010113000",
-          "dns.id": "0x000004d9",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "21444",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1673",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1673",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1673",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1673",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1673",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1673",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1673",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1673",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1673",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1204",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1743",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 96.17.70.175": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4517",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.175"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.174": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "584",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.174"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 209.18.46.225": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4991",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.225"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1543",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1127",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3229",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "676",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:33:22.916241000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508495602.916241000",
-          "frame.time_delta": "3.559096000",
-          "frame.time_delta_displayed": "629.782138000",
-          "frame.time_relative": "37890.511037000",
-          "frame.number": "35811",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00007ba1",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00003d19",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "49663",
-          "udp.dstport": "53",
-          "udp.port": "49663",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000fe63",
-          "udp.checksum.status": "2",
-          "udp.stream": "376"
-        },
-        "dns": {
-          "dns.response_in": "35812",
-          "dns.id": "0x000004da",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:33:22.918183000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508495602.918183000",
-          "frame.time_delta": "0.001942000",
-          "frame.time_delta_displayed": "0.001942000",
-          "frame.time_relative": "37890.512979000",
-          "frame.number": "35812",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x0000d276",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000e609",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "49663",
-          "udp.port": "53",
-          "udp.port": "49663",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "376"
-        },
-        "dns": {
-          "dns.response_to": "35811",
-          "dns.time": "0.001942000",
-          "dns.id": "0x000004da",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1787",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:33:22.920557000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508495602.920557000",
-          "frame.time_delta": "0.002374000",
-          "frame.time_delta_displayed": "0.002374000",
-          "frame.time_relative": "37890.515353000",
-          "frame.number": "35813",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00007ba2",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00003d18",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "33688",
-          "udp.dstport": "53",
-          "udp.port": "33688",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x000057ca",
-          "udp.checksum.status": "2",
-          "udp.stream": "377"
-        },
-        "dns": {
-          "dns.response_in": "35814",
-          "dns.id": "0x000004db",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:33:22.922284000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508495602.922284000",
-          "frame.time_delta": "0.001727000",
-          "frame.time_delta_displayed": "0.001727000",
-          "frame.time_relative": "37890.517080000",
-          "frame.number": "35814",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x0000d277",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000e574",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "33688",
-          "udp.port": "53",
-          "udp.port": "33688",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "377"
-        },
-        "dns": {
-          "dns.response_to": "35813",
-          "dns.time": "0.001727000",
-          "dns.id": "0x000004db",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2989",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1787",
-              "dns.resp.len": "10",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1787",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1787",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "119008",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "143726",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "143726",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "122627",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "115200",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "115200",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:33:23.341511000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508495603.341511000",
-          "frame.time_delta": "0.001324000",
-          "frame.time_delta_displayed": "0.419227000",
-          "frame.time_relative": "37890.936307000",
-          "frame.number": "35830",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00007bba",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00003d00",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "36096",
-          "udp.dstport": "53",
-          "udp.port": "36096",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00003361",
-          "udp.checksum.status": "2",
-          "udp.stream": "378"
-        },
-        "dns": {
-          "dns.response_in": "35831",
-          "dns.id": "0x000004dc",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:33:23.341806000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508495603.341806000",
-          "frame.time_delta": "0.000295000",
-          "frame.time_delta_displayed": "0.000295000",
-          "frame.time_relative": "37890.936602000",
-          "frame.number": "35831",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000d284",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000e635",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "36096",
-          "udp.port": "53",
-          "udp.port": "36096",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "378"
-        },
-        "dns": {
-          "dns.response_to": "35830",
-          "dns.time": "0.000295000",
-          "dns.id": "0x000004dc",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:33:23.342577000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508495603.342577000",
-          "frame.time_delta": "0.000771000",
-          "frame.time_delta_displayed": "0.000771000",
-          "frame.time_relative": "37890.937373000",
-          "frame.number": "35832",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00007bbb",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00003cff",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "49358",
-          "udp.dstport": "53",
-          "udp.port": "49358",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00001a92",
-          "udp.checksum.status": "2",
-          "udp.stream": "379"
-        },
-        "dns": {
-          "dns.response_in": "35833",
-          "dns.id": "0x000004dd",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:33:23.342908000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508495603.342908000",
-          "frame.time_delta": "0.000331000",
-          "frame.time_delta_displayed": "0.000331000",
-          "frame.time_relative": "37890.937704000",
-          "frame.number": "35833",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x0000d285",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000e624",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "49358",
-          "udp.port": "53",
-          "udp.port": "49358",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "379"
-        },
-        "dns": {
-          "dns.response_to": "35832",
-          "dns.time": "0.000331000",
-          "dns.id": "0x000004dd",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2988",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:37:53.142390000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508495873.142390000",
-          "frame.time_delta": "3.770169000",
-          "frame.time_delta_displayed": "269.799482000",
-          "frame.time_relative": "38160.737186000",
-          "frame.number": "36053",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000d08e",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000e82e",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "36775",
-          "udp.dstport": "53",
-          "udp.port": "36775",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000c932",
-          "udp.checksum.status": "2",
-          "udp.stream": "380"
-        },
-        "dns": {
-          "dns.response_in": "36054",
-          "dns.id": "0x000004de",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:37:53.148990000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508495873.148990000",
-          "frame.time_delta": "0.006600000",
-          "frame.time_delta_displayed": "0.006600000",
-          "frame.time_relative": "38160.743786000",
-          "frame.number": "36054",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000fff7",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b710",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "36775",
-          "udp.port": "53",
-          "udp.port": "36775",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "380"
-        },
-        "dns": {
-          "dns.response_to": "36053",
-          "dns.time": "0.006600000",
-          "dns.id": "0x000004de",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20544",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "773",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "773",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "773",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "773",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "773",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "773",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "773",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "773",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "773",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "304",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "843",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 96.17.70.175": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3617",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.175"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3691",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 209.18.46.225": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4091",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.225"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "643",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 204.2.166.154": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "227",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.154"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2329",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5779",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:52:53.157944000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508496773.157944000",
-          "frame.time_delta": "0.549528000",
-          "frame.time_delta_displayed": "900.008954000",
-          "frame.time_relative": "39060.752740000",
-          "frame.number": "36810",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000fe35",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000ba87",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "58619",
-          "udp.dstport": "53",
-          "udp.port": "58619",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x000073dd",
-          "udp.checksum.status": "2",
-          "udp.stream": "384"
-        },
-        "dns": {
-          "dns.response_in": "36811",
-          "dns.id": "0x000004df",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 03:52:53.164664000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508496773.164664000",
-          "frame.time_delta": "0.006720000",
-          "frame.time_delta_displayed": "0.006720000",
-          "frame.time_relative": "39060.759460000",
-          "frame.number": "36811",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00004af7",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00006c11",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "58619",
-          "udp.port": "53",
-          "udp.port": "58619",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "384"
-        },
-        "dns": {
-          "dns.response_to": "36810",
-          "dns.time": "0.006720000",
-          "dns.id": "0x000004df",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "144",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "19644",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3873",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3873",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3873",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3873",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3873",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3873",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3873",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3873",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3873",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3407",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 96.17.70.173": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7948",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.173"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 96.17.70.175": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2717",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.175"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2791",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 209.18.46.225": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3191",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.225"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 209.18.46.218": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7745",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.218"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.223.52.131": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3330",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.131"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1429",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4879",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:07:53.171491000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508497673.171491000",
-          "frame.time_delta": "3.380707000",
-          "frame.time_delta_displayed": "900.006827000",
-          "frame.time_relative": "39960.766287000",
-          "frame.number": "37558",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00001426",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000a497",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "46109",
-          "udp.dstport": "53",
-          "udp.port": "46109",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000a4ba",
-          "udp.checksum.status": "2",
-          "udp.stream": "388"
-        },
-        "dns": {
-          "dns.response_in": "37559",
-          "dns.id": "0x000004e0",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:07:53.178025000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508497673.178025000",
-          "frame.time_delta": "0.006534000",
-          "frame.time_delta_displayed": "0.006534000",
-          "frame.time_relative": "39960.772821000",
-          "frame.number": "37559",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000d1c0",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000e547",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "46109",
-          "udp.port": "53",
-          "udp.port": "46109",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "388"
-        },
-        "dns": {
-          "dns.response_to": "37558",
-          "dns.time": "0.006534000",
-          "dns.id": "0x000004e0",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "121",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "16919",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2890",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2890",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2890",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2890",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2890",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2890",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2890",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2890",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2890",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "220",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.197.192.233": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2919",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.233"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3429",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3625",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 209.18.46.217": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4526",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.217"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 209.18.46.223": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4270",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.223"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 209.18.46.221": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "83",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.221"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "127",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5928",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:22:53.188284000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508498573.188284000",
-          "frame.time_delta": "2.605383000",
-          "frame.time_delta_displayed": "900.010259000",
-          "frame.time_relative": "40860.783080000",
-          "frame.number": "38342",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00001f18",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000099a5",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "55484",
-          "udp.dstport": "53",
-          "udp.port": "55484",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000801a",
-          "udp.checksum.status": "2",
-          "udp.stream": "397"
-        },
-        "dns": {
-          "dns.response_in": "38343",
-          "dns.id": "0x000004e1",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:22:53.198461000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508498573.198461000",
-          "frame.time_delta": "0.010177000",
-          "frame.time_delta_displayed": "0.010177000",
-          "frame.time_relative": "40860.793257000",
-          "frame.number": "38343",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00000c8c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000aa7c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "55484",
-          "udp.port": "53",
-          "udp.port": "55484",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "397"
-        },
-        "dns": {
-          "dns.response_to": "38342",
-          "dns.time": "0.010177000",
-          "dns.id": "0x000004e1",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "121",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "16019",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1990",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1990",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1990",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1990",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1990",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1990",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1990",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1990",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1990",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3326",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.197.192.233": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2019",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.233"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2529",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2725",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 209.18.46.217": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3626",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.217"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 209.18.46.223": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3370",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.223"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.197.192.232": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3208",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.232"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 96.17.70.173": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5231",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.173"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5028",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:33:23.646883000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508499203.646883000",
-          "frame.time_delta": "3.475755000",
-          "frame.time_delta_displayed": "630.448422000",
-          "frame.time_relative": "41491.241679000",
-          "frame.number": "38816",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000984f",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000206b",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "49413",
-          "udp.dstport": "53",
-          "udp.port": "49413",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000ff55",
-          "udp.checksum.status": "2",
-          "udp.stream": "398"
-        },
-        "dns": {
-          "dns.response_in": "38817",
-          "dns.id": "0x000004e2",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:33:23.648923000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508499203.648923000",
-          "frame.time_delta": "0.002040000",
-          "frame.time_delta_displayed": "0.002040000",
-          "frame.time_relative": "41491.243719000",
-          "frame.number": "38817",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x000050e3",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000679d",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "49413",
-          "udp.port": "53",
-          "udp.port": "49413",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "398"
-        },
-        "dns": {
-          "dns.response_to": "38816",
-          "dns.time": "0.002040000",
-          "dns.id": "0x000004e2",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:33:23.651769000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508499203.651769000",
-          "frame.time_delta": "0.002846000",
-          "frame.time_delta_displayed": "0.002846000",
-          "frame.time_relative": "41491.246565000",
-          "frame.number": "38818",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00009850",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000206a",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "36635",
-          "udp.dstport": "53",
-          "udp.port": "36635",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00004c3f",
-          "udp.checksum.status": "2",
-          "udp.stream": "399"
-        },
-        "dns": {
-          "dns.response_in": "38819",
-          "dns.id": "0x000004e3",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:33:23.653376000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508499203.653376000",
-          "frame.time_delta": "0.001607000",
-          "frame.time_delta_displayed": "0.001607000",
-          "frame.time_relative": "41491.248172000",
-          "frame.number": "38819",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x000050e4",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00006708",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "36635",
-          "udp.port": "53",
-          "udp.port": "36635",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "399"
-        },
-        "dns": {
-          "dns.response_to": "38818",
-          "dns.time": "0.001607000",
-          "dns.id": "0x000004e3",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2989",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "10",
-              "dns.ns": "ns1.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1786",
-              "dns.resp.len": "6",
-              "dns.ns": "ns3.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "115407",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "140125",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "140125",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "119026",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "111599",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "111599",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:33:24.064209000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508499204.064209000",
-          "frame.time_delta": "0.000887000",
-          "frame.time_delta_displayed": "0.410833000",
-          "frame.time_relative": "41491.659005000",
-          "frame.number": "38835",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00009876",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002044",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "44523",
-          "udp.dstport": "53",
-          "udp.port": "44523",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000126e",
-          "udp.checksum.status": "2",
-          "udp.stream": "400"
-        },
-        "dns": {
-          "dns.response_in": "38836",
-          "dns.id": "0x000004e4",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:33:24.064806000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508499204.064806000",
-          "frame.time_delta": "0.000597000",
-          "frame.time_delta_displayed": "0.000597000",
-          "frame.time_relative": "41491.659602000",
-          "frame.number": "38836",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00005106",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000067b4",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "44523",
-          "udp.port": "53",
-          "udp.port": "44523",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "400"
-        },
-        "dns": {
-          "dns.response_to": "38835",
-          "dns.time": "0.000597000",
-          "dns.id": "0x000004e4",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:33:24.065754000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508499204.065754000",
-          "frame.time_delta": "0.000948000",
-          "frame.time_delta_displayed": "0.000948000",
-          "frame.time_relative": "41491.660550000",
-          "frame.number": "38837",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00009877",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002043",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "44144",
-          "udp.dstport": "53",
-          "udp.port": "44144",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00002ee8",
-          "udp.checksum.status": "2",
-          "udp.stream": "401"
-        },
-        "dns": {
-          "dns.response_in": "38838",
-          "dns.id": "0x000004e5",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:33:24.066174000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508499204.066174000",
-          "frame.time_delta": "0.000420000",
-          "frame.time_delta_displayed": "0.000420000",
-          "frame.time_relative": "41491.660970000",
-          "frame.number": "38838",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x00005107",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000067a3",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "44144",
-          "udp.port": "53",
-          "udp.port": "44144",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "401"
-        },
-        "dns": {
-          "dns.response_to": "38837",
-          "dns.time": "0.000420000",
-          "dns.id": "0x000004e5",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2988",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:37:53.206495000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508499473.206495000",
-          "frame.time_delta": "0.549295000",
-          "frame.time_delta_displayed": "269.140321000",
-          "frame.time_relative": "41760.801291000",
-          "frame.number": "39097",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000dbe6",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000dcd6",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "45662",
-          "udp.dstport": "53",
-          "udp.port": "45662",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000a673",
-          "udp.checksum.status": "2",
-          "udp.stream": "405"
-        },
-        "dns": {
-          "dns.response_in": "39098",
-          "dns.id": "0x000004e6",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:37:53.212525000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508499473.212525000",
-          "frame.time_delta": "0.006030000",
-          "frame.time_delta_displayed": "0.006030000",
-          "frame.time_relative": "41760.807321000",
-          "frame.number": "39098",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000808b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000367d",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "45662",
-          "udp.port": "53",
-          "udp.port": "45662",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "405"
-        },
-        "dns": {
-          "dns.response_to": "39097",
-          "dns.time": "0.006030000",
-          "dns.id": "0x000004e6",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "121",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "15119",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1090",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1090",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1090",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1090",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1090",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1090",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1090",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1090",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1090",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2426",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.197.192.233": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1119",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.233"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1629",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1825",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 209.18.46.217": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2726",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.217"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 209.18.46.223": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2470",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.223"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.197.192.232": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2308",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.232"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 96.17.70.173": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4331",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.173"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4128",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:52:53.219299000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508500373.219299000",
-          "frame.time_delta": "3.495831000",
-          "frame.time_delta_displayed": "900.006774000",
-          "frame.time_relative": "42660.814095000",
-          "frame.number": "39806",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00005dbd",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00005b00",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "40448",
-          "udp.dstport": "53",
-          "udp.port": "40448",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000bad0",
-          "udp.checksum.status": "2",
-          "udp.stream": "409"
-        },
-        "dns": {
-          "dns.response_in": "39807",
-          "dns.id": "0x000004e7",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 04:52:53.225624000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508500373.225624000",
-          "frame.time_delta": "0.006325000",
-          "frame.time_delta_displayed": "0.006325000",
-          "frame.time_relative": "42660.820420000",
-          "frame.number": "39807",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000ac16",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000af2",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "40448",
-          "udp.port": "53",
-          "udp.port": "40448",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "409"
-        },
-        "dns": {
-          "dns.response_to": "39806",
-          "dns.time": "0.006325000",
-          "dns.id": "0x000004e7",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "122",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "14219",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "190",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "190",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "190",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "190",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "190",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "190",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "190",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "190",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "190",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1526",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.197.192.233": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "219",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.233"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "729",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "925",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 209.18.46.217": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1826",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.217"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 209.18.46.223": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1570",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.223"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.197.192.232": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1408",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.232"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 96.17.70.173": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3431",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.173"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3228",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:07:53.234776000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508501273.234776000",
-          "frame.time_delta": "0.078020000",
-          "frame.time_delta_displayed": "900.009152000",
-          "frame.time_relative": "43560.829572000",
-          "frame.number": "40624",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00006faa",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00004913",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "56663",
-          "udp.dstport": "53",
-          "udp.port": "56663",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00007b78",
-          "udp.checksum.status": "2",
-          "udp.stream": "410"
-        },
-        "dns": {
-          "dns.response_in": "40625",
-          "dns.id": "0x000004e8",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:07:53.240805000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508501273.240805000",
-          "frame.time_delta": "0.006029000",
-          "frame.time_delta_displayed": "0.006029000",
-          "frame.time_relative": "43560.835601000",
-          "frame.number": "40625",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000456f",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00007199",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "56663",
-          "udp.port": "53",
-          "udp.port": "56663",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "410"
-        },
-        "dns": {
-          "dns.response_to": "40624",
-          "dns.time": "0.006029000",
-          "dns.id": "0x000004e8",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "122",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "13319",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3298",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3298",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3298",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3298",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3298",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3298",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3298",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3298",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3298",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "626",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7320",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7830",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.108": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "25",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.108"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 209.18.46.217": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "926",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.217"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 209.18.46.223": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "670",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.223"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.197.192.232": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "508",
-              "dns.resp.len": "4",
-              "dns.a": "173.197.192.232"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 96.17.70.173": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2531",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.173"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2328",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:22:53.251101000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508502173.251101000",
-          "frame.time_delta": "2.791011000",
-          "frame.time_delta_displayed": "900.010296000",
-          "frame.time_relative": "44460.845897000",
-          "frame.number": "41391",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000c79b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000f121",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "47619",
-          "udp.dstport": "53",
-          "udp.port": "47619",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00009ecb",
-          "udp.checksum.status": "2",
-          "udp.stream": "417"
-        },
-        "dns": {
-          "dns.response_in": "41392",
-          "dns.id": "0x000004e9",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:22:53.257780000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508502173.257780000",
-          "frame.time_delta": "0.006679000",
-          "frame.time_delta_displayed": "0.006679000",
-          "frame.time_relative": "44460.852576000",
-          "frame.number": "41392",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00002ab8",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00008c50",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "47619",
-          "udp.port": "53",
-          "udp.port": "47619",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "417"
-        },
-        "dns": {
-          "dns.response_to": "41391",
-          "dns.time": "0.006679000",
-          "dns.id": "0x000004e9",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "122",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "12419",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2398",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2398",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2398",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2398",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2398",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2398",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2398",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2398",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2398",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3749",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6420",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6930",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.133": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3133",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.133"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 209.18.46.217": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "26",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.217"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7774",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3612",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 96.17.70.173": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1631",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.173"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1428",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:33:22.354168000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508502802.354168000",
-          "frame.time_delta": "7.493030000",
-          "frame.time_delta_displayed": "629.096388000",
-          "frame.time_relative": "45089.948964000",
-          "frame.number": "41927",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00004173",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00007747",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "36484",
-          "udp.dstport": "53",
-          "udp.port": "36484",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x000031cf",
-          "udp.checksum.status": "2",
-          "udp.stream": "422"
-        },
-        "dns": {
-          "dns.response_in": "41928",
-          "dns.id": "0x000004ea",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:33:22.356157000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508502802.356157000",
-          "frame.time_delta": "0.001989000",
-          "frame.time_delta_displayed": "0.001989000",
-          "frame.time_relative": "45089.950953000",
-          "frame.number": "41928",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x00009f4a",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00001936",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "36484",
-          "udp.port": "53",
-          "udp.port": "36484",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "422"
-        },
-        "dns": {
-          "dns.response_to": "41927",
-          "dns.time": "0.001989000",
-          "dns.id": "0x000004ea",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:33:22.357016000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508502802.357016000",
-          "frame.time_delta": "0.000859000",
-          "frame.time_delta_displayed": "0.000859000",
-          "frame.time_relative": "45089.951812000",
-          "frame.number": "41929",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00004174",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00007746",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "37527",
-          "udp.dstport": "53",
-          "udp.port": "37527",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x000048bb",
-          "udp.checksum.status": "2",
-          "udp.stream": "423"
-        },
-        "dns": {
-          "dns.response_in": "41930",
-          "dns.id": "0x000004eb",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:33:22.358502000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508502802.358502000",
-          "frame.time_delta": "0.001486000",
-          "frame.time_delta_displayed": "0.001486000",
-          "frame.time_relative": "45089.953298000",
-          "frame.number": "41930",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x00009f4b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000018a1",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "37527",
-          "udp.port": "53",
-          "udp.port": "37527",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "423"
-        },
-        "dns": {
-          "dns.response_to": "41929",
-          "dns.time": "0.001486000",
-          "dns.id": "0x000004eb",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "413",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2799",
-              "dns.resp.len": "10",
-              "dns.ns": "ns2.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2799",
-              "dns.resp.len": "6",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2799",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "161051",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "131974",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "131974",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "150229",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "21951",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "21951",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:33:22.769938000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508502802.769938000",
-          "frame.time_delta": "0.000959000",
-          "frame.time_delta_displayed": "0.411436000",
-          "frame.time_relative": "45090.364734000",
-          "frame.number": "41946",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000418a",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00007730",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "35698",
-          "udp.dstport": "53",
-          "udp.port": "35698",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x000034df",
-          "udp.checksum.status": "2",
-          "udp.stream": "424"
-        },
-        "dns": {
-          "dns.response_in": "41947",
-          "dns.id": "0x000004ec",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:33:22.770497000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508502802.770497000",
-          "frame.time_delta": "0.000559000",
-          "frame.time_delta_displayed": "0.000559000",
-          "frame.time_relative": "45090.365293000",
-          "frame.number": "41947",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00009f51",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00001969",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "35698",
-          "udp.port": "53",
-          "udp.port": "35698",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "424"
-        },
-        "dns": {
-          "dns.response_to": "41946",
-          "dns.time": "0.000559000",
-          "dns.id": "0x000004ec",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:33:22.771306000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508502802.771306000",
-          "frame.time_delta": "0.000809000",
-          "frame.time_delta_displayed": "0.000809000",
-          "frame.time_relative": "45090.366102000",
-          "frame.number": "41948",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000418b",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000772f",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "59480",
-          "udp.dstport": "53",
-          "udp.port": "59480",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000f2f7",
-          "udp.checksum.status": "2",
-          "udp.stream": "425"
-        },
-        "dns": {
-          "dns.response_in": "41949",
-          "dns.id": "0x000004ed",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:33:22.771826000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508502802.771826000",
-          "frame.time_delta": "0.000520000",
-          "frame.time_delta_displayed": "0.000520000",
-          "frame.time_relative": "45090.366622000",
-          "frame.number": "41949",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x00009f52",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00001958",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "59480",
-          "udp.port": "53",
-          "udp.port": "59480",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "425"
-        },
-        "dns": {
-          "dns.response_to": "41948",
-          "dns.time": "0.000520000",
-          "dns.id": "0x000004ed",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "413",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:37:53.266045000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508503073.266045000",
-          "frame.time_delta": "2.473971000",
-          "frame.time_delta_displayed": "270.494219000",
-          "frame.time_relative": "45360.860841000",
-          "frame.number": "42165",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00006f25",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00004998",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "45073",
-          "udp.dstport": "53",
-          "udp.port": "45073",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000a8b8",
-          "udp.checksum.status": "2",
-          "udp.stream": "426"
-        },
-        "dns": {
-          "dns.response_in": "42166",
-          "dns.id": "0x000004ee",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:37:53.344536000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508503073.344536000",
-          "frame.time_delta": "0.078491000",
-          "frame.time_delta_displayed": "0.078491000",
-          "frame.time_relative": "45360.939332000",
-          "frame.number": "42166",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000a957",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000db1",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "45073",
-          "udp.port": "53",
-          "udp.port": "45073",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "426"
-        },
-        "dns": {
-          "dns.response_to": "42165",
-          "dns.time": "0.078491000",
-          "dns.id": "0x000004ee",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "300",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "13344",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1573",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1573",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1573",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1573",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1573",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1573",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1573",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1573",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1573",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1109",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 96.17.70.173": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1648",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.173"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.131": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4418",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.131"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 209.18.46.223": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "492",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.223"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 209.18.46.225": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2893",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.225"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 209.18.46.218": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1445",
-              "dns.resp.len": "4",
-              "dns.a": "209.18.46.218"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.223.52.133": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1033",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.133"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 96.17.70.173": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1131",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.173"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4587",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:52:53.349738000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508503973.349738000",
-          "frame.time_delta": "0.133221000",
-          "frame.time_delta_displayed": "900.005202000",
-          "frame.time_relative": "46260.944534000",
-          "frame.number": "42899",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00003ed9",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000079e4",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "37008",
-          "udp.dstport": "53",
-          "udp.port": "37008",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000c838",
-          "udp.checksum.status": "2",
-          "udp.stream": "430"
-        },
-        "dns": {
-          "dns.response_in": "42900",
-          "dns.id": "0x000004ef",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 05:52:53.356337000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508503973.356337000",
-          "frame.time_delta": "0.006599000",
-          "frame.time_delta_displayed": "0.006599000",
-          "frame.time_relative": "46260.951133000",
-          "frame.number": "42900",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000f284",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000c483",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "37008",
-          "udp.port": "53",
-          "udp.port": "37008",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "430"
-        },
-        "dns": {
-          "dns.response_to": "42899",
-          "dns.time": "0.006599000",
-          "dns.id": "0x000004ef",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "123",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "10619",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "598",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "598",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "598",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "598",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "598",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "598",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "598",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "598",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "598",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1949",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4620",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5130",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.133": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1333",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.133"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 204.2.166.157": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4233",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.157"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5974",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1812",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.157.167": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5834",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.157.167"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5629",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:07:53.361739000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508504873.361739000",
-          "frame.time_delta": "3.522645000",
-          "frame.time_delta_displayed": "900.005402000",
-          "frame.time_relative": "47160.956535000",
-          "frame.number": "43627",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00002003",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000098ba",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "32771",
-          "udp.dstport": "53",
-          "udp.port": "32771",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000d8c4",
-          "udp.checksum.status": "2",
-          "udp.stream": "434"
-        },
-        "dns": {
-          "dns.response_in": "43628",
-          "dns.id": "0x000004f0",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:07:53.369270000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508504873.369270000",
-          "frame.time_delta": "0.007531000",
-          "frame.time_delta_displayed": "0.007531000",
-          "frame.time_relative": "47160.964066000",
-          "frame.number": "43628",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000dd37",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000d9d0",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "32771",
-          "udp.port": "53",
-          "udp.port": "32771",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "434"
-        },
-        "dns": {
-          "dns.response_to": "43627",
-          "dns.time": "0.007531000",
-          "dns.id": "0x000004f0",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "126",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "9719",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3700",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3700",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3700",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3700",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3700",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3700",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3700",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3700",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3700",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1049",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3720",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4230",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.133": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "433",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.133"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 204.2.166.157": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3333",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.157"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5074",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "912",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.157.167": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4934",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.157.167"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4729",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:22:53.379501000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508505773.379501000",
-          "frame.time_delta": "5.573394000",
-          "frame.time_delta_displayed": "900.010231000",
-          "frame.time_relative": "48060.974297000",
-          "frame.number": "44377",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000ea56",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000ce66",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "47638",
-          "udp.dstport": "53",
-          "udp.port": "47638",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00009eb0",
-          "udp.checksum.status": "2",
-          "udp.stream": "438"
-        },
-        "dns": {
-          "dns.response_in": "44378",
-          "dns.id": "0x000004f1",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:22:53.386242000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508505773.386242000",
-          "frame.time_delta": "0.006741000",
-          "frame.time_delta_displayed": "0.006741000",
-          "frame.time_relative": "48060.981038000",
-          "frame.number": "44378",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x000016a1",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000a067",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "47638",
-          "udp.port": "53",
-          "udp.port": "47638",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "438"
-        },
-        "dns": {
-          "dns.response_to": "44377",
-          "dns.time": "0.006741000",
-          "dns.id": "0x000004f1",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "126",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "8819",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.27": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.27"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 184.84.242.42": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "184.84.242.42"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2800",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2800",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2800",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2800",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2800",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2800",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2800",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2800",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2800",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "149",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2820",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3330",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.192": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3537",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.192"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 204.2.166.157": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2433",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.157"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4174",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 204.2.166.150": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "12",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.150"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.157.167": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4034",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.157.167"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3829",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:33:22.946788000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508506402.946788000",
-          "frame.time_delta": "0.766058000",
-          "frame.time_delta_displayed": "629.560546000",
-          "frame.time_relative": "48690.541584000",
-          "frame.number": "44868",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000bdc8",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000faf1",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "34522",
-          "udp.dstport": "53",
-          "udp.port": "34522",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00003971",
-          "udp.checksum.status": "2",
-          "udp.stream": "444"
-        },
-        "dns": {
-          "dns.response_in": "44869",
-          "dns.id": "0x000004f2",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:33:22.948908000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508506402.948908000",
-          "frame.time_delta": "0.002120000",
-          "frame.time_delta_displayed": "0.002120000",
-          "frame.time_relative": "48690.543704000",
-          "frame.number": "44869",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x00005bc7",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00005cb9",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "34522",
-          "udp.port": "53",
-          "udp.port": "34522",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "444"
-        },
-        "dns": {
-          "dns.response_to": "44868",
-          "dns.time": "0.002120000",
-          "dns.id": "0x000004f2",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "413",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:33:22.950083000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508506402.950083000",
-          "frame.time_delta": "0.001175000",
-          "frame.time_delta_displayed": "0.001175000",
-          "frame.time_relative": "48690.544879000",
-          "frame.number": "44870",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000bdc9",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000faf0",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "33646",
-          "udp.dstport": "53",
-          "udp.port": "33646",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x000057dc",
-          "udp.checksum.status": "2",
-          "udp.stream": "445"
-        },
-        "dns": {
-          "dns.response_in": "44871",
-          "dns.id": "0x000004f3",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:33:22.951622000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508506402.951622000",
-          "frame.time_delta": "0.001539000",
-          "frame.time_delta_displayed": "0.001539000",
-          "frame.time_relative": "48690.546418000",
-          "frame.number": "44871",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x00005bc8",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00005c24",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "33646",
-          "udp.port": "53",
-          "udp.port": "33646",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "445"
-        },
-        "dns": {
-          "dns.response_to": "44870",
-          "dns.time": "0.001539000",
-          "dns.id": "0x000004f3",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "413",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2799",
-              "dns.resp.len": "10",
-              "dns.ns": "ns1.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2799",
-              "dns.resp.len": "6",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2799",
-              "dns.resp.len": "6",
-              "dns.ns": "ns2.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "157451",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "128374",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "128374",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "146629",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "18351",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "18351",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:33:23.416488000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508506403.416488000",
-          "frame.time_delta": "0.000964000",
-          "frame.time_delta_displayed": "0.464866000",
-          "frame.time_relative": "48691.011284000",
-          "frame.number": "44887",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000bddb",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000fade",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "59813",
-          "udp.dstport": "53",
-          "udp.port": "59813",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000d6a3",
-          "udp.checksum.status": "2",
-          "udp.stream": "446"
-        },
-        "dns": {
-          "dns.response_in": "44888",
-          "dns.id": "0x000004f4",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:33:23.416961000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508506403.416961000",
-          "frame.time_delta": "0.000473000",
-          "frame.time_delta_displayed": "0.000473000",
-          "frame.time_relative": "48691.011757000",
-          "frame.number": "44888",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x00005bce",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00005cec",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "59813",
-          "udp.port": "53",
-          "udp.port": "59813",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "446"
-        },
-        "dns": {
-          "dns.response_to": "44887",
-          "dns.time": "0.000473000",
-          "dns.id": "0x000004f4",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:33:23.417890000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508506403.417890000",
-          "frame.time_delta": "0.000929000",
-          "frame.time_delta_displayed": "0.000929000",
-          "frame.time_relative": "48691.012686000",
-          "frame.number": "44889",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000bddc",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000fadd",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "44681",
-          "udp.dstport": "53",
-          "udp.port": "44681",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00002cbf",
-          "udp.checksum.status": "2",
-          "udp.stream": "447"
-        },
-        "dns": {
-          "dns.response_in": "44890",
-          "dns.id": "0x000004f5",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:33:23.418452000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508506403.418452000",
-          "frame.time_delta": "0.000562000",
-          "frame.time_delta_displayed": "0.000562000",
-          "frame.time_relative": "48691.013248000",
-          "frame.number": "44890",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x00005bcf",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00005cdb",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "44681",
-          "udp.port": "53",
-          "udp.port": "44681",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "447"
-        },
-        "dns": {
-          "dns.response_to": "44889",
-          "dns.time": "0.000562000",
-          "dns.id": "0x000004f5",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "412",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:37:53.397275000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508506673.397275000",
-          "frame.time_delta": "0.977714000",
-          "frame.time_delta_displayed": "269.978823000",
-          "frame.time_relative": "48960.992071000",
-          "frame.number": "45164",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x0000f463",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000c459",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53189",
-          "udp.dstport": "53",
-          "udp.port": "53189",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x000088fc",
-          "udp.checksum.status": "2",
-          "udp.stream": "449"
-        },
-        "dns": {
-          "dns.response_in": "45165",
-          "dns.id": "0x000004f6",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:37:53.407078000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508506673.407078000",
-          "frame.time_delta": "0.009803000",
-          "frame.time_delta_displayed": "0.009803000",
-          "frame.time_relative": "48961.001874000",
-          "frame.number": "45165",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000adc8",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00000940",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "53189",
-          "udp.port": "53",
-          "udp.port": "53189",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "449"
-        },
-        "dns": {
-          "dns.response_to": "45164",
-          "dns.time": "0.009803000",
-          "dns.id": "0x000004f6",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "127",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7919",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1900",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1900",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1900",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1900",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1900",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1900",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1900",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1900",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1900",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3256",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1920",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2430",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.192": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2637",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.192"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 204.2.166.157": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1533",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.157"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3274",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.188": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3115",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.188"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.157.167": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3134",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.157.167"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2929",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:52:53.416716000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508507573.416716000",
-          "frame.time_delta": "1.378707000",
-          "frame.time_delta_displayed": "900.009638000",
-          "frame.time_relative": "49861.011512000",
-          "frame.number": "45902",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x000028c2",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00008ffb",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53544",
-          "udp.dstport": "53",
-          "udp.port": "53544",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00008798",
-          "udp.checksum.status": "2",
-          "udp.stream": "454"
-        },
-        "dns": {
-          "dns.response_in": "45903",
-          "dns.id": "0x000004f7",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 06:52:53.422982000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508507573.422982000",
-          "frame.time_delta": "0.006266000",
-          "frame.time_delta_displayed": "0.006266000",
-          "frame.time_relative": "49861.017778000",
-          "frame.number": "45903",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000f786",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bf81",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "53544",
-          "udp.port": "53",
-          "udp.port": "53544",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "454"
-        },
-        "dns": {
-          "dns.response_to": "45902",
-          "dns.time": "0.006266000",
-          "dns.id": "0x000004f7",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "127",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7019",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1000",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1000",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1000",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1000",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1000",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1000",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1000",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1000",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1000",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2356",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1020",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1530",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.192": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1737",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.192"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 204.2.166.157": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "633",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.157"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2374",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.188": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2215",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.188"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.157.167": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2234",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.157.167"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2029",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:07:53.431212000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508508473.431212000",
-          "frame.time_delta": "2.092085000",
-          "frame.time_delta_displayed": "900.008230000",
-          "frame.time_relative": "50761.026008000",
-          "frame.number": "46613",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00000dff",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000aabe",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "34206",
-          "udp.dstport": "53",
-          "udp.port": "34206",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000d321",
-          "udp.checksum.status": "2",
-          "udp.stream": "458"
-        },
-        "dns": {
-          "dns.response_in": "46614",
-          "dns.id": "0x000004f8",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:07:53.437633000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508508473.437633000",
-          "frame.time_delta": "0.006421000",
-          "frame.time_delta_displayed": "0.006421000",
-          "frame.time_relative": "50761.032429000",
-          "frame.number": "46614",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00004f64",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x000067a4",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "34206",
-          "udp.port": "53",
-          "udp.port": "34206",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "458"
-        },
-        "dns": {
-          "dns.response_to": "46613",
-          "dns.time": "0.006421000",
-          "dns.id": "0x000004f8",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "127",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6119",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "100",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "100",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "100",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "100",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "100",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "100",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "100",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "100",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "100",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1456",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "120",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "630",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 96.17.70.192": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "837",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.192"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 198.172.88.207": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5740",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.207"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1474",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.188": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1315",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.188"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.157.167": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1334",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.157.167"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "1129",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:22:53.445298000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508509373.445298000",
-          "frame.time_delta": "4.162550000",
-          "frame.time_delta_displayed": "900.007665000",
-          "frame.time_relative": "51661.040094000",
-          "frame.number": "47529",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00001618",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000a2a5",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "37517",
-          "udp.dstport": "53",
-          "udp.port": "37517",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x0000c631",
-          "udp.checksum.status": "2",
-          "udp.stream": "459"
-        },
-        "dns": {
-          "dns.response_in": "47530",
-          "dns.id": "0x000004f9",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:22:53.451560000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508509373.451560000",
-          "frame.time_delta": "0.006262000",
-          "frame.time_delta_displayed": "0.006262000",
-          "frame.time_relative": "51661.046356000",
-          "frame.number": "47530",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x0000879c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00002f6c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "37517",
-          "udp.port": "53",
-          "udp.port": "37517",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "459"
-        },
-        "dns": {
-          "dns.response_to": "47529",
-          "dns.time": "0.006262000",
-          "dns.id": "0x000004f9",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "127",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5219",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3203",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3203",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3203",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3203",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3203",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3203",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3203",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3203",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3203",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "556",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 96.17.70.191": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7221",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.191"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.146.244": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7733",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.146.244"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3938",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 198.172.88.207": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4840",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.207"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 204.2.166.158": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "574",
-              "dns.resp.len": "4",
-              "dns.a": "204.2.166.158"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 96.17.70.188": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "415",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.188"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 165.254.157.167": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "434",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.157.167"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "229",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:33:23.445057000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508510003.445057000",
-          "frame.time_delta": "7.984590000",
-          "frame.time_delta_displayed": "629.993497000",
-          "frame.time_relative": "52291.039853000",
-          "frame.number": "48058",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000fb5d",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bd5c",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "54194",
-          "udp.dstport": "53",
-          "udp.port": "54194",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000ec90",
-          "udp.checksum.status": "2",
-          "udp.stream": "463"
-        },
-        "dns": {
-          "dns.response_in": "48059",
-          "dns.id": "0x000004fa",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:33:23.447069000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508510003.447069000",
-          "frame.time_delta": "0.002012000",
-          "frame.time_delta_displayed": "0.002012000",
-          "frame.time_relative": "52291.041865000",
-          "frame.number": "48059",
-          "frame.len": "137",
-          "frame.cap_len": "137",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "123",
-          "ip.id": "0x000001dc",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b6a4",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "54194",
-          "udp.port": "53",
-          "udp.port": "54194",
-          "udp.length": "103",
-          "udp.checksum": "0x0000826a",
-          "udp.checksum.status": "2",
-          "udp.stream": "463"
-        },
-        "dns": {
-          "dns.response_to": "48058",
-          "dns.time": "0.002012000",
-          "dns.id": "0x000004fa",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "1",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type SOA, class IN, mname ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "6",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "412",
-              "dns.resp.len": "46",
-              "dns.soa.mname": "ns1.ext.philips.com",
-              "dns.soa.rname": "ddi-authority.philips.com",
-              "dns.soa.serial_number": "387",
-              "dns.soa.refresh_interval": "1200",
-              "dns.soa.retry_interval": "300",
-              "dns.soa.expire_limit": "1209600",
-              "dns.soa.mininum_ttl": "3600"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:33:23.447897000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508510003.447897000",
-          "frame.time_delta": "0.000828000",
-          "frame.time_delta_displayed": "0.000828000",
-          "frame.time_relative": "52291.042693000",
-          "frame.number": "48060",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000fb5e",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bd5b",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "35295",
-          "udp.dstport": "53",
-          "udp.port": "35295",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00005163",
-          "udp.checksum.status": "2",
-          "udp.stream": "464"
-        },
-        "dns": {
-          "dns.response_in": "48061",
-          "dns.id": "0x000004fb",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:33:23.449477000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508510003.449477000",
-          "frame.time_delta": "0.001580000",
-          "frame.time_delta_displayed": "0.001580000",
-          "frame.time_relative": "52291.044273000",
-          "frame.number": "48061",
-          "frame.len": "285",
-          "frame.cap_len": "285",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "271",
-          "ip.id": "0x000001dd",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b60f",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "35295",
-          "udp.port": "53",
-          "udp.port": "35295",
-          "udp.length": "251",
-          "udp.checksum": "0x000082fe",
-          "udp.checksum.status": "2",
-          "udp.stream": "464"
-        },
-        "dns": {
-          "dns.response_to": "48060",
-          "dns.time": "0.001580000",
-          "dns.id": "0x000004fb",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "3",
-          "dns.count.add_rr": "6",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "412",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          },
-          "Authoritative nameservers": {
-            "cpp.philips.com: type NS, class IN, ns ns2.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2798",
-              "dns.resp.len": "10",
-              "dns.ns": "ns2.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns3.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2798",
-              "dns.resp.len": "6",
-              "dns.ns": "ns3.ext.philips.com"
-            },
-            "cpp.philips.com: type NS, class IN, ns ns1.ext.philips.com": {
-              "dns.resp.name": "cpp.philips.com",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2798",
-              "dns.resp.len": "6",
-              "dns.ns": "ns1.ext.philips.com"
-            }
-          },
-          "Additional records": {
-            "ns1.ext.philips.com: type A, class IN, addr 57.67.40.20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "153850",
-              "dns.resp.len": "4",
-              "dns.a": "57.67.40.20"
-            },
-            "ns2.ext.philips.com: type A, class IN, addr 57.77.21.76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "124773",
-              "dns.resp.len": "4",
-              "dns.a": "57.77.21.76"
-            },
-            "ns3.ext.philips.com: type A, class IN, addr 57.73.36.68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "124773",
-              "dns.resp.len": "4",
-              "dns.a": "57.73.36.68"
-            },
-            "ns1.ext.philips.com: type AAAA, class IN, addr 2a01:ce89:8001::57:67:40:20": {
-              "dns.resp.name": "ns1.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "143028",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce89:8001::57:67:40:20"
-            },
-            "ns2.ext.philips.com: type AAAA, class IN, addr 2a01:ce95:4001:100:57:77:21:76": {
-              "dns.resp.name": "ns2.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "14750",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce95:4001:100:57:77:21:76"
-            },
-            "ns3.ext.philips.com: type AAAA, class IN, addr 2a01:ce9d:1::57:73:36:68": {
-              "dns.resp.name": "ns3.ext.philips.com",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "14750",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2a01:ce9d:1::57:73:36:68"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:33:23.865101000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508510003.865101000",
-          "frame.time_delta": "0.001627000",
-          "frame.time_delta_displayed": "0.415624000",
-          "frame.time_relative": "52291.459897000",
-          "frame.number": "48078",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000fb69",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bd50",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "56468",
-          "udp.dstport": "53",
-          "udp.port": "56468",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x0000e3ac",
-          "udp.checksum.status": "2",
-          "udp.stream": "465"
-        },
-        "dns": {
-          "dns.response_in": "48079",
-          "dns.id": "0x000004fc",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:33:23.865672000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508510003.865672000",
-          "frame.time_delta": "0.000571000",
-          "frame.time_delta_displayed": "0.000571000",
-          "frame.time_relative": "52291.460468000",
-          "frame.number": "48079",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x000001de",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b6dc",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "56468",
-          "udp.port": "53",
-          "udp.port": "56468",
-          "udp.length": "45",
-          "udp.checksum": "0x00008230",
-          "udp.checksum.status": "2",
-          "udp.stream": "465"
-        },
-        "dns": {
-          "dns.response_to": "48078",
-          "dns.time": "0.000571000",
-          "dns.id": "0x000004fc",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type AAAA, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "28",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:33:23.866499000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508510003.866499000",
-          "frame.time_delta": "0.000827000",
-          "frame.time_delta_displayed": "0.000827000",
-          "frame.time_relative": "52291.461295000",
-          "frame.number": "48080",
-          "frame.len": "79",
-          "frame.cap_len": "79",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "65",
-          "ip.id": "0x0000fb6a",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000bd4f",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "42815",
-          "udp.dstport": "53",
-          "udp.port": "42815",
-          "udp.port": "53",
-          "udp.length": "45",
-          "udp.checksum": "0x00003401",
-          "udp.checksum.status": "2",
-          "udp.stream": "466"
-        },
-        "dns": {
-          "dns.response_in": "48081",
-          "dns.id": "0x000004fd",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:33:23.867228000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508510003.867228000",
-          "frame.time_delta": "0.000729000",
-          "frame.time_delta_displayed": "0.000729000",
-          "frame.time_relative": "52291.462024000",
-          "frame.number": "48081",
-          "frame.len": "95",
-          "frame.cap_len": "95",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "81",
-          "ip.id": "0x000001df",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000b6cb",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "42815",
-          "udp.port": "53",
-          "udp.port": "42815",
-          "udp.length": "61",
-          "udp.checksum": "0x00008240",
-          "udp.checksum.status": "2",
-          "udp.stream": "466"
-        },
-        "dns": {
-          "dns.response_to": "48080",
-          "dns.time": "0.000729000",
-          "dns.id": "0x000004fd",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "1",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "dcp.cpp.philips.com: type A, class IN": {
-              "dns.qry.name": "dcp.cpp.philips.com",
-              "dns.qry.name.len": "19",
-              "dns.count.labels": "4",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "dcp.cpp.philips.com: type A, class IN, addr 5.79.62.93": {
-              "dns.resp.name": "dcp.cpp.philips.com",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "412",
-              "dns.resp.len": "4",
-              "dns.a": "5.79.62.93"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:37:53.461226000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508510273.461226000",
-          "frame.time_delta": "5.280384000",
-          "frame.time_delta_displayed": "269.593998000",
-          "frame.time_relative": "52561.056022000",
-          "frame.number": "48304",
-          "frame.len": "76",
-          "frame.cap_len": "76",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "b0:b9:8a:73:69:8e",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "00:17:88:69:ee:e4",
-          "eth.src_tree": {
-            "eth.src_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "62",
-          "ip.id": "0x00000e4c",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x0000aa71",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.src_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "ip.dst": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.dst_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "49801",
-          "udp.dstport": "53",
-          "udp.port": "49801",
-          "udp.port": "53",
-          "udp.length": "42",
-          "udp.checksum": "0x00009630",
-          "udp.checksum.status": "2",
-          "udp.stream": "467"
-        },
-        "dns": {
-          "dns.response_in": "48305",
-          "dns.id": "0x000004fe",
-          "dns.flags": "0x00000100",
-          "dns.flags_tree": {
-            "dns.flags.response": "0",
-            "dns.flags.opcode": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.z": "0",
-            "dns.flags.checkdisable": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "0",
-          "dns.count.auth_rr": "0",
-          "dns.count.add_rr": "0",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          }
-        }
-      }
-    }
-  }
-  ,
-  {
-    "_index": "packets-2017-10-26",
-    "_type": "pcap_file",
-    "_score": null,
-    "_source": {
-      "layers": {
-        "frame": {
-          "frame.encap_type": "1",
-          "frame.time": "Oct 20, 2017 07:37:53.467660000 PDT",
-          "frame.offset_shift": "0.000000000",
-          "frame.time_epoch": "1508510273.467660000",
-          "frame.time_delta": "0.006434000",
-          "frame.time_delta_displayed": "0.006434000",
-          "frame.time_relative": "52561.062456000",
-          "frame.number": "48305",
-          "frame.len": "513",
-          "frame.cap_len": "513",
-          "frame.marked": "0",
-          "frame.ignored": "0",
-          "frame.protocols": "eth:ethertype:ip:udp:dns",
-          "frame.coloring_rule.name": "UDP",
-          "frame.coloring_rule.string": "udp"
-        },
-        "eth": {
-          "eth.dst": "00:17:88:69:ee:e4",
-          "eth.dst_tree": {
-            "eth.dst_resolved": "PhilipsL_69:ee:e4",
-            "eth.addr": "00:17:88:69:ee:e4",
-            "eth.addr_resolved": "PhilipsL_69:ee:e4",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.src": "b0:b9:8a:73:69:8e",
-          "eth.src_tree": {
-            "eth.src_resolved": "Netgear_73:69:8e",
-            "eth.addr": "b0:b9:8a:73:69:8e",
-            "eth.addr_resolved": "Netgear_73:69:8e",
-            "eth.lg": "0",
-            "eth.ig": "0"
-          },
-          "eth.type": "0x00000800"
-        },
-        "ip": {
-          "ip.version": "4",
-          "ip.hdr_len": "20",
-          "ip.dsfield": "0x00000000",
-          "ip.dsfield_tree": {
-            "ip.dsfield.dscp": "0",
-            "ip.dsfield.ecn": "0"
-          },
-          "ip.len": "499",
-          "ip.id": "0x00001912",
-          "ip.flags": "0x00000002",
-          "ip.flags_tree": {
-            "ip.flags.rb": "0",
-            "ip.flags.df": "1",
-            "ip.flags.mf": "0"
-          },
-          "ip.frag_offset": "0",
-          "ip.ttl": "64",
-          "ip.proto": "17",
-          "ip.checksum": "0x00009df6",
-          "ip.checksum.status": "2",
-          "ip.src": "192.168.0.1",
-          "ip.addr": "192.168.0.1",
-          "ip.src_host": "192.168.0.1",
-          "ip.host": "192.168.0.1",
-          "ip.dst": "192.168.0.160",
-          "ip.addr": "192.168.0.160",
-          "ip.dst_host": "192.168.0.160",
-          "ip.host": "192.168.0.160",
-          "Source GeoIP: Unknown": "",
-          "Destination GeoIP: Unknown": ""
-        },
-        "udp": {
-          "udp.srcport": "53",
-          "udp.dstport": "49801",
-          "udp.port": "53",
-          "udp.port": "49801",
-          "udp.length": "479",
-          "udp.checksum": "0x000083e2",
-          "udp.checksum.status": "2",
-          "udp.stream": "467"
-        },
-        "dns": {
-          "dns.response_to": "48304",
-          "dns.time": "0.006434000",
-          "dns.id": "0x000004fe",
-          "dns.flags": "0x00008180",
-          "dns.flags_tree": {
-            "dns.flags.response": "1",
-            "dns.flags.opcode": "0",
-            "dns.flags.authoritative": "0",
-            "dns.flags.truncated": "0",
-            "dns.flags.recdesired": "1",
-            "dns.flags.recavail": "1",
-            "dns.flags.z": "0",
-            "dns.flags.authenticated": "0",
-            "dns.flags.checkdisable": "0",
-            "dns.flags.rcode": "0"
-          },
-          "dns.count.queries": "1",
-          "dns.count.answers": "4",
-          "dns.count.auth_rr": "9",
-          "dns.count.add_rr": "9",
-          "Queries": {
-            "www2.meethue.com: type A, class IN": {
-              "dns.qry.name": "www2.meethue.com",
-              "dns.qry.name.len": "16",
-              "dns.count.labels": "3",
-              "dns.qry.type": "1",
-              "dns.qry.class": "0x00000001"
-            }
-          },
-          "Answers": {
-            "www2.meethue.com: type CNAME, class IN, cname brands.lighting.philips.com.edgekey.net": {
-              "dns.resp.name": "www2.meethue.com",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "128",
-              "dns.resp.len": "41",
-              "dns.cname": "brands.lighting.philips.com.edgekey.net"
-            },
-            "brands.lighting.philips.com.edgekey.net: type CNAME, class IN, cname e15361.b.akamaiedge.net": {
-              "dns.resp.name": "brands.lighting.philips.com.edgekey.net",
-              "dns.resp.type": "5",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "4319",
-              "dns.resp.len": "22",
-              "dns.cname": "e15361.b.akamaiedge.net"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.125": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.125"
-            },
-            "e15361.b.akamaiedge.net: type A, class IN, addr 173.223.52.112": {
-              "dns.resp.name": "e15361.b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "20",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.112"
-            }
-          },
-          "Authoritative nameservers": {
-            "b.akamaiedge.net: type NS, class IN, ns n6b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2303",
-              "dns.resp.len": "6",
-              "dns.ns": "n6b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n2b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2303",
-              "dns.resp.len": "6",
-              "dns.ns": "n2b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns a0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2303",
-              "dns.resp.len": "6",
-              "dns.ns": "a0b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n4b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2303",
-              "dns.resp.len": "6",
-              "dns.ns": "n4b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n5b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2303",
-              "dns.resp.len": "6",
-              "dns.ns": "n5b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n1b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2303",
-              "dns.resp.len": "6",
-              "dns.ns": "n1b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n7b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2303",
-              "dns.resp.len": "6",
-              "dns.ns": "n7b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n3b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2303",
-              "dns.resp.len": "6",
-              "dns.ns": "n3b.akamaiedge.net"
-            },
-            "b.akamaiedge.net: type NS, class IN, ns n0b.akamaiedge.net": {
-              "dns.resp.name": "b.akamaiedge.net",
-              "dns.resp.type": "2",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "2303",
-              "dns.resp.len": "6",
-              "dns.ns": "n0b.akamaiedge.net"
-            }
-          },
-          "Additional records": {
-            "n0b.akamaiedge.net: type A, class IN, addr 88.221.81.192": {
-              "dns.resp.name": "n0b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3658",
-              "dns.resp.len": "4",
-              "dns.a": "88.221.81.192"
-            },
-            "n1b.akamaiedge.net: type A, class IN, addr 96.17.70.191": {
-              "dns.resp.name": "n1b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6321",
-              "dns.resp.len": "4",
-              "dns.a": "96.17.70.191"
-            },
-            "n2b.akamaiedge.net: type A, class IN, addr 165.254.146.244": {
-              "dns.resp.name": "n2b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "6833",
-              "dns.resp.len": "4",
-              "dns.a": "165.254.146.244"
-            },
-            "n3b.akamaiedge.net: type A, class IN, addr 173.223.52.109": {
-              "dns.resp.name": "n3b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3038",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.109"
-            },
-            "n4b.akamaiedge.net: type A, class IN, addr 198.172.88.207": {
-              "dns.resp.name": "n4b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3940",
-              "dns.resp.len": "4",
-              "dns.a": "198.172.88.207"
-            },
-            "n5b.akamaiedge.net: type A, class IN, addr 173.223.52.131": {
-              "dns.resp.name": "n5b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "7681",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.131"
-            },
-            "n6b.akamaiedge.net: type A, class IN, addr 173.223.52.133": {
-              "dns.resp.name": "n6b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "3520",
-              "dns.resp.len": "4",
-              "dns.a": "173.223.52.133"
-            },
-            "n7b.akamaiedge.net: type A, class IN, addr 204.1.137.41": {
-              "dns.resp.name": "n7b.akamaiedge.net",
-              "dns.resp.type": "1",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5538",
-              "dns.resp.len": "4",
-              "dns.a": "204.1.137.41"
-            },
-            "a0b.akamaiedge.net: type AAAA, class IN, addr 2600:1480:e800::c0": {
-              "dns.resp.name": "a0b.akamaiedge.net",
-              "dns.resp.type": "28",
-              "dns.resp.class": "0x00000001",
-              "dns.resp.ttl": "5335",
-              "dns.resp.len": "16",
-              "dns.aaaa": "2600:1480:e800::c0"
-            }
-          }
-        }
-      }
-    }
-  }
-]

diff --git a/json/http.json b/json/http.json
deleted file mode 100644 (file)
index 5919871..0000000
--- a/json/http.json
+++ /dev/null
@@ -1,1427 +0,0 @@
-{
-    "0018c361-c05b-462b-80fd-924d0d90110f": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"74\", Nonce=\"5uz+9xSbrsC2F9UIj3EnlQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"U77HA2bdom8FQeQHHjOBKw==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45243, 
-        "ts": "1508502803.048797000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "06c3f251-5dd2-429f-840c-7cee46775c08": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"51\", Nonce=\"IDqv9WAPICxSF9UIgYzuNQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"HO0GNANgmPqD3EsKDz11CQ==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45175, 
-        "ts": "1508463201.902797000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "109a8616-e01e-47b1-a381-dc10de5c50a1": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"67\", Nonce=\"OeXj2KpCdTmVF9UIH/fp1g==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"v7WnBnxyc0rL6zBViUZt3Q==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45224, 
-        "ts": "1508492002.667066000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "1146dff1-5bec-4a75-a7be-8e0607e2d79b": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"59\", Nonce=\"IIRRXKWHaLNzF9UIafRhqA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"Mb84RTuO7v9NBZI4u2KVow==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45199, 
-        "ts": "1508477602.251054000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "17203fc4-cc9c-4ddc-b75d-828dadcd5707": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56971, 
-        "ts": "1508500993.884194000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "1d146b55-7395-435d-8e03-d8747f6fc3ca": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56611, 
-        "ts": "1508469852.249587000", 
-        "uri": "/description.xml"
-    }, 
-    "1ea946a4-e4a6-4fa5-927e-4603e47d6251": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56609, 
-        "ts": "1508469851.936530000", 
-        "uri": "/description.xml"
-    }, 
-    "1f73b3b1-a13d-499c-8df9-32873a7c340e": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56968, 
-        "ts": "1508500992.947109000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "21088abf-df7d-45e8-a028-edd22a383f65": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"63\", Nonce=\"0n/qkGVhjHaEF9UIbD9C0w==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"a7dKjQVsYpg5YH/p9UfqmQ==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45212, 
-        "ts": "1508484803.583720000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "215520aa-f1ea-4129-83c5-155fa84aa219": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56701, 
-        "ts": "1508477534.895063000", 
-        "uri": "/description.xml"
-    }, 
-    "297939f9-7e43-48ba-b44c-f05d590fac2f": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"72\", Nonce=\"jwevBP0xoV+uF9UI3sJnlA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"GCdNlUt1IhjIKFkIuQ8V8g==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45237, 
-        "ts": "1508499204.343328000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "2aa32fd9-ca8e-4ec4-9ef7-0e56a508ce51": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56538, 
-        "ts": "1508463913.265019000", 
-        "uri": "/description.xml"
-    }, 
-    "2cecaffd-d363-401d-9b6f-1ca89d2b350b": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"60\", Nonce=\"T8McgxJ9HBR8F9UIHQxr3A==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"pB8wKvl1l7ugOuNTTS9oxQ==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45200, 
-        "ts": "1508477602.669084000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "2f197b06-d092-427f-a92a-ba9b247e73d6": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57055, 
-        "ts": "1508509044.965021000", 
-        "uri": "/description.xml"
-    }, 
-    "3010efcb-45f8-43fc-9443-8a3ba838ee9f": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56540, 
-        "ts": "1508463914.137918000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "3236af6d-4542-4257-9087-bafcbbdb5de9": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56879, 
-        "ts": "1508493119.264807000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "3acd5f57-061a-474b-bb89-5b65f5e549d3": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57062, 
-        "ts": "1508509045.921481000", 
-        "uri": "/description.xml"
-    }, 
-    "3c1ba96c-4e39-439b-9ada-e6c66f6e0e7f": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57072, 
-        "ts": "1508509214.456013000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "3f95a4d2-9586-430c-a002-616896328da3": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"57\", Nonce=\"UKDWAA1aUlFrF9UItdlMsw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"PdwZCCElcnhZG70H7kTWtg==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45193, 
-        "ts": "1508474003.675549000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "4b7c4441-ee52-4167-a7e3-f9b196e31cf2": {
-        "dst_ip": "130.211.67.12", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "connection": "close", 
-            "content-type": "text/plain", 
-            "host": "diagnostics.meethue.com:80", 
-            "transfer-encoding": "chunked"
-        }, 
-        "host": "diagnostics.meethue.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 54159, 
-        "ts": "1508461977.224826000", 
-        "uri": "/bridges/fullconfig?sso=91c2b44e0cc2e21ed49576ab6732c15b5c8a86e5f4211feb4a1e9a086dddf9d2663e7c6b035a33b43dd98c6168842c6bbed4f84f8ba27cb6e6593dc3de07a2909c62693157c503a676c182a44daf78ddae30900de525cad753035de299958db2121a4284346b74371c889cfc5df609cb33d126e3051871163f5d767a9d53b72ae6e8901db39b90d2247db5cb734db1b8f18c37bfc23ed6091359629f8c68074ea0d7377c6da7b5b88bccda18a2e137e29f0bab89d64d94c2524b639e5712061b&i=e11f3860cfb5d8a0e502583853950fb6&auth=f66de122ea23c53e85a152b1be18131517dddef7"
-    }, 
-    "503b740d-2377-4ab3-b1c0-318522744453": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"55\", Nonce=\"LDg3BhU5Mu9iF9UIehwGlA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"yoodQRhNNMKwd6zmaU7QuA==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45187, 
-        "ts": "1508470403.122955000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "515d8cf7-1847-4ac5-a62d-9fb279703109": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56697, 
-        "ts": "1508477533.624722000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "5247061a-0a8d-4bc5-a7a5-71f86862d3e1": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"66\", Nonce=\"bSBJ+8tVRzmVF9UI+DCyBw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rLf0EDCXW2dxHEFY/c0lzg==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45219, 
-        "ts": "1508488402.457324000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "54753c2d-6229-405d-8cbd-b54c2d464099": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56612, 
-        "ts": "1508469853.385023000", 
-        "uri": "/description.xml"
-    }, 
-    "562394f8-b1da-4002-9ad4-822c09bee722": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"52\", Nonce=\"+prNMq//zoxaF9UIAX4cmA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"PD/HP4NMadOITSv65W1NVQ==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45176, 
-        "ts": "1508463202.320736000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "58c45fe4-76f3-4b37-a318-32c55384cc82": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"65\", Nonce=\"YbFoE9OcpdiMF9UI5i3Sxg==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"2+jvV9CpnWbrY7RxSfhszw==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45218, 
-        "ts": "1508488402.036753000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "5d624b10-ff7e-4134-a095-ebb132041283": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56537, 
-        "ts": "1508463913.049301000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "5fc69874-d257-4986-8e73-81fe63d58a58": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56970, 
-        "ts": "1508500993.744272000", 
-        "uri": "/description.xml"
-    }, 
-    "6134fa96-2d71-4749-ab82-c9680631966d": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"49\", Nonce=\"pjd9TR/COapKF9UIvgMIbg==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"cWIdFvlc1zTaM1lRh+sG1w==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45168, 
-        "ts": "1508459603.327754000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "640baacd-ba1a-46ba-925f-1e7459564989": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56539, 
-        "ts": "1508463913.918475000", 
-        "uri": "/description.xml"
-    }, 
-    "6518d1b2-1015-4ec9-95ee-77e9830e115a": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56878, 
-        "ts": "1508493119.118306000", 
-        "uri": "/description.xml"
-    }, 
-    "6a4d30ba-1446-4921-84c1-fbbbf1a4f6e1": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56794, 
-        "ts": "1508485432.979175000", 
-        "uri": "/description.xml"
-    }, 
-    "6a7f595a-e223-45b3-97cc-48cad9d7c548": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57073, 
-        "ts": "1508509214.519479000", 
-        "uri": "/description.xml"
-    }, 
-    "6cb61e21-61f1-4d86-8211-f8e52362755f": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56788, 
-        "ts": "1508485431.641818000", 
-        "uri": "/description.xml"
-    }, 
-    "6ce7eecd-fadf-45e2-9cea-fdd76d667be6": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"53\", Nonce=\"Aj6ghgnkEo1aF9UIkdJNZQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"9OaGG6mRlwNym3ixwA9ivw==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45181, 
-        "ts": "1508466802.518608000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "6de21d41-d0c9-4504-bb60-86479bdd0d1f": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57071, 
-        "ts": "1508509214.280691000", 
-        "uri": "/description.xml"
-    }, 
-    "6eac540f-2617-4caf-a777-158fa155a7e2": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"54\", Nonce=\"RnQj4ESU6O5iF9UIGxlBuw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"lFHZk7Y9NuBYpbyswcoUZw==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45182, 
-        "ts": "1508466802.939248000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "706cc9e4-06a0-4260-a5fb-d1e5846b15fd": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56613, 
-        "ts": "1508469853.515797000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "73768ca9-ada0-4930-9be5-a4ae242bc6e3": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56698, 
-        "ts": "1508477533.627907000", 
-        "uri": "/description.xml"
-    }, 
-    "75b2f21d-cafb-4fa2-a1be-86c8da9b7b9c": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56696, 
-        "ts": "1508477533.470368000", 
-        "uri": "/description.xml"
-    }, 
-    "773114f0-2158-4484-9905-0b2c23357138": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56881, 
-        "ts": "1508493120.171827000", 
-        "uri": "/description.xml"
-    }, 
-    "7a7d63cd-9a64-4c22-943c-2ff539fb0713": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"50\", Nonce=\"HYIu7st62itSF9UI1C0tnw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"AIJFnUuBeCAhSJwsSPPIJA==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45169, 
-        "ts": "1508459603.745723000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "7bbe7675-bca6-480c-8b4c-372cfb412b65": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56700, 
-        "ts": "1508477534.717225000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "7c0eac67-4f15-4fce-8443-ef89c391060b": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"70\", Nonce=\"w0E1Ikptdv2lF9UIt96XtA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"ZbLS0OUJ3WJY/VmOWlIEQg==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45231, 
-        "ts": "1508495603.618857000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "80a3ebbb-6983-406f-8bfa-4c0e9ccca1f7": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"73\", Nonce=\"D/VVU+4V91+uF9UIMimHoA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"wTYNVcjDJuYaIlqPvDbd+Q==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45242, 
-        "ts": "1508502802.629928000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "80ca0244-6b0d-4b4c-9672-c0e4d82ba48e": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"61\", Nonce=\"wrIsdgJIWhR8F9UIx6Nk6A==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rMFjUBkfbR8k+XM4J0Nk+A==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45205, 
-        "ts": "1508481202.944385000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "8404af06-b8d8-4276-aea8-fee733250922": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56880, 
-        "ts": "1508493119.423201000", 
-        "uri": "/description.xml"
-    }, 
-    "87e491e1-d4e0-4248-8172-fa71bfbd2625": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56966, 
-        "ts": "1508500992.697184000", 
-        "uri": "/description.xml"
-    }, 
-    "8b7dcd6a-c592-42c6-8749-433f748ff589": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"77\", Nonce=\"v6de2RSqHCO/F9UIB9IETQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"Y2KkPRoOd5rN1bo4Bru7XQ==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45254, 
-        "ts": "1508510003.723787000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "902ca1cf-b791-4fdd-bc7c-63eda786335d": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"69\", Nonce=\"O2nbMFG4qpudF9UI9et8gQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rE4BCqqoV5ApwZlmkzLx/A==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45230, 
-        "ts": "1508495603.198446000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "94ca8be3-3c28-4fae-93da-2bdf41621ad0": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57061, 
-        "ts": "1508509045.209972000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "995abfd5-ed0b-4d4d-a9fe-1c09fb7f0baa": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56793, 
-        "ts": "1508485432.751765000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "9aa6333b-b72b-455a-8135-c75c0c81ae72": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56702, 
-        "ts": "1508477535.050616000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "9b7c2e45-6897-47f5-a3ac-60a88fd71525": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56610, 
-        "ts": "1508469852.190570000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "a12bb9fa-49ec-4969-b687-18567f93d8a8": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57065, 
-        "ts": "1508509046.706024000", 
-        "uri": "/description.xml"
-    }, 
-    "a1305724-ce2b-4ec0-96a1-56ffdada2782": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56791, 
-        "ts": "1508485432.224563000", 
-        "uri": "/description.xml"
-    }, 
-    "a4464775-d8d8-44fc-9215-94a4bfb5c26d": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"76\", Nonce=\"Txncu/KW2yK/F9UIeTMGug==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"Fn/fJIlXLMbcdiZ27pWNwQ==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45249, 
-        "ts": "1508506403.694917000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "a61dd83c-6989-4559-9039-363dbeb54ab9": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56542, 
-        "ts": "1508463914.840072000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "a9ce3646-8671-4c44-a14e-47a38d0a32e0": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"56\", Nonce=\"87rYprWmElFrF9UIyB2bjQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"5oOnGRHc4VVgOtmTGnSXSw==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45188, 
-        "ts": "1508470403.541300000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "acd1abe3-3f2e-4656-8847-5c3213277d11": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56882, 
-        "ts": "1508493120.316778000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "bc134e48-ab13-4e58-b132-dd6435f3ac2b": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"71\", Nonce=\"LtIwGyrkvv2lF9UIdFDgLg==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"jTrgvKNNbcTEqXRajrcYKQ==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45236, 
-        "ts": "1508499203.924411000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "bd3385cb-97f2-43ba-9639-b92249b43a20": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57063, 
-        "ts": "1508509046.116595000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "bffb106d-cfe8-4a1c-9f23-33fbd2d5e217": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56969, 
-        "ts": "1508500993.623407000", 
-        "uri": "/description.xml"
-    }, 
-    "c0838e3b-834e-413b-bcb8-d259b10616d1": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57075, 
-        "ts": "1508509215.520208000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "cacaff93-4fc0-4d24-a0db-83a437c22f8f": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"64\", Nonce=\"WIGvypHsZdiMF9UIrliQWQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"uf13Jx8s/eL7BiklzmuutQ==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45213, 
-        "ts": "1508484804.000058000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "cb89a141-47e7-48e2-86bb-998e956c390a": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56614, 
-        "ts": "1508469853.818103000", 
-        "uri": "/description.xml"
-    }, 
-    "d798cc2e-b848-416a-ae9f-0feb5c5cc83a": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57074, 
-        "ts": "1508509215.329645000", 
-        "uri": "/description.xml"
-    }, 
-    "db713a11-86ca-4903-bf03-78c056424a33": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"68\", Nonce=\"pedBaQkJYZudF9UICPNNyA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rXzU3PkJXq66quYxt4dR0w==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45225, 
-        "ts": "1508492003.083641000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "de22dff6-4385-4c1b-9c0e-647784497294": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56795, 
-        "ts": "1508485433.142029000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "df5bcd9f-f274-4fff-b318-27fb659b6f59": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57064, 
-        "ts": "1508509046.116540000", 
-        "uri": "/description.xml"
-    }, 
-    "e3d19c2c-b137-4756-919c-f70036e6ee04": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56615, 
-        "ts": "1508469854.003616000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "e600104e-fbe8-4319-9d84-ca08047efd0f": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"75\", Nonce=\"8tOzN9657sC2F9UIl3ayqQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"OZk4/yc2TQeK7ph0tAkojA==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45248, 
-        "ts": "1508506403.275265000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "e9139b55-7c4d-407f-aaeb-b4e748a066a3": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56792, 
-        "ts": "1508485432.565257000", 
-        "uri": "/description.xml"
-    }, 
-    "e9557ac5-4e07-4514-a804-1b0a69b99036": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"62\", Nonce=\"BdKCsHaZQHaEF9UI5C5bWQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"hZf/7zl4u0jeRzps/5PXjA==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45206, 
-        "ts": "1508481203.365353000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "ed359f08-9716-46e9-b242-fa0a7ad74b32": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"58\", Nonce=\"rSl/kVJvL7NzF9UIfuR6vQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"F1ymgtXGLgEjjsJtNRm7jQ==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45194, 
-        "ts": "1508474004.097958000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "edbec7e3-ab76-4c3d-92cf-afbf3a717665": {
-        "dst_ip": "130.211.67.12", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "connection": "close", 
-            "content-type": "text/plain", 
-            "host": "diagnostics.meethue.com:80", 
-            "transfer-encoding": "chunked"
-        }, 
-        "host": "diagnostics.meethue.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 54196, 
-        "ts": "1508483525.057124000", 
-        "uri": "/bridges/ws/stats?sso=91c2b44e0cc2e21ed49576ab6732c15b5c8a86e5f4211feb4a1e9a086dddf9d2663e7c6b035a33b43dd98c6168842c6bbed4f84f8ba27cb6e6593dc3de07a2909c62693157c503a676c182a44daf78ddae30900de525cad753035de299958db2121a4284346b74371c889cfc5df609cb33d126e3051871163f5d767a9d53b72ae6e8901db39b90d2247db5cb734db1b8f18c37bfc23ed6091359629f8c68074ea0d7377c6da7b5b88bccda18a2e137e29f0bab89d64d94c2524b639e5712061b&i=aa75654336d2f72df5b22d857fe4e512&auth=c0692053fa23c4a9704396bc516c1287a38e4b38"
-    }, 
-    "ee7a172f-4939-42b3-90c4-f14569632c3d": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "eth.dst": "b0:b9:8a:73:69:8e", 
-        "eth.src": "00:17:88:69:ee:e4", 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"78\", Nonce=\"z9B2roxq4oTHF9UICymJ7Q==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"okPL+Sx5SKAgjONdFT54nQ==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45255, 
-        "ts": "1508510004.140691000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "f1b63783-f5dd-4a48-ad04-40b447f2adf7": {
-        "dst_ip": "192.168.0.226", 
-        "dst_port": 49153, 
-        "eth.dst": "94:10:3e:36:60:09", 
-        "eth.src": "d0:52:a8:a3:60:0f", 
-        "headers": {
-            "content-length": "277", 
-            "content-type": "text/xml; charset=\"utf-8\"", 
-            "host": "192.168.0.226:49153", 
-            "soapaction": "\"urn:Belkin:service:basicevent:1#GetBinaryState\"", 
-            "user-agent": "CyberGarage-HTTP/1.0"
-        }, 
-        "host": "192.168.0.226:49153", 
-        "method": "POST", 
-        "src_ip": "192.168.0.243", 
-        "src_port": 51912, 
-        "ts": "1508472514.240077000", 
-        "uri": "/upnp/control/basicevent1"
-    }, 
-    "f8607e7e-d759-4f28-95c4-9cb58fa19e67": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56541, 
-        "ts": "1508463914.706660000", 
-        "uri": "/description.xml"
-    }, 
-    "fa94b3a9-8cbd-4782-a151-a274592aeeb4": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56536, 
-        "ts": "1508463912.908377000", 
-        "uri": "/description.xml"
-    }, 
-    "fb58b8af-4bd8-443f-a9b1-9143aca25692": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56699, 
-        "ts": "1508477534.524516000", 
-        "uri": "/description.xml"
-    }, 
-    "fc44d4d5-0fff-4c2a-b246-1a3a2c162409": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56790, 
-        "ts": "1508485431.919622000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "fe685706-cfaa-4b66-9959-1fe78bbbd89a": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "eth.dst": "00:17:88:69:ee:e4", 
-        "eth.src": "68:37:e9:d2:26:0d", 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57066, 
-        "ts": "1508509046.856076000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }
-}
\ No newline at end of file

diff --git a/origin/CAPture.py b/origin/CAPture.py
deleted file mode 100644 (file)
index 4d6972a..0000000
--- a/origin/CAPture.py
+++ /dev/null
@@ -1,385 +0,0 @@
-#!/usr/local/bin/python2.7
-
-""" -----------------------------------------------------------------------------
-    CAPture - a pcap file analyzer and report generator
-    (c) 2017 - Rahmadi Trimananda
-    University of California, Irvine - Programming Language and Systems
-    -----------------------------------------------------------------------------
-    Credits to tutorial: https://dpkt.readthedocs.io/en/latest/
-    -----------------------------------------------------------------------------
-""" 
-
-import datetime
-import dpkt
-from dpkt.compat import compat_ord
-
-import socket
-import sys
-
-""" -----------------------------------------------------------------------------
-    Global variable declarations
-    -----------------------------------------------------------------------------
-"""
-# Command line arguments
-INPUT = "-i"
-OUTPUT = "-o"
-POINT_TO_MANY = "-pm"
-VERBOSE = "-v"
-
-
-def mac_addr(address):
-    # Courtesy of: https://dpkt.readthedocs.io/en/latest/
-    """ Convert a MAC address to a readable/printable string
-        Args:
-            address (str): a MAC address in hex form (e.g. '\x01\x02\x03\x04\x05\x06')
-        Returns:
-            str: Printable/readable MAC address
-    """
-    return ':'.join('%02x' % compat_ord(b) for b in address)
-
-
-def inet_to_str(inet):
-    # Courtesy of: https://dpkt.readthedocs.io/en/latest/
-    """ Convert inet object to a string
-        Args:
-            inet (inet struct): inet network address
-        Returns:
-            str: Printable/readable IP address
-    """
-    # First try ipv4 and then ipv6
-    try:
-        return socket.inet_ntop(socket.AF_INET, inet)
-    except ValueError:
-        return socket.inet_ntop(socket.AF_INET6, inet)
-
-
-def show_usage():
-    """ Show usage of this Python script 
-    """
-    print "Usage: python CAPture.py [ -i <file-name>.pcap ] [ -o <file-name>.pcap ] [ -pm ] [ -v ]"
-    print
-    print "[ -o ]  = output file"
-    print "[ -pm ] = point-to-many analysis"
-    print "[ -v ]  = verbose output"
-    print "By default, this script does simple statistical analysis of IP, TCP, and UDP packets."
-    print "(c) 2017 - University of California, Irvine - Programming Language and Systems"
-
-
-def show_progress(verbose, counter):
-    """ Show packet processing progress
-        Args:
-            verbose: verbose output (True/False)
-            counter: counter of all packets
-    """
-    if verbose:
-        print "Processing packet number: ", counter
-    else:
-        if counter % 100000 == 0:
-            print "Processing %s packets..." % counter
-
-
-def show_summary(counter, ip_counter, tcp_counter, udp_counter):
-    """ Show summary of statistics of PCAP file
-        Args:
-            counter: counter of all packets
-            ip_counter: counter of all IP packets
-            tcp_counter: counter of all TCP packets
-            udp_counter: counter of all UDP packets
-    """
-    print
-    print "Total number of packets in the pcap file: ", counter
-    print "Total number of ip packets: ", ip_counter
-    print "Total number of tcp packets: ", tcp_counter
-    print "Total number of udp packets: ", udp_counter
-    print
-
-
-def save_to_file(tbl_header, dictionary, filename_out):
-    """ Show summary of statistics of PCAP file
-        Args:
-            tbl_header: header for the saved table
-            dictionary: dictionary to be saved
-            filename_out: file name to save
-    """
-    # Appending, not overwriting!
-    f = open(filename_out, 'a')
-    # Write the table header
-    f.write("\n\n" + str(tbl_header) + "\n");
-    # Iterate over dictionary and write (key, value) pairs
-    for key, value in dictionary.iteritems():
-        f.write(str(key) + ", " + str(value) + "\n")
-
-    f.close()
-    print "Writing output to file: ", filename_out
-
-
-def statistical_analysis(verbose, pcap, counter, ip_counter, tcp_counter, udp_counter):
-    """ This is the default analysis of packet statistics (generic)
-        Args:
-            verbose: verbose output (True/False)
-            pcap: object that handles PCAP file content
-            counter: counter of all packets
-            ip_counter: counter of all IP packets
-            tcp_counter: counter of all TCP packets
-            udp_counter: counter of all UDP packets
-    """
-    for time_stamp, packet in pcap:
-
-        counter += 1
-        eth = dpkt.ethernet.Ethernet(packet)
-
-        if verbose:
-            # Print out the timestamp in UTC
-            print "Timestamp: ", str(datetime.datetime.utcfromtimestamp(time_stamp))
-            # Print out the MAC addresses
-            print "Ethernet frame: ", mac_addr(eth.src), mac_addr(eth.dst), eth.data.__class__.__name__
-
-        # Process only IP data
-        if not isinstance(eth.data, dpkt.ip.IP):
-
-            is_ip = False
-            if verbose:
-                print "Non IP packet type not analyzed... skipping..."
-        else:
-            is_ip = True
-
-        if is_ip:
-            ip = eth.data
-            ip_counter += 1
-
-            # Pull out fragment information (flags and offset all packed into off field, so use bitmasks)
-            do_not_fragment = bool(ip.off & dpkt.ip.IP_DF)
-            more_fragments = bool(ip.off & dpkt.ip.IP_MF)
-            fragment_offset = ip.off & dpkt.ip.IP_OFFMASK
-
-            if verbose:
-                # Print out the complete IP information
-                print "IP: %s -> %s   (len=%d ttl=%d DF=%d MF=%d offset=%d)\n" % \
-                    (inet_to_str(ip.src), inet_to_str(ip.dst), ip.len, ip.ttl, do_not_fragment, 
-                     more_fragments, fragment_offset)
-
-            # Count TCP packets
-            if ip.p == dpkt.ip.IP_PROTO_TCP:  
-                tcp_counter += 1
-
-            # Count UDP packets
-            if ip.p == dpkt.ip.IP_PROTO_UDP:
-                udp_counter += 1
-
-        show_progress(verbose, counter)
-
-    # Print general statistics
-    show_summary(counter, ip_counter, tcp_counter, udp_counter)
-
-
-def point_to_many_analysis(filename_out, dev_add, verbose, pcap, counter, ip_counter, 
-        tcp_counter, udp_counter):
-    """ This analysis presents how 1 device (MAC address or IP address) communicates
-        to every other device in the analyzed PCAP file.
-        Args:
-            dev_add: device address (MAC or IP address)
-            verbose: verbose output (True/False)
-            pcap: object that handles PCAP file content
-            counter: counter of all packets
-            ip_counter: counter of all IP packets
-            tcp_counter: counter of all TCP packets
-            udp_counter: counter of all UDP packets
-    """
-    # Dictionary that preserves the mapping between destination address to frequency
-    mac2freq = dict()
-    ip2freq = dict()
-    for time_stamp, packet in pcap:
-
-        counter += 1
-        eth = dpkt.ethernet.Ethernet(packet)
-
-        # Save the timestamp and MAC addresses
-        tstamp = str(datetime.datetime.utcfromtimestamp(time_stamp))
-        mac_src = mac_addr(eth.src)
-        mac_dst = mac_addr(eth.dst)
-
-        # Process only IP data
-        if not isinstance(eth.data, dpkt.ip.IP):
-
-            is_ip = False
-            if verbose:
-                print "Non IP packet type not analyzed... skipping..."
-                print 
-        else:
-            is_ip = True
-
-        if is_ip:
-            ip = eth.data
-            ip_counter += 1
-
-            # Pull out fragment information (flags and offset all packed into off field, so use bitmasks)
-            do_not_fragment = bool(ip.off & dpkt.ip.IP_DF)
-            more_fragments = bool(ip.off & dpkt.ip.IP_MF)
-            fragment_offset = ip.off & dpkt.ip.IP_OFFMASK
-            
-            # Save IP addresses
-            ip_src = inet_to_str(ip.src)
-            ip_dst = inet_to_str(ip.dst)
-
-            if verbose:
-                # Print out the complete IP information
-                print "IP: %s -> %s   (len=%d ttl=%d DF=%d MF=%d offset=%d)\n" % \
-                    (ip_src, ip_dst, ip.len, ip.ttl, do_not_fragment, 
-                     more_fragments, fragment_offset)
-
-            # Categorize packets based on source device address
-            # Save the destination device addresses (point-to-many)
-            if dev_add == ip_src:
-                if ip_dst in ip2freq:
-                    freq = ip2freq[ip_dst]
-                    ip2freq[ip_dst] = freq + 1
-                else:
-                    ip2freq[ip_dst] = 1
-
-            if dev_add == mac_src:
-                if mac_dst in ip2freq:
-                    freq = mac2freq[mac_dst]
-                    mac2freq[mac_dst] = freq + 1
-                else:
-                    mac2freq[mac_dst] = 1
-
-            # Count TCP packets
-            if ip.p == dpkt.ip.IP_PROTO_TCP:  
-                tcp_counter += 1
-
-            # Count UDP packets
-            if ip.p == dpkt.ip.IP_PROTO_UDP:
-                udp_counter += 1
-
-        show_progress(verbose, counter)
-
-    # Print general statistics
-    show_summary(counter, ip_counter, tcp_counter, udp_counter)
-    # Save results into file if filename_out is not empty
-    if not filename_out == "":
-        print "Saving results into file: ", filename_out
-        ip_tbl_header = "Point-to-many Analysis - IP destinations for " + dev_add
-        mac_tbl_header = "Point-to-many Analysis - MAC destinations for " + dev_add
-        save_to_file(ip_tbl_header, ip2freq, filename_out)
-        save_to_file(mac_tbl_header, mac2freq, filename_out)
-    else:
-        print "Output file name is not specified... exitting now!"
-
-
-def parse_cli_args(argv):
-    """ Parse command line arguments and store them in a dictionary
-        Args:
-            argv: list of command line arguments and their values
-        Returns:
-            str: dictionary that maps arguments to their values
-    """
-    options = dict()
-    # First argument is "CAPture.py", so skip it
-    argv = argv[1:]
-    # Loop and collect arguments and their values
-    while argv:
-        print "Examining argument: ", argv[0]
-        # Check the first character of each argv list
-        # If it is a '-' then it is a command line argument
-        if argv[0][0] == '-':
-            if argv[0] == VERBOSE:
-                # We don't have value for the argument VERBOSE
-                options[argv[0]] = argv[0]
-                # Remove one command line argument and its value
-                argv = argv[1:]
-            else:
-                options[argv[0]] = argv[1]
-                # Remove one command line argument and its value
-                argv = argv[2:]
-
-    return options
-
-
-""" -----------------------------------------------------------------------------
-    Main Running Methods
-    -----------------------------------------------------------------------------
-""" 
-def main():
-    # Variable declarations
-    global CAP_EXTENSION
-    global PCAP_EXTENSION
-    global VERBOSE
-    global POINT_TO_MANY
-
-    # Counters
-    counter = 0
-    ip_counter = 0
-    tcp_counter = 0
-    udp_counter = 0
-    # Booleans as flags
-    verbose = False
-    is_ip = True
-    is_statistical_analysis = True
-    is_point_to_many_analysis = False
-    # Names
-    filename_in = ""
-    filename_out = ""
-    dev_add = ""
-
-    # Welcome message
-    print
-    print "Welcome to CAPture version 1.0 - A PCAP file instant analyzer!"
-
-    # Get file name from user input
-    # Show usage if file name is not specified (only accept 1 file name for now)
-    if len(sys.argv) < 2:
-        show_usage()
-        print
-        return
-
-    # Check and process sys.argv
-    options = parse_cli_args(sys.argv)
-    for key, value in options.iteritems():
-        # Process "-i" - input PCAP file
-        if key == INPUT:
-            filename_in = value
-        elif key == OUTPUT:
-            filename_out = value
-        elif key == VERBOSE:
-            verbose = True
-        elif key == POINT_TO_MANY:
-            is_statistical_analysis = False
-            is_point_to_many_analysis = True
-            dev_add = value
-
-    # Show manual again if input is not correct
-    if filename_in == "":
-        print "File name is empty!"
-        print
-        show_usage()
-        print
-        return
-
-    # dev_add is needed for these analyses
-    if is_point_to_many_analysis and dev_add == "":
-        print "Device address is empty!"
-        print
-        show_usage()
-        print
-        return
-
-    # One PCAP file name is specified - now analyze!
-    print "Analyzing PCAP file: ", filename_in
-
-    # Opening and analyzing PCAP file
-    f = open(filename_in,'rb')
-    pcap = dpkt.pcap.Reader(f)
-
-    # Choose from the existing options
-    if is_statistical_analysis:
-        statistical_analysis(verbose, pcap, counter, ip_counter, tcp_counter, udp_counter)
-    elif is_point_to_many_analysis:
-        point_to_many_analysis(filename_out, dev_add, verbose, pcap, counter, ip_counter, 
-                               tcp_counter, udp_counter)
-
-
-if __name__ == "__main__":
-    # call main function since this is being run as the start
-    main()
-
-

diff --git a/origin/extract_from_tshark.py b/origin/extract_from_tshark.py
deleted file mode 100644 (file)
index 5704a97..0000000
--- a/origin/extract_from_tshark.py
+++ /dev/null
@@ -1,176 +0,0 @@
-#!/usr/bin/python\r
-\r
-"""\r
-Script used to extract only the needed information from JSON packet traces generated by\r
-tshark from PCAPNG format\r
-"""\r
-\r
-import os, sys\r
-import json\r
-import uuid\r
-\r
-from collections import OrderedDict\r
-\r
-json_key_source = "_source"\r
-json_key_layers = "layers"\r
-\r
-json_key_ip = "ip"\r
-json_key_tcp = "tcp"\r
-\r
-json_key_http = "http"\r
-json_key_method = "method"\r
-json_key_uri = "uri"\r
-json_key_headers = "headers"\r
-json_key_host = "host"\r
-\r
-json_key_http_req = json_key_http + ".request."\r
-json_key_http_req_method = json_key_http_req + json_key_method\r
-json_key_http_req_uri = json_key_http_req + json_key_uri\r
-json_key_http_req_line = json_key_http_req + "line"\r
-\r
-json_key_pkt_comment = "pkt_comment"\r
-\r
-json_key_frame = "frame"\r
-json_key_frame_num = json_key_frame + ".number"\r
-json_key_frame_comment = json_key_frame + ".comment"\r
-json_key_frame_ts = json_key_frame + ".time_epoch"\r
-\r
-\r
-JSON_KEY_ETH = "eth"\r
-JSON_KEY_ETH_SRC = "eth.src"\r
-JSON_KEY_ETH_DST = "eth.dst"\r
-\r
-\r
-def make_unique(key, dct):\r
-    counter = 0\r
-    unique_key = key\r
-\r
-    while unique_key in dct:\r
-        counter += 1\r
-        unique_key = '{}_{}'.format(key, counter)\r
-    return unique_key\r
-\r
-\r
-def parse_object_pairs(pairs):\r
-    dct = OrderedDict()\r
-    for key, value in pairs:\r
-        if key in dct:\r
-            key = make_unique(key, dct)\r
-        dct[key] = value\r
-\r
-    return dct\r
-\r
-def change_file(fpath):\r
-    for fn in os.listdir(fpath):\r
-        full_path = fpath + '/' + fn\r
-\r
-        # Recursively go through all directories\r
-        if os.path.isdir(full_path):\r
-            change_file(full_path)\r
-            continue\r
-\r
-        print full_path\r
-        with open(full_path, "r+") as jf:\r
-            # Since certain json 'keys' appear multiple times in our data, we have to make them\r
-            # unique first (we can't use regular json.load() or we lose some data points). From:\r
-            # https://stackoverflow.com/questions/29321677/python-json-parser-allow-duplicate-keys\r
-            decoder = json.JSONDecoder(object_pairs_hook=parse_object_pairs)\r
-            pcap_data = decoder.decode(jf.read())\r
-\r
-            # Prepare new data structure for re-formatted JSON storage\r
-            data = {}\r
-            for packet in pcap_data:\r
-                layers = packet[json_key_source][json_key_layers]\r
-\r
-                # All captured traffic should have a frame + frame number, but check anyway\r
-                frame_num = " Frame: "\r
-                if json_key_frame not in layers or json_key_frame_num not in layers[json_key_frame]:\r
-                    print "WARNING: could not find frame number! Using -1..."\r
-                    frame_num = frame_num + "-1"\r
-                else:\r
-                    # Save frame number for error-reporting\r
-                    frame_num = frame_num + layers[json_key_frame][json_key_frame_num]\r
-\r
-                # All captured traffic should be IP, but check anyway\r
-                if not json_key_ip in layers:\r
-                    print "WARNING: Non-IP traffic detected!" + frame_num\r
-                    continue\r
-\r
-                # For now, focus on HTTP only\r
-                if json_key_tcp not in layers or json_key_http not in layers:\r
-                    continue\r
-\r
-                # Fill our new JSON packet with TCP/IP info\r
-                new_packet = {}\r
-                new_packet["dst_ip"] = layers[json_key_ip][json_key_ip + ".dst"]\r
-                new_packet["dst_port"] = int(layers[json_key_tcp][json_key_tcp + ".dstport"])\r
-\r
-                # JV: Also include src so we can see what device initiates the traffic\r
-                new_packet["src_ip"] = layers[json_key_ip][json_key_ip + ".src"]\r
-                new_packet["src_port"] = int(layers[json_key_tcp][json_key_tcp + ".srcport"])\r
-                #JV: Also include eth soure/destination info so that we can map traffic to physical device using MAC\r
-                new_packet[JSON_KEY_ETH_SRC] = layers[JSON_KEY_ETH][JSON_KEY_ETH_SRC]\r
-                new_packet[JSON_KEY_ETH_DST] = layers[JSON_KEY_ETH][JSON_KEY_ETH_DST]\r
-\r
-                # Go through all HTTP fields and extract the ones that are needed\r
-                http_data = layers[json_key_http]\r
-                for http_key in http_data:\r
-                    http_value = http_data[http_key]\r
-\r
-                    if http_key.startswith(json_key_http_req_line):\r
-                        header_line = http_value.split(":", 1)\r
-                        if len(header_line) != 2:\r
-                            print ("WARNING: could not parse header '" + str(header_line) + "'"\r
-                                   + frame_num)\r
-                            continue\r
-\r
-                        # Prepare container for HTTP headers\r
-                        if json_key_headers not in new_packet:\r
-                            new_packet[json_key_headers] = {}\r
-\r
-                        # Use lower case for header keys to stay consistent with our other data\r
-                        header_key = header_line[0].lower()\r
-\r
-                        # Remove the trailing carriage return\r
-                        header_val = header_line[1].strip()\r
-\r
-                        # Save the header key-value pair\r
-                        new_packet[json_key_headers][header_key] = header_val\r
-\r
-                        # If this is the host header, we also save it to the main object\r
-                        if header_key == json_key_host:\r
-                            new_packet[json_key_host] = header_val\r
-\r
-                    if json_key_http_req_method in http_value:\r
-                        new_packet[json_key_method] = http_value[json_key_http_req_method]\r
-                    if json_key_http_req_uri in http_value:\r
-                        new_packet[json_key_uri] = http_value[json_key_http_req_uri]\r
-\r
-                # End of HTTP parsing\r
-\r
-                # Check that we found the minimum needed HTTP headers\r
-                if (json_key_uri not in new_packet or json_key_method not in new_packet or\r
-                        json_key_host not in new_packet):\r
-                    print "Missing some HTTP Headers!" + frame_num\r
-                    continue\r
-\r
-                # Extract timestamp\r
-                if json_key_frame_ts not in layers[json_key_frame]:\r
-                    print "WARNING: could not find timestamp!" + frame_num\r
-                    continue\r
-\r
-                new_packet["ts"] = layers[json_key_frame][json_key_frame_ts]\r
-\r
-                # Create a unique key for each packet to keep consistent with ReCon\r
-                # Also good in case packets end up in different files\r
-                data[str(uuid.uuid4())] = new_packet\r
-\r
-            # Write the new data\r
-            #print json.dumps(data, sort_keys=True, indent=4)\r
-            jf.seek(0)\r
-            jf.write(json.dumps(data, sort_keys=True, indent=4))\r
-            jf.truncate()\r
-\r
-if __name__ == '__main__':\r
-    # Needed to re-use some JSON keys\r
-    change_file(sys.argv[1])
\ No newline at end of file

diff --git a/papers/SIGCOMM2018_IoT-SP/.gitignore b/papers/SIGCOMM2018_IoT-SP/.gitignore
deleted file mode 100644 (file)
index 96d7989..0000000
--- a/papers/SIGCOMM2018_IoT-SP/.gitignore
+++ /dev/null
@@ -1,35 +0,0 @@
-## Core latex/pdflatex auxiliary files:
-*.aux
-*.lof
-*.log
-*.lot
-*.fls
-*.out
-*.toc
-*.fmt
-*.fot
-*.cb
-*.cb2
-
-## Intermediate documents:
-*.dvi
-*-converted-to.*
-# these rules might exclude image files for figures etc.
-# *.ps
-# *.eps
-*.pdf
-
-# Ignore BibTex generated files.
-*.bbl
-*.blg
-
-## Build tool auxiliary files:
-*.fdb_latexmk
-*.synctex
-*.synctex(busy)
-*.synctex.gz
-*.synctex.gz(busy)
-*.pdfsync
-
-# Ignore lstlisting autogenerated file
-main.lol

diff --git a/papers/SIGCOMM2018_IoT-SP/ACM-Reference-Format.bst b/papers/SIGCOMM2018_IoT-SP/ACM-Reference-Format.bst
deleted file mode 100755 (executable)
index f79017e..0000000
--- a/papers/SIGCOMM2018_IoT-SP/ACM-Reference-Format.bst
+++ /dev/null
@@ -1,2893 +0,0 @@
-%%% -*-BibTeX-*-
-%%% ====================================================================
-%%%  @BibTeX-style-file{
-%%%     author          = "Nelson H. F. Beebe, Boris Veytsman and Gerald Murray",
-%%%     version         = "2.1",
-%%%     date            = "14 June 2017",
-%%%     filename        = "ACM-Reference-Format.bst",
-%%%     email           = "borisv@lk.net, boris@varphi.com",
-%%%     codetable       = "ISO/ASCII",
-%%%     keywords        = "ACM Transactions bibliography style; BibTeX",
-%%%     license         = "public domain",
-%%%     supported       = "yes",
-%%%     abstract        = "",
-%%%  }
-%%% ====================================================================
-
-%%% Revision history:  see source in git
-
-ENTRY
-  { address
-    advisor
-    archiveprefix
-    author
-    booktitle
-    chapter
-    city
-    date
-    edition
-    editor
-    eprint
-    eprinttype
-    eprintclass
-    howpublished
-    institution
-    journal
-    key
-    month
-    note
-    number
-    organization
-    pages
-    primaryclass
-    publisher
-    school
-    series
-    title
-    type
-    volume
-    year
-        % New keys recognized
-        issue         % UTAH: used in, e.g., ACM SIGSAM Bulletin and ACM Communications in Computer Algebra
-        articleno
-        eid
-        day           % UTAH: needed for newspapers, weeklies, bi-weeklies
-        doi           % UTAH
-        url           % UTAH
-        bookpages     % UTAH
-        numpages
-        lastaccessed  % UTAH: used only for @Misc{...}
-        coden         % UTAH
-        isbn          % UTAH
-        isbn-13       % UTAH
-        issn          % UTAH
-        lccn          % UTAH
-  }
-  {}
-  { label.year extra.label sort.year sort.label basic.label.year}
-
-INTEGERS { output.state before.all mid.sentence after.sentence after.block }
-
-INTEGERS { show-isbn-10-and-13 }  % initialized below in begin.bib
-
-INTEGERS { nameptr namesleft numnames }
-
-INTEGERS { multiresult }
-
-INTEGERS { len }
-
-INTEGERS { last.extra.num }
-
-STRINGS { s t t.org u }
-
-STRINGS { last.label next.extra }
-
-STRINGS { p1 p2 p3 page.count }
-
-
-FUNCTION { not }
-{
-    { #0 }
-    { #1 }
-  if$
-}
-
-FUNCTION { and }
-{
-    'skip$
-    { pop$ #0 }
-  if$
-}
-
-FUNCTION { or }
-{
-   { pop$ #1 }
-    'skip$
-  if$
-}
-
-
-FUNCTION { dump.stack.1 }
-{
-    duplicate$ "STACK[top] = [" swap$ * "]" * warning$
-}
-
-FUNCTION { dump.stack.2 }
-{
-    duplicate$ "STACK[top  ] = [" swap$ * "]" * warning$
-    swap$
-    duplicate$ "STACK[top-1] = [" swap$ * "]" * warning$
-    swap$
-}
-
-FUNCTION { empty.or.unknown }
-{
-  %% Examine the top stack entry, and push 1 if it is empty, or
-  %% consists only of whitespace, or is a string beginning with two
-  %% queries (??), and otherwise, push 0.
-  %%
-  %% This function provides a replacement for empty$, with the
-  %% convenient feature that unknown values marked by two leading
-  %% queries are treated the same as missing values, and thus, do not
-  %% appear in the output .bbl file, and yet, their presence in .bib
-  %% file(s) serves to mark values which are temporarily missing, but
-  %% are expected to be filled in eventually once more data is
-  %% obtained.  The TeX User Group and BibNet bibliography archives
-  %% make extensive use of this practice.
-  %%
-  %% An empty string cannot serve the same purpose, because just as in
-  %% statistics data processing, an unknown value is not the same as an
-  %% empty value.
-  %%
-  %% At entry: stack = ... top:[string]
-  %% At exit:  stack = ... top:[0 or 1]
-
-  duplicate$ empty$
-    { pop$ #1 }
-    { #1 #2 substring$ "??" = }
-  if$
-}
-
-FUNCTION { writeln }
-{
-  %% In BibTeX style files, the sequences
-  %%
-  %%     ... "one" "two" output
-  %%     ... "one" "two" output.xxx
-  %%
-  %% ship "one" to the output file, possibly following by punctuation,
-  %% leaving the stack with
-  %%
-  %%     ... "two"
-  %%
-  %% There is thus a one-string lag in output processing that must be
-  %% carefully handled to avoid duplicating a string in the output
-  %% file.  Unless otherwise noted, all output.xxx functions leave
-  %% just one new string on the stack, and that model should be born
-  %% in mind when reading or writing function code.
-  %%
-  %% BibTeX's asynchronous buffering of output from strings from the
-  %% stack is confusing because newline$ bypasses the buffer.  It
-  %% would have been so much easier for newline to be a character
-  %% rather than a state of the output-in-progress.
-  %%
-  %% The documentation in btxhak.dvi is WRONG:  it says
-  %%
-  %%    newline$ Writes onto the bbl file what's accumulated in the
-  %%             output buffer. It writes a blank line if and only
-  %%             if the output buffer is empty. Since write$ does
-  %%             reasonable line breaking, you should use this
-  %%             function only when you want a blank line or an
-  %%             explicit line break.
-  %%
-  %%    write$   Pops the top (string) literal and writes it on the
-  %%             output buffer (which will result in stuff being
-  %%             written onto the bbl file when the buffer fills
-  %%             up).
-  %%
-  %% Examination of the BibTeX source code shows that write$ does
-  %% indeed behave as claimed, but newline$ sends a newline character
-  %% directly to the output file, leaving the stack unchanged.  The
-  %% first line "Writes onto ... buffer." is therefore wrong.
-  %%
-  %% The original BibTeX style files almost always use "write$ newline$"
-  %% in that order, so it makes sense to hide that pair in a private
-  %% function like this one, named after a statement in Pascal,
-  %% the programming language embedded in the BibTeX Web program.
-
-  write$                % output top-of-stack string
-  newline$              % immediate write of newline (not via stack)
-}
-
-FUNCTION { init.state.consts }
-{
-  #0 'before.all :=
-  #1 'mid.sentence :=
-  #2 'after.sentence :=
-  #3 'after.block :=
-}
-
-FUNCTION { output.nonnull }
-{ % Stack in: ... R S T  Stack out: ... R T   File out: S<comma><space>
-  's :=
-  output.state mid.sentence =
-    {
-      ", " * write$
-    }
-    {
-      output.state after.block =
-        {
-          add.period$ writeln
-          "\newblock " write$
-        }
-        {
-          output.state before.all =
-            {
-              write$
-            }
-            {
-              add.period$ " " * write$
-            }
-          if$
-        }
-      if$
-      mid.sentence 'output.state :=
-    }
-  if$
-  s
-}
-
-FUNCTION { output.nonnull.dot.space }
-{ % Stack in: ... R S T  Stack out: ... R T   File out: S<dot><space>
-  's :=
-  output.state mid.sentence =           % { "<DEBUG output.nonnull.dot.space>. " * write$ }
-    {
-      ". " * write$
-    }
-    {
-      output.state after.block =
-        {
-          add.period$ writeln "\newblock " write$
-        }
-        {
-          output.state before.all =
-            {
-              write$
-            }
-            {
-              add.period$ " " * write$
-            }
-          if$
-        }
-      if$
-      mid.sentence 'output.state :=
-    }
-  if$
-  s
-}
-
-FUNCTION { output.nonnull.remove }
-{ % Stack in: ... R S T  Stack out: ... R T   File out: S<space>
-  's :=
-  output.state mid.sentence =
-    {
-      " " * write$
-    }
-    {
-      output.state after.block =
-        {
-          add.period$ writeln "\newblock " write$
-        }
-        {
-          output.state before.all =
-            {
-              write$
-            }
-            {
-              add.period$ " " * write$
-            }
-          if$
-        }
-      if$
-      mid.sentence 'output.state :=
-    }
-  if$
-  s
-}
-
-FUNCTION { output.nonnull.removenospace }
-{ % Stack in: ... R S T  Stack out: ... R T   File out: S
-  's :=
-  output.state mid.sentence =
-    {
-      "" * write$
-    }
-    {
-      output.state after.block =
-        {
-          add.period$ writeln "\newblock " write$
-        }
-        {
-          output.state before.all =
-            {
-              write$
-            }
-            {
-              add.period$ " " * write$
-            }
-          if$
-        }
-      if$
-      mid.sentence 'output.state :=
-    }
-  if$
-  s
-}
-
-FUNCTION { output }
-{ % discard top token if empty, else like output.nonnull
-  duplicate$ empty.or.unknown
-    'pop$
-    'output.nonnull
-  if$
-}
-
-FUNCTION { output.dot.space }
-{ % discard top token if empty, else like output.nonnull.dot.space
-  duplicate$ empty.or.unknown
-    'pop$
-    'output.nonnull.dot.space
-  if$
-}
-
-FUNCTION { output.removenospace }
-{ % discard top token if empty, else like output.nonnull.removenospace
-  duplicate$ empty.or.unknown
-    'pop$
-    'output.nonnull.removenospace
-  if$
-}
-
-FUNCTION { output.check }
-{ % like output, but warn if key name on top-of-stack is not set
-  't :=
-  duplicate$ empty.or.unknown
-    { pop$ "empty " t * " in " * cite$ * warning$ }
-    'output.nonnull
-  if$
-}
-
-FUNCTION { bibinfo.output.check }
-{ % like output.check, adding bibinfo field
-  't :=
-  duplicate$ empty.or.unknown
-    { pop$ "empty " t * " in " * cite$ * warning$ }
-    { "\bibinfo{" t "}{" * * swap$ * "}" *
-      output.nonnull }
-  if$
-}
-
-FUNCTION { output.check.dot.space }
-{ % like output.dot.space, but warn if key name on top-of-stack is not set
-  't :=
-  duplicate$ empty.or.unknown
-    { pop$ "empty " t * " in " * cite$ * warning$ }
-    'output.nonnull.dot.space
-  if$
-}
-
-FUNCTION { fin.block }
-{ % functionally, but not logically, identical to fin.entry
-   add.period$
-   writeln
-}
-
-FUNCTION { fin.entry }
-{
-   add.period$
-   writeln
-}
-
-FUNCTION { new.sentence }
-{ % update sentence state, with neither output nor stack change
-  output.state after.block =
-    'skip$
-    {
-      output.state before.all =
-        'skip$
-        { after.sentence 'output.state := }
-      if$
-    }
-  if$
-}
-
-FUNCTION { fin.sentence }
-{
-   add.period$
-   write$
-   new.sentence
-   ""
-}
-
-FUNCTION { new.block }
-{
-  output.state before.all =
-    'skip$
-    { after.block 'output.state := }
-  if$
-}
-
-FUNCTION { output.coden }       % UTAH
-{ % output non-empty CODEN as one-line sentence (stack untouched)
-  coden empty.or.unknown
-    { }
-    { "\showCODEN{" coden * "}" * writeln }
-  if$
-}
-
-FUNCTION { format.articleno }
-{
-  articleno empty.or.unknown not eid empty.or.unknown not and
-     { "Both articleno and eid are defined for " cite$ * warning$ }
-     'skip$
-  if$
-  articleno empty.or.unknown eid empty.or.unknown and
-     { "" }
-     {
-        numpages empty.or.unknown
-          { "articleno or eid field, but no numpages field, in "
-            cite$ * warning$ }
-          { }
-        if$
-        eid empty.or.unknown
-          { "Article \bibinfo{articleno}{" articleno * "}" * }
-          { "Article \bibinfo{articleno}{" eid * "}" * }
-        if$
-     }
-  if$
-}
-
-FUNCTION { format.year }
-{ % push year string or "[n. d.]" onto output stack
-  %% Because year is a mandatory field, we always force SOMETHING
-  %% to be output
-  "\bibinfo{year}{"
-  year empty.or.unknown
-    { "[n. d.]" }
-    { year }
-  if$
-  *  "}" *
-}
-
-FUNCTION { format.day.month }
-{ % push "day month " or "month " or "" onto output stack
-  day empty.or.unknown
-    {
-      month empty.or.unknown
-        { "" }
-        { "\bibinfo{date}{" month * "} " *}
-      if$
-    }
-    {
-      month empty.or.unknown
-        { "" }
-        { "\bibinfo{date}{" day * " " * month * "} " *}
-      if$
-    }
-  if$
-}
-
-FUNCTION { format.day.month.year }     % UTAH
-{ % if month is empty, push "" else push "(MON.)" or "(DD MON.)"
-  % Needed for frequent periodicals: 2008. ... New York Times C-1, C-2, C-17 (23 Oct.)
-  % acm-*.bst addition: prefix parenthesized date string with
-  % ", Article nnn "
-  articleno empty.or.unknown eid empty.or.unknown and
-    { "" }
-    { output.state after.block =
-       {", " format.articleno * }
-       { format.articleno  }
-      if$
-    }
-  if$
-  " (" * format.day.month * format.year * ")" *
-}
-
-FUNCTION { output.day.month.year }     % UTAH
-{ % if month is empty value, do nothing; else output stack top and
-  % leave with new top string "(MON.)" or "(DD MON.)"
-  % Needed for frequent periodicals: 2008. ... New York Times C-1, C-2, C-17 (23 Oct.)
-  format.day.month.year
-  output.nonnull.remove
-}
-
-FUNCTION { strip.doi } % UTAH
-{ % Strip any Web address prefix to recover the bare DOI, leaving the
-  % result on the output stack, as recommended by CrossRef DOI
-  % documentation.
-  % For example, reduce "http://doi.acm.org/10.1145/1534530.1534545" to
-  % "10.1145/1534530.1534545".  That is later typeset and displayed as
-  % doi:10.1145/1534530.1534545 as the LAST item in the reference list
-  % entry.  Publisher Web sites wrap this with a suitable link to a real
-  % URL to resolve the DOI, and the master https://doi.org/ address is
-  % preferred, since publisher-specific URLs can disappear in response
-  % to economic events.  All journals are encouraged by the DOI
-  % authorities to use that typeset format and link procedures for
-  % uniformity across all publications that include DOIs in reference
-  % lists.
-  % The numeric prefix is guaranteed to start with "10.", so we use
-  % that as a test.
-  % 2017-02-04 Added stripping of https:// (Boris)
-  doi #1 #3 substring$ "10." =
-    { doi }
-    {
-      doi 't :=  % get modifiable copy of DOI
-
-      % Change https:// to http:// to strip both prefixes (BV)
-
-      t #1 #8 substring$ "https://" =
-        { "http://"  t #9 t text.length$ #8 - substring$ * 't := }
-        { }
-      if$
-
-      t #1 #7 substring$ "http://" =
-        {
-            t #8 t text.length$ #7 - substring$ 't :=
-
-            "INTERNAL STYLE-FILE ERROR" 's :=
-
-            % search for next "/" and assign its suffix to s
-
-            { t text.length$ }
-            {
-              t #1 #1 substring$ "/" =
-                {
-                  % save rest of string as true DOI (should be 10.xxxx/yyyy)
-                  t #2 t text.length$ #1 - substring$ 's :=
-                  "" 't :=    % empty string t terminates the loop
-                }
-                {
-                  % discard first character and continue loop: t <= substring(t,2,last)
-                  t #2 t text.length$ #1 - substring$ 't :=
-                }
-              if$
-            }
-            while$
-
-            % check for valid DOI (should be 10.xxxx/yyyy)
-            s #1 #3 substring$ "10." =
-              { }
-              { "unrecognized DOI substring " s * " in DOI value [" * doi * "]" * warning$ }
-            if$
-
-            s   % push the stripped DOI on the output stack
-
-        }
-        {
-          "unrecognized DOI value [" doi * "]" * warning$
-          doi   % push the unrecognized original DOI on the output stack
-        }
-      if$
-    }
-  if$
-}
-
-%
-% Change by BV: added standard prefix to URL
-%
-FUNCTION { output.doi } % UTAH
-{ % output non-empty DOI as one-line sentence (stack untouched)
-  doi empty.or.unknown
-    { }
-    {
-      %% Use \urldef here for the same reason it is used in output.url,
-      %% see output.url for further discussion.
-      "\urldef\tempurl%" writeln
-      "\url{https://doi.org/" strip.doi * "}" * writeln
-      "\showDOI{\tempurl}" writeln
-    }
-  if$
-}
-
-FUNCTION { output.isbn }                % UTAH
-{ % output non-empty ISBN-10 and/or ISBN-13 as one-line sentences (stack untouched)
-  show-isbn-10-and-13
-    {
-      %% show both 10- and 13-digit ISBNs
-      isbn empty.or.unknown
-        { }
-        {
-          "\showISBNx{" isbn * "}" * writeln
-        }
-      if$
-      isbn-13 empty.or.unknown
-        { }
-        {
-          "\showISBNxiii{" isbn-13 * "}" * writeln
-        }
-      if$
-    }
-    {
-      %% show 10-digit ISBNs only if 13-digit ISBNs not available
-      isbn-13 empty.or.unknown
-        {
-          isbn empty.or.unknown
-            { }
-            {
-              "\showISBNx{" isbn * "}" * writeln
-            }
-          if$
-        }
-        {
-          "\showISBNxiii{" isbn-13 * "}" * writeln
-        }
-      if$
-    }
-  if$
-}
-
-FUNCTION { output.issn } % UTAH
-{ % output non-empty ISSN as one-line sentence (stack untouched)
-  issn empty.or.unknown
-    { }
-    { "\showISSN{" issn * "}" * writeln }
-  if$
-}
-
-FUNCTION { output.issue }
-{ % output non-empty issue number as a one-line sentence (stack untouched)
-  issue empty.or.unknown
-    { }
-    { "Issue " issue * "." * writeln }
-  if$
-}
-
-FUNCTION { output.lccn } % UTAH
-{ % return with stack untouched
-  lccn empty.or.unknown
-    { }
-    { "\showLCCN{" lccn * "}" * writeln }
-  if$
-}
-
-FUNCTION { output.note } % UTAH
-{ % return with stack empty
-  note empty.or.unknown
-    { }
-    { "\shownote{" note add.period$ * "}" * writeln }
-  if$
-}
-
-FUNCTION { output.note.check } % UTAH
-{ % return with stack empty
-  note empty.or.unknown
-    { "empty note in " cite$ * warning$ }
-    { "\shownote{" note add.period$ * "}" * writeln }
-  if$
-}
-
-FUNCTION { output.eprint } %
-{ % return with stack empty
-  eprint empty.or.unknown
-    { }
-    { "\showeprint"
-         archiveprefix empty.or.unknown
-           { eprinttype empty.or.unknown
-               { }
-               { "[" eprinttype "]" * * * }
-             if$
-           }
-           { "[" archiveprefix "l" change.case$ "]" * * * }
-         if$
-         "{" *
-         primaryclass empty.or.unknown
-           { eprintclass empty.or.unknown
-             { }
-             { eprintclass "/" * * }
-             if$
-           }
-           { primaryclass "/" * * }
-         if$
-         eprint "}" * *
-         writeln
-    }
-  if$
-}
-
-
-%
-% Changes by BV 2011/04/15.  Do not output
-% url if doi is defined
-%
-FUNCTION { output.url } % UTAH
-{ % return with stack untouched
-  % output URL and associated lastaccessed fields
-  doi empty.or.unknown
-  {
-    url empty.or.unknown
-      { }
-      {
-          %% Use \urldef, outside \showURL, so that %nn, #, etc in URLs work
-          %% correctly.  Put the actual URL on its own line to reduce the
-          %% likelihood of BibTeX's nasty line wrapping after column 79.
-          %% \url{} can undo this, but if that doesn't work for some reason
-          %% the .bbl file would have to be repaired manually.
-          "\urldef\tempurl%" writeln
-          "\url{" url * "}" * writeln
-
-          "\showURL{%" writeln
-          lastaccessed empty.or.unknown
-            { "" }
-            { "Retrieved " lastaccessed * " from " * }
-          if$
-          "\tempurl}" * writeln
-      }
-      if$
-  }
-  { }
-  if$
-}
-
-FUNCTION { output.year.check }
-{ % warn if year empty, output top string and leave " YEAR<label>" on stack in mid-sentence
-  year empty.or.unknown
-     { "empty year in " cite$ * warning$
-       write$
-       " \bibinfo{year}{[n. d.]}"
-       "\natexlab{" extra.label * "}" * *
-       mid.sentence 'output.state :=
-     }
-     { write$
-       " \bibinfo{year}{" year * "}"  *
-       "\natexlab{" extra.label * "}" * *
-       mid.sentence 'output.state :=
-     }
-  if$
-}
-
-
-FUNCTION { le }
-{
-  %% test whether first number is less than or equal to second number
-  %% stack in:  n1 n2
-  %% stack out: if n1 <= n2 then 1 else 0
-
-  %% "DEBUG: le " cite$ * warning$
-  > { #0 } { #1 } if$
-}
-
-FUNCTION { ge }
-{
-  %% test whether first number is greater than or equal to second number
-  %% stack in:  n1 n2
-  %% stack out: if n1 >= n2 then 1 else 0
-
-  %% "DEBUG: ge " cite$ * warning$
-  < { #0 } { #1 } if$
-}
-
-FUNCTION { is.leading.digit }
-{
-  %% test whether first character of string is a digit
-  %% stack in:  string
-  %% stack out: if first-char-is-digit then 1 else 0
-
-  #1 #1 substring$                      % replace string by string[1:1]
-  duplicate$                            % string[1:1] string[1:1]
-  chr.to.int$
-  "0" chr.to.int$ swap$ le              % "0" <= string[1:1] --> 0-or-1
-  swap$                                 % 0-or-1 string[1:1]
-  chr.to.int$
-  "9" chr.to.int$ le                    % string[1:1} <= "9" --> 0-or-1
-  and
-}
-
-FUNCTION { skip.digits }
-{
-  %% skip over leading digits in string
-  %% stack in:  string
-  %% stack out: rest-of-string leading-digits
-
-  %% "DEBUG: enter skip.digits " cite$ * warning$
-
-  %% dump.stack.1
-
-  duplicate$
-  't :=
-  't.org :=
-  "" 'u :=
-
-  { t text.length$ }
-  {
-    %% "=================DEBUG: skip.digits   t = [" t * "]" * warning$
-    t is.leading.digit
-      { t #2 t text.length$ #1 - substring$ }
-      {
-        t 'u :=
-        ""
-      }
-    if$
-    't :=
-  }
-  while$
-
-  u                                                             % rest of string
-  t.org #1 t.org text.length$ u text.length$ - substring$       % leading digits
-
-  %% "DEBUG: t.org = [" t.org * "]" * warning$
-  %% "DEBUG: u     = [" u * "]" * warning$
-
-  %% dump.stack.2
-
-  %% "DEBUG: leave skip.digits " cite$ * warning$
-}
-
-FUNCTION { skip.nondigits }
-{
-  %% skip over leading nondigits in string
-  %% stack in:  string
-  %% stack out: rest-of-string
-
-  %% "DEBUG: enter skip.nondigits " cite$ * warning$
-
-  't :=
-  "" 'u :=
-
-  { t text.length$ }
-  {
-    %% "=================DEBUG: skip.nondigits   t = [" t * "]" * warning$
-    t is.leading.digit
-      {
-        t 'u :=
-        ""
-      }
-      { t #2 t text.length$ #1 - substring$ }
-    if$
-    't :=
-  }
-  while$
-
-  u                     % rest of string
-
-  %% dump.stack.1
-  %% "DEBUG: leave skip.nondigits " cite$ * warning$
-}
-
-FUNCTION { parse.next.number }
-{
-  %% stack in:  string
-  %% stack out: rest-of-string next-numeric-part-of-string
-  %% Example:
-  %% stack in:  "123:1--123:59"
-  %% stack out: ":1--123:59" "123"
-
-  's :=
-  s skip.nondigits 's :=
-  s skip.digits
-}
-
-FUNCTION { reduce.pages.to.page.count }
-{
-  %% Stack in:  arbitrary-and-unused
-  %% Stack out: unchanged
-  %%
-  %% For the new-style pagination with article number and numpages or
-  %% pages, we expect to have BibTeX entries containing something like
-  %%     articleno = "17",
-  %%     pages     = "1--23",
-  %% with output "Article 17, 23 pages",
-  %% or
-  %%     articleno = "17",
-  %%     numpages  = "23",
-  %% with output "Article 17, 23 pages",
-  %% or
-  %%     articleno = "17",
-  %%     pages     = "17:1--17:23",
-  %% with output "Article 17, 23 pages",
-  %%
-  %% If articleno is missing or empty, then we should output "1--23",
-  %% "23" (with a warning of a missing articleno), or "17:1--17:23",
-  %% respectively.
-
-  %% "DEBUG: enter reduce.pages.to.page.count " cite$ * warning$
-
-  %% "DEBUG: pages = [" pages * "]" * warning$
-
-  pages
-  parse.next.number 'p1 :=
-  parse.next.number 'p2 :=
-  parse.next.number 'p3 :=
-  parse.next.number 'page.count :=
-
-  duplicate$
-  empty.or.unknown
-    {  }
-    {
-      duplicate$ "unexpected trailing garbage [" swap$ *
-      "] after n:p1--n:p2 in pages = [" *
-      pages *
-      "] in " *
-      cite$ *
-      warning$
-    }
-  if$
-
-  pop$
-
-  %% "DEBUG: reduce.pages.to.page.count: "
-  %% " p1 = " p1 * *
-  %% " p2 = " p2 * *
-  %% " p3 = " p3 * *
-  %% " p4 = " page.count * *
-  %% " in " cite$ * * warning$
-
-  p1 p3 =   p2 "1" =   and   numpages empty.or.unknown   and
-    { "INFO: reduced pages = [" pages * "] to numpages = [" * page.count * "]" * warning$ }
-    {
-      numpages empty.or.unknown
-        { pages }
-        { numpages }
-      if$
-      'page.count :=
-    }
-  if$
-
-  p1 "1" =   p3 empty.or.unknown   and   numpages empty.or.unknown   and
-    {
-      p2 'page.count :=
-      "INFO: reduced pages = [" pages * "] to numpages = [" * page.count * "]" * warning$
-    }
-    {
-      numpages empty.or.unknown
-        { pages }
-        { numpages }
-      if$
-      'page.count :=
-    }
-  if$
-
-  %% "DEBUG: leave reduce.pages.to.page.count " cite$ * warning$
-}
-
-FUNCTION { new.block.checkb }
-{ % issue a new.block only if at least one of top two stack strings is not empty
-  empty.or.unknown
-  swap$ empty.or.unknown
-  and
-    'skip$
-    'new.block
-  if$
-}
-
-FUNCTION { field.or.null }
-{ % convert empty value to null string, else return value
-  duplicate$ empty.or.unknown
-    { pop$ "" }
-    'skip$
-  if$
-}
-
-
-
-FUNCTION { emphasize }
-{ % emphasize a non-empty top string on the stack
-  duplicate$ empty.or.unknown
-    { pop$ "" }
-    { "\emph{" swap$ * "}" * }
-  if$
-}
-
-FUNCTION { comma }
-{ % convert empty string to null string, or brace string and add trailing comma
-  duplicate$ empty.or.unknown
-    { pop$ "" }
-    { "{" swap$ * "}," * }
-  if$
-}
-
-FUNCTION { format.names }
-{
-  % Format bibliographical entries with the first author last name first,
-  % and subsequent authors with initials followed by last name.
-  % All names are formatted in this routine.
-
-  's :=
-  #1 'nameptr :=               % nameptr = 1;
-  s num.names$ 'numnames :=    % numnames = num.name$(s);
-  numnames 'namesleft :=
-    { namesleft #0 > }
-    { nameptr #1 =
-        %NO: BAD ORDER: {"{" s nameptr "{ff~}{ll}{, jj}{, vv}" format.name$ * "}" * 't := }
-        %NO: BAD ORDER: {"{" s nameptr "{ff~}{ll}{, jj}{, vv}" format.name$ * "}" * 't := }
-        {"\bibinfo{person}{" s nameptr "{ff }{vv }{ll}{, jj}" format.name$ * "}" * 't := }
-        {"\bibinfo{person}{" s nameptr "{ff }{vv }{ll}{, jj}" format.name$ * "}" * 't := }
-      if$
-      nameptr #1 >
-        {
-          namesleft #1 >
-            { ", " * t * }
-            {
-              numnames #2 >
-                { "," * }
-                'skip$
-              if$
-              t "\bibinfo{person}{others}" =
-                { " {et~al\mbox{.}}" * } % jrh: avoid spacing problems
-                { " {and} " * t * } % from Chicago Manual of Style
-              if$
-            }
-          if$
-        }
-        't
-      if$
-      nameptr #1 + 'nameptr :=          % nameptr += 1;
-      namesleft #1 - 'namesleft :=      % namesleft =- 1;
-    }
-  while$
-}
-
-FUNCTION { my.full.label }
-{
-  's :=
-  #1 'nameptr :=               % nameptr = 1;
-  s num.names$ 'numnames :=    % numnames = num.name$(s);
-  numnames 'namesleft :=
-    { namesleft #0 > }
-
-    { s nameptr "{vv~}{ll}" format.name$ 't :=  % get the next name
-      nameptr #1 >
-        {
-          namesleft #1 >
-            { ", " * t * }
-            {
-              numnames #2 >
-                { "," * }
-                'skip$
-              if$
-              t "others" =
-                { " et~al\mbox{.}" * } % jrh: avoid spacing problems
-                { " and " * t * } % from Chicago Manual of Style
-              if$
-            }
-          if$
-        }
-        't
-      if$
-      nameptr #1 + 'nameptr :=          % nameptr += 1;
-      namesleft #1 - 'namesleft :=      % namesleft =- 1;
-    }
-  while$
-
-}
-
-FUNCTION { format.names.fml }
-{
-  % Format names in "familiar" format, with first initial followed by
-  % last name. Like format.names, ALL names are formatted.
-  % jtb: The names are NOT put in small caps
-
-  's :=
-  #1 'nameptr :=               % nameptr = 1;
-  s num.names$ 'numnames :=    % numnames = num.name$(s);
-  numnames 'namesleft :=
-    { namesleft #0 > }
-
-    {
-      "\bibinfo{person}{" s nameptr "{ff~}{vv~}{ll}{, jj}" format.name$ * "}" * 't :=
-
-      nameptr #1 >
-        {
-          namesleft #1 >
-            { ", " * t * }
-            {
-              numnames #2 >
-                { "," * }
-                'skip$
-              if$
-              t "\bibinfo{person}{others}" =
-                { " {et~al\mbox{.}}" * }
-                { " {and} " * t * }
-              if$
-            }
-          if$
-        }
-        't
-      if$
-      nameptr #1 + 'nameptr :=          % nameptr += 1;
-      namesleft #1 - 'namesleft :=      % namesleft =- 1;
-    }
-  while$
-}
-
-FUNCTION { format.authors }
-{
-  author empty.or.unknown
-    { "" }
-    {
-      "\bibfield{author}{"
-      author format.names add.period$ * "}" *} % jtb: add period if none before
-  if$
-}
-
-FUNCTION { format.key }
-{
-  empty.or.unknown
-    { key field.or.null }
-    { "" }
-  if$
-}
-
-FUNCTION { format.no.key }
-{
-  empty.or.unknown
-    { "" }
-    { "" }
-  if$
-}
-
-FUNCTION { format.editors.fml }
-{
-  % Format editor names for use in the "in" types: inbook, incollection,
-  % inproceedings: first initial, then last names. When editors are the
-  % LABEL for an entry, then format.editor is used which lists editors
-  % by last name first.
-
-  editor empty.or.unknown
-    { "" }
-    {
-      "\bibfield{editor}{"
-      editor format.names.fml
-      *  "}" *
-      editor num.names$ #1 >
-        { " (Eds.)" * }
-        { " (Ed.)" * }
-      if$
-    }
-  if$
-}
-
-FUNCTION { format.editors }
-{ % format editor names for use in labels, last names first.
-  editor empty.or.unknown
-    { "" }
-    {
-      "\bibfield{editor}{"
-      editor format.names
-      *  "}" *
-      editor num.names$ #1 >
-        { " (Eds.)." * }
-        { " (Ed.)." * }
-      if$
-    }
-  if$
-}
-
-FUNCTION { format.articletitle }
-{
-  title empty.or.unknown
-    { "" }
-    % Use this to preserve lettercase in titles:
-    { "\showarticletitle{" title * "}" * }
-    % Use this for downcase title style:
-    % { \showarticletitle{" title "t" change.case$ * "}" * }
-  if$
-}
-
-FUNCTION { format.title }
-{
-  title empty.or.unknown
-    { "" }
-    % Use this to preserve lettercase in titles:
-    { "\bibinfo{title}{" title * "}" * }
-    % Use this for downcase title style:
-    % { title "t" change.case$ }
-  if$
-}
-
-FUNCTION { n.dashify }
-{
-  't :=
-  ""
-    { t empty.or.unknown not }
-    {
-      t #1 #1 substring$ "-" =
-        {
-          t #1 #2 substring$ "--" = not
-            { "--" *
-              t #2 global.max$ substring$ 't :=
-            }
-            {
-              { t #1 #1 substring$ "-" = }
-              {
-                "-" *
-                t #2 global.max$ substring$ 't :=
-              }
-              while$
-            }
-          if$
-        }
-        {
-          t #1 #1 substring$ *
-          t #2 global.max$ substring$ 't :=
-        }
-      if$
-    }
-  while$
-}
-
-FUNCTION { format.a.title.with.edition }
-{
-  "\bibinfo{booktitle}{"
-  swap$ emphasize *
-  edition empty.or.unknown
-    'skip$
-    { " (\bibinfo{edition}{" * edition "l" change.case$ *
-      "} ed.)" * } % jtb: no parens for ed.
-  if$
-  "}" *
-}
-
-FUNCTION { format.btitle }
-{ title format.a.title.with.edition }
-
-FUNCTION { format.emphasize.booktitle }
-{ booktitle format.a.title.with.edition }
-
-FUNCTION { format.city }
-{
-  % jtb: if the preceding string (the title of the conference) is non-empty,
-  % jtb: append the location, otherwise leave empty (so as to trigger the
-  % jtb: error message in output.check
-
-  duplicate$ empty.or.unknown
-    { }
-    {
-      city empty.or.unknown
-        {
-          date empty.or.unknown
-            { }
-            { " (" * date * ")" * }
-          if$
-        }
-        {
-          date empty.or.unknown
-            { " (" * city * ")" * }
-            { " (" * city * ", " * date * ")" * }
-          if$
-        }
-      if$
-    }
-  if$
-}
-
-FUNCTION { tie.or.space.connect }
-{
-  duplicate$ text.length$ #3 <
-    { "~" }
-    { " " }
-  if$
-  swap$ * *
-}
-
-FUNCTION { either.or.check }
-{
-  empty.or.unknown
-    'pop$
-    { "can't use both " swap$ * " fields in " * cite$ * warning$ }
-  if$
-}
-
-FUNCTION { format.bvolume }
-{
-  % jtb: If there is a series, this is added and the volume trails after it.
-  % jtb: Otherwise, "Vol" is Capitalized.
-
-  volume empty.or.unknown
-    { "" }
-    {
-      series empty.or.unknown
-        { "Vol.~\bibinfo{volume}{" volume "}" * *}
-        { "\bibinfo{series}{" series "}, " * *
-          "Vol.~\bibinfo{volume}{" volume "}" * * *}
-      if$
-      "volume and number" number either.or.check
-    }
-  if$
-}
-
-FUNCTION { format.bvolume.noseries }
-{
-  volume empty.or.unknown
-    { "" }
-    { "Vol.~\bibinfo{volume}{" volume "}" * *
-      "volume and number" number either.or.check
-    }
-  if$
-}
-
-FUNCTION { format.series }
-{
-  series empty.or.unknown
-    {""}
-    {" \emph{(\bibinfo{series}{" * series "})}" *}
-  if$
-}
-
-FUNCTION { format.number.series }
-{
-  volume empty.or.unknown
-    {
-      number empty.or.unknown
-        {
-          volume empty.or.unknown
-          { "" }
-          {
-            series empty.or.unknown
-              { "" }
-              { " (\bibinfo{series}{" series * "})" * }
-            if$
-          }
-          if$
-        }                                       %    { series field.or.null }
-        {
-          output.state mid.sentence =
-            { "Number" }                        % gnp - changed to mixed case always
-            { "Number" }
-          if$
-          number tie.or.space.connect series empty.or.unknown
-            { "there's a number but no series in " cite$ * warning$ }
-            { " in \bibinfo{series}{" * series * "}" * }
-          if$
-        }
-      if$
-    }
-    {
-      ""
-    }
-  if$
-}
-
-FUNCTION { multi.page.check }
-{
-  't :=
-  #0 'multiresult :=
-    { multiresult not
-      t empty.or.unknown not
-      and
-    }
-    { t #1 #1 substring$
-      duplicate$ "-" =
-      swap$ duplicate$ "," =
-      swap$ "+" =
-      or or
-    { #1 'multiresult := }
-    { t #2 global.max$ substring$ 't := }
-      if$
-    }
-  while$
-  multiresult
-}
-
-FUNCTION { format.pages }
-{
-  pages empty.or.unknown
-    { "" }
-    { "\bibinfo{pages}{"
-      pages multi.page.check
-        { pages n.dashify } % gnp - removed () % jtb: removed pp.
-        { pages }
-      if$
-      * "}" *
-    }
-  if$
-}
-
-FUNCTION { format.pages.check.without.articleno }
-{ %% format pages field only if articleno is absent
-  %% Stack out: pages-specification
-  numpages missing$ pages missing$ and
-    { "page numbers missing in both pages and numpages fields in " cite$ * warning$ }
-    { }
-  if$
-
-  articleno empty.or.unknown eid empty.or.unknown and
-    {
-      pages missing$
-        { numpages }
-        { format.pages }
-      if$
-    }
-    { "" }
-  if$
-}
-
-FUNCTION { format.pages.check }
-{
-  pages empty.or.unknown
-    { "page numbers missing in " cite$ * warning$ "" }
-    { pages n.dashify }
-  if$
-}
-
-FUNCTION { format.bookpages }
-{
-  bookpages empty.or.unknown
-    { "" }
-    { bookpages "book pages" tie.or.space.connect }
-  if$
-}
-
-FUNCTION { format.named.pages }
-{
-  pages empty.or.unknown
-    { "" }
-    { format.pages "pages" tie.or.space.connect }
-  if$
-}
-
-%
-% Changed by Boris Veytsman, 2011-03-13
-% Now the word "pages" is printed even if
-% there field pages is not empty.
-%
-
-FUNCTION { format.page.count }
-{
-  page.count empty.or.unknown
-    { "" }
-    { "\bibinfo{numpages}{" page.count * "}~pages" * }
-  if$
-}
-
-FUNCTION { format.articleno.numpages }
-{
-  %% There are seven possible outputs, depending on which fields are set.
-  %%
-  %% These four are handled here:
-  %%
-  %%     articleno, numpages, pages     -> "Article articleno-value, numpages-value pages"
-  %%     articleno, numpages            -> "Article articleno-value, numpages-value pages"
-  %%     articleno, pages               -> "Article articleno-value, reduced-pages-value pages"
-  %%     articleno                      -> "Article articleno-value" and warn about missing numpages
-  %%
-  %% The remaining three have already been handled by
-  %% format.pages.check.without.articleno:
-  %%
-  %%     numpages, pages                -> "pages-value"
-  %%     numpages                       -> "numpages-value"
-  %%     pages                          -> "pages-value"
-
-  articleno empty.or.unknown eid empty.or.unknown and
-    {
-      numpages empty.or.unknown
-        { }
-        { "numpages field, but no articleno or eid field, in "
-          cite$ * warning$ }
-      if$
-      ""
-    }
-    {
-      numpages empty.or.unknown
-        {
-          pages empty.or.unknown
-            {
-              "articleno or eid, but no pages or numpages field in "
-                 cite$ * warning$
-              "" 'page.count :=
-            }
-            { reduce.pages.to.page.count }
-          if$
-        }
-        { numpages 'page.count := }
-      if$
-
-      %% The Article number is now handled in format.day.month.year because
-      %% ACM prefers the style "Digital Libraries 12, 3, Article 5 (July 2008)"
-      %% over "Digital Libraries 12, 3 (July 2008), Article 5"
-      %% format.articleno output
-      format.page.count
-    }
-  if$
-}
-
-FUNCTION {calc.format.page.count}
-{
-  numpages empty.or.unknown
-   {
-     pages empty.or.unknown
-        {
-        "" 'page.count :=
-        }
-        { reduce.pages.to.page.count }
-     if$
-   }
-   { numpages 'page.count := }
-  if$
-  format.page.count
-}
-
-
-FUNCTION { journal.canon.abbrev }
-{
-  % Returns a canonical abbreviation for 'journal', or else 'journal'
-  % unchanged.
-  journal "ACM Computing Surveys"                                                                       = { "Comput. Surveys"                                 } {
-  journal "{ACM} Computing Surveys"                                                                     = { "Comput. Surveys"                                 } {
-  journal "ACM Transactions on Mathematical Software"                                                   = { "ACM Trans. Math. Software"                       } {
-  journal "{ACM} Transactions on Mathematical Software"                                                 = { "ACM Trans. Math. Software"                       } {
-  journal "ACM SIGNUM Newsletter"                                                                       = { "ACM SIGNUM Newslett."                            } {
-  journal "ACM {SIGNUM} Newsletter"                                                                     = { "ACM SIGNUM Newslett."                            } {
-  journal "{ACM} SIGNUM Newsletter"                                                                     = { "ACM SIGNUM Newslett."                            } {
-  journal "{ACM} {SIGNUM} Newsletter"                                                                   = { "ACM SIGNUM Newslett."                            } {
-  journal "American Journal of Sociology"                                                               = { "Amer. J. Sociology"                              } {
-  journal "American Mathematical Monthly"                                                               = { "Amer. Math. Monthly"                             } {
-  journal "American Mathematical Society Translations"                                                  = { "Amer. Math. Soc. Transl."                        } {
-  journal "Applied Mathematics and Computation"                                                         = { "Appl. Math. Comput."                             } {
-  journal "British Journal of Mathematical and Statistical Psychology"                                  = { "Brit. J. Math. Statist. Psych."                  } {
-  journal "Bulletin of the American Mathematical Society"                                               = { "Bull. Amer. Math. Soc."                          } {
-  journal "Canadian Mathematical Bulletin"                                                              = { "Canad. Math. Bull."                              } {
-  journal "Communications of the ACM"                                                                   = { "Commun. ACM"                                     } {
-  journal "Communications of the {ACM}"                                                                 = { "Commun. ACM"                                     } {
-  journal "Computers and Structures"                                                                    = { "Comput. \& Structures"                           } {
-  journal "Contemporary Mathematics"                                                                    = { "Contemp. Math."                                  } {
-  journal "Crelle's Journal"                                                                            = { "Crelle's J."                                     } {
-  journal "Giornale di Mathematiche"                                                                    = { "Giorn. Mat."                                     } {
-  journal "IEEE Transactions on Aerospace and Electronic Systems"                                       = { "IEEE Trans. Aerospace Electron. Systems"         } {
-  journal "{IEEE} Transactions on Aerospace and Electronic Systems"                                     = { "IEEE Trans. Aerospace Electron. Systems"         } {
-  journal "IEEE Transactions on Automatic Control"                                                      = { "IEEE Trans. Automat. Control"                    } {
-  journal "{IEEE} Transactions on Automatic Control"                                                    = { "IEEE Trans. Automat. Control"                    } {
-  journal "IEEE Transactions on Computers"                                                              = { "IEEE Trans. Comput."                             } {
-  journal "{IEEE} Transactions on Computers"                                                            = { "IEEE Trans. Comput."                             } {
-  journal "IMA Journal of Numerical Analysis"                                                           = { "IMA J. Numer. Anal."                             } {
-  journal "{IMA} Journal of Numerical Analysis"                                                         = { "IMA J. Numer. Anal."                             } {
-  journal "Information Processing Letters"                                                              = { "Inform. Process. Lett."                          } {
-  journal "International Journal for Numerical Methods in Engineering"                                  = { "Internat. J. Numer. Methods Engrg."              } {
-  journal "International Journal of Control"                                                            = { "Internat. J. Control"                            } {
-  journal "International Journal of Supercomputing Applications"                                        = { "Internat. J. Supercomputing Applic."             } {
-  journal "Journal of Computational Physics"                                                            = { "J. Comput. Phys."                                } {
-  journal "Journal of Computational and Applied Mathematics"                                            = { "J. Comput. Appl. Math."                          } {
-  journal "Journal of Computer and System Sciences"                                                     = { "J. Comput. System Sci."                          } {
-  journal "Journal of Mathematical Analysis and Applications"                                           = { "J. Math. Anal. Appl."                            } {
-  journal "Journal of Mathematical Physics"                                                             = { "J. Math. Phys."                                  } {
-  journal "Journal of Parallel and Distributed Computing"                                               = { "J. Parallel and Distrib. Comput."                } {
-  journal "Journal of Research of the National Bureau of Standards"                                     = { "J. Res. Nat. Bur. Standards"                     } {
-  journal "Journal of VLSI and Computer Systems"                                                        = { "J. VLSI Comput. Syst."                           } {
-  journal "Journal of {VLSI} and Computer Systems"                                                      = { "J. VLSI Comput. Syst."                           } {
-  journal "Journal of the ACM"                                                                          = { "J. ACM"                                          } {
-  journal "Journal of the American Statistical Association"                                             = { "J. Amer. Statist. Assoc."                        } {
-  journal "Journal of the Institute of Mathematics and its Applications"                                = { "J. Inst. Math. Appl."                            } {
-  journal "Journal of the Society for Industrial and Applied Mathematics"                               = { "J. Soc. Indust. Appl. Math."                     } {
-  journal "Journal of the Society for Industrial and Applied Mathematics, Series B, Numerical Analysis" = { "J. Soc. Indust. Appl. Math. Ser. B Numer. Anal." } {
-  journal "Linear Algebra and its Applications"                                                         = { "Linear Algebra Appl."                            } {
-  journal "Mathematica Scandinavica"                                                                    = { "Math. Scand."                                    } {
-  journal "Mathematical Tables and Other Aids to Computation"                                           = { "Math. Tables Aids Comput."                       } {
-  journal "Mathematics of Computation"                                                                  = { "Math. Comp."                                     } {
-  journal "Mathematische Annalen"                                                                       = { "Math. Ann."                                      } {
-  journal "Numerische Mathematik"                                                                       = { "Numer. Math."                                    } {
-  journal "Pacific Journal of Mathematics"                                                              = { "Pacific J. Math."                                } {
-  journal "Parallel Computing"                                                                          = { "Parallel Comput."                                } {
-  journal "Philosophical Magazine"                                                                      = { "Philos. Mag."                                    } {
-  journal "Proceedings of the American Mathematical Society"                                            = { "Proc. Amer. Math. Soc."                          } {
-  journal "Proceedings of the IEEE"                                                                     = { "Proc. IEEE"                                      } {
-  journal "Proceedings of the {IEEE}"                                                                   = { "Proc. IEEE"                                      } {
-  journal "Proceedings of the National Academy of Sciences of the USA"                                  = { "Proc. Nat. Acad. Sci. U. S. A."                  } {
-  journal "Quarterly Journal of Mathematics, Oxford, Series (2)"                                        = { "Quart. J. Math. Oxford Ser. (2)"                 } {
-  journal "Quarterly of Applied Mathematics"                                                            = { "Quart. Appl. Math."                              } {
-  journal "Review of the International Statisical Institute"                                            = { "Rev. Inst. Internat. Statist."                   } {
-  journal "SIAM Journal on Algebraic and Discrete Methods"                                              = { "SIAM J. Algebraic Discrete Methods"              } {
-  journal "{SIAM} Journal on Algebraic and Discrete Methods"                                            = { "SIAM J. Algebraic Discrete Methods"              } {
-  journal "SIAM Journal on Applied Mathematics"                                                         = { "SIAM J. Appl. Math."                             } {
-  journal "{SIAM} Journal on Applied Mathematics"                                                       = { "SIAM J. Appl. Math."                             } {
-  journal "SIAM Journal on Computing"                                                                   = { "SIAM J. Comput."                                 } {
-  journal "{SIAM} Journal on Computing"                                                                 = { "SIAM J. Comput."                                 } {
-  journal "SIAM Journal on Matrix Analysis and Applications"                                            = { "SIAM J. Matrix Anal. Appl."                      } {
-  journal "{SIAM} Journal on Matrix Analysis and Applications"                                          = { "SIAM J. Matrix Anal. Appl."                      } {
-  journal "SIAM Journal on Numerical Analysis"                                                          = { "SIAM J. Numer. Anal."                            } {
-  journal "{SIAM} Journal on Numerical Analysis"                                                        = { "SIAM J. Numer. Anal."                            } {
-  journal "SIAM Journal on Scientific and Statistical Computing"                                        = { "SIAM J. Sci. Statist. Comput."                   } {
-  journal "{SIAM} Journal on Scientific and Statistical Computing"                                      = { "SIAM J. Sci. Statist. Comput."                   } {
-  journal "SIAM Review"                                                                                 = { "SIAM Rev."                                       } {
-  journal "{SIAM} Review"                                                                               = { "SIAM Rev."                                       } {
-  journal "Software Practice and Experience"                                                            = { "Software Prac. Experience"                       } {
-  journal "Statistical Science"                                                                         = { "Statist. Sci."                                   } {
-  journal "The Computer Journal"                                                                        = { "Comput. J."                                      } {
-  journal "Transactions of the American Mathematical Society"                                           = { "Trans. Amer. Math. Soc."                         } {
-  journal "USSR Computational Mathematics and Mathematical Physics"                                     = { "U. S. S. R. Comput. Math. and Math. Phys."       } {
-  journal "{USSR} Computational Mathematics and Mathematical Physics"                                   = { "U. S. S. R. Comput. Math. and Math. Phys."       } {
-  journal "Zeitschrift fur Angewandte Mathematik und Mechanik"                                          = { "Z. Angew. Math. Mech."                           } {
-  journal "Zeitschrift fur Angewandte Mathematik und Physik"                                            = { "Z. Angew. Math. Phys."                           } {
-  journal
-  } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$
-  } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$
-  } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$
-  } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$
-  } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$
-  } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$
-  } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$
-  } if$ } if$ } if$ } if$ } if$ } if$ } if$ } if$
-}
-
-FUNCTION { format.journal.volume.number.day.month.year }
-{
-  % By Young (and Spencer)
-  % GNP - fixed bugs with missing volume, number, and/or pages
-  %
-  % Format journal, volume, number, pages for article types.
-  %
-  journal empty.or.unknown
-    { "no journal in " cite$ * warning$ "" }
-    { "\bibinfo{journal}{"
-      journal.canon.abbrev emphasize *
-      "}" * }
-  if$
-
-  number empty.or.unknown
-    {
-      volume empty.or.unknown
-        { "no number and no volume in " cite$ * warning$ "" * }
-        { " " * " \bibinfo{volume}{" * volume * "}" * }
-      if$
-    }
-    {
-      volume empty.or.unknown
-        {
-          "unusual to have number, but no volume, for " cite$ * warning$
-          " \bibinfo{number}{" * number * "}" *
-        }
-        { " \bibinfo{volume}{" * volume  * "}, \bibinfo{number}{" *
-          number * "}" *}
-      if$
-    }
-  if$
-  after.block 'output.state :=
-
-  % Sometimes proceedings are published in journals
-  % In this case we do not want to put year, day and month here
-
-  type$ "inproceedings" =
-    { }
-    {format.day.month.year * }
-  if$
-}
-
-FUNCTION { format.chapter.pages }
-{
-  chapter empty.or.unknown
-    'format.pages
-    { type empty.or.unknown
-        { "Chapter" } % gnp - changed to mixed case
-        { type "t" change.case$ }
-      if$
-      chapter tie.or.space.connect
-      pages empty.or.unknown
-        {"page numbers missing in " cite$ * warning$} % gnp - added check
-        { ", " * format.pages * }
-      if$
-    }
-  if$
-}
-
-FUNCTION { format.in.emphasize.booktitle }
-{ % jtb: format for collections or proceedings not appearing in a journal
-  booktitle empty.or.unknown
-  { "" }
-  { "In " format.emphasize.booktitle * }
-  if$
-}
-
-FUNCTION { format.in.booktitle }
-{ % jtb: format for proceedings appearing in a journal
-  booktitle empty.or.unknown
-  { "" }
-  { "In \bibinfo{booktitle}{" booktitle * "}" * }
-  if$
-}
-
-FUNCTION { format.in.ed.booktitle }
-{
-  booktitle empty.or.unknown
-  { "" }
-  { editor empty.or.unknown
-    { "In " format.emphasize.booktitle * }
-                % jtb: swapped editor location
-    { "In " format.emphasize.booktitle * ", " * format.editors.fml * }
-    if$
-  }
-  if$
-}
-
-FUNCTION { format.thesis.type }
-{ % call with default type on stack top
-  type empty.or.unknown
-    'skip$    % use default type
-    {
-      pop$    % discard default type
-      % NO: it is silly to have to brace protect every degree type!:  type "t" change.case$
-      type
-    }
-  if$
-}
-
-FUNCTION { format.tr.number }
-{
-  "\bibinfo{type}{"
-  type empty.or.unknown
-    { "{T}echnical {R}eport" }
-    'type
-  if$
-  "}" * *
-  number empty.or.unknown
-    { "t" change.case$ }
-    %% LOOKS BAD: { "." * number tie.or.space.connect }
-    %% Prefer "Research report RJ687." to "Research report. RJ687."
-    { number tie.or.space.connect }
-  if$
-}
-
-FUNCTION { format.advisor }
-{
-  advisor empty.or.unknown
-    { "" }
-    { "Advisor(s) " advisor * }
-  if$
-}
-
-FUNCTION { format.article.crossref }
-{ "See"
-  "\citeN{" * crossref * "}" *
-}
-
-FUNCTION { format.crossref.editor }
-{
-  editor #1 "{vv~}{ll}" format.name$
-  editor num.names$ duplicate$
-  #2 >
-    { pop$ " et~al\mbox{.}" * }         % jrh: avoid spacing problems
-    { #2 <
-    'skip$
-    { editor #2 "{ff }{vv }{ll}{ jj}" format.name$ "others" =
-        { " et~al\mbox{.}" * }          % jrh: avoid spacing problems
-        { " and " * editor #2 "{vv~}{ll}" format.name$ * }
-      if$
-    }
-      if$
-    }
-  if$
-}
-
-FUNCTION { format.book.crossref }
-{
-  volume empty.or.unknown
-    { "empty volume in " cite$ * "'s crossref of " * crossref * warning$
-      "In "
-    }
-    { "Volume" volume tie.or.space.connect % gnp - changed to mixed case
-      " of " *
-    }
-  if$
-  editor empty.or.unknown
-  editor field.or.null author field.or.null =
-  or
-    { key empty.or.unknown
-    { series empty.or.unknown
-        { "need editor, key, or series for " cite$ * " to crossref " *
-          crossref * warning$
-          "" *
-        }
-        { series emphasize * }
-      if$
-    }
-    { key * }
-      if$
-    }
-    { format.crossref.editor * }
-  if$
-  " \citeN{" * crossref * "}" *
-}
-
-FUNCTION { format.incoll.inproc.crossref }
-{ "See"
-  " \citeN{" * crossref * "}" *
-}
-
-FUNCTION { format.lab.names }
-{
-  % format.lab.names:
-  %
-  % determines "short" names for the abbreviated author information.
-  % "Long" labels are created in calc.label, using the routine my.full.label
-  % to format author and editor fields.
-  %
-  % There are 4 cases for labels.   (n=3 in the example)
-  % a) one author             Foo
-  % b) one to n               Foo, Bar and Baz
-  % c) use of "and others"    Foo, Bar et al.
-  % d) more than n            Foo et al.
-
-  's :=
-  s num.names$ 'numnames :=
-  numnames #2 >    % change number to number of others allowed before
-                   % forcing "et al".
-    { s #1 "{vv~}{ll}" format.name$ " et~al\mbox{.}" * } % jrh: \mbox{} added
-    {
-      numnames #1 - 'namesleft :=
-      #2 'nameptr :=
-      s #1 "{vv~}{ll}" format.name$
-        { namesleft #0 > }
-        { nameptr numnames =
-            { s nameptr "{ff }{vv }{ll}{ jj}" format.name$ "others" =
-                { " et~al\mbox{.}" * }          % jrh: avoid spacing problems
-                { " and " * s nameptr "{vv~}{ll}" format.name$ * }
-              if$
-            }
-            { ", " * s nameptr "{vv~}{ll}" format.name$ * }
-          if$
-          nameptr #1 + 'nameptr :=
-          namesleft #1 - 'namesleft :=
-        }
-      while$
-    }
-  if$
-}
-
-FUNCTION { author.key.label }
-{
-  author empty.or.unknown
-    { key empty.or.unknown
-          { "no key, author in " cite$ * warning$
-            cite$ #1 #3 substring$ }
-         'key
-      if$
-    }
-    { author format.lab.names }
-  if$
-}
-
-FUNCTION { editor.key.organization.label }
-{ % added - gnp. Provide label formatting by organization if editor is null.
-  editor empty.or.unknown
-    { organization empty.or.unknown
-        { key empty.or.unknown
-            { "no key, editor or organization in " cite$ * warning$
-              cite$ #1 #3 substring$ }
-            'key
-          if$
-        }
-        { organization }
-      if$
-    }
-    { editor format.lab.names }
-  if$
-}
-
-FUNCTION { author.editor.key.label }
-{
-  author empty.or.unknown
-    { editor empty.or.unknown
-          { key empty.or.unknown
-               { "no key, author, or editor in " cite$ * warning$
-                 cite$ #1 #3 substring$ }
-             'key
-           if$
-         }
-          { editor format.lab.names }
-      if$
-    }
-    { author format.lab.names }
-  if$
-}
-
-FUNCTION { author.editor.key.organization.label }
-{ % added - gnp. Provide label formatting by organization if author is null.
-  author empty.or.unknown
-    { editor empty.or.unknown
-        { organization empty.or.unknown
-            { key empty.or.unknown
-               { "no key, author, editor or organization in " cite$ * warning$
-                 cite$ #1 #3 substring$ }
-               'key
-              if$
-            }
-            { organization }
-          if$
-        }
-        { editor format.lab.names }
-      if$
-    }
-    { author format.lab.names }
-  if$
-}
-
-% Calculate label and leave it on stack
-FUNCTION { calc.basic.label }
-{
-  type$ "book" =
-  type$ "inbook" =
-  or
-  type$ "article" =
-  or
-    'author.editor.key.label
-    { type$ "proceedings" =
-      type$ "periodical" =
-      or
-        'editor.key.organization.label
-        { type$ "manual" =
-            'author.editor.key.organization.label
-            'author.key.label
-          if$
-        }
-      if$
-    }
-  if$
-  duplicate$
-  year empty.or.unknown
-    { "[n. d.]" }
-    { year field.or.null purify$ #-1 #4 substring$}
-  if$
-  *
-  'basic.label.year :=
-}
-
-FUNCTION { calc.label }
-{
-  % Changed - GNP. See also author.editor.organization.sort, editor.organization.sort
-  % Form label for BibTeX entry. The classification of which fields are used
-  % for which type of entry (book, inbook, etc.) are taken from alpha.bst.
-  % The change here from newapa is to also include organization as a
-  % citation label if author or editor is missing.
-
-  calc.basic.label
-
-  author empty.or.unknown  % generate the full label citation information.
-    {
-      editor empty.or.unknown
-        {
-          organization empty.or.unknown
-            {
-              key empty.or.unknown
-                {
-                  "no author, editor, organization, or key in " cite$ * warning$
-                  "??"
-                }
-                { key }
-              if$
-            }
-            { organization }
-          if$
-        }
-        { editor my.full.label }
-      if$
-    }
-    { author my.full.label }
-  if$
-
-  % leave label on the stack, to be popped when required.
-
-  "}{" * swap$ * "}{" *
-  %  year field.or.null purify$ #-1 #4 substring$ *
-  %
-  % save the year for sort processing afterwards (adding a, b, c, etc.)
-  %
-  year empty.or.unknown
-    { "[n. d.]" }
-    { year field.or.null purify$ #-1 #4 substring$}
-  if$
-  'label.year :=
-}
-
-
-FUNCTION { output.bibitem }
-{
-  newline$
-  "\bibitem[\protect\citeauthoryear{" write$
-  calc.label write$
-  sort.year write$
-  "}]%" writeln
-  "        {" write$
-  cite$ write$
-  "}" writeln
-  ""
-  before.all 'output.state :=
-}
-
-
-FUNCTION { output.issue.doi.coden.isxn.lccn.url.eprint }
-{ % enter and return with stack empty
-  %% We switch now from buffered output to output of complete lines, so
-  %% that the Issue .. URL data have their own lines, and are less likely
-  %% to be line-wrapped by BibTeX's short-sighted algorithm, which wraps
-  %% lines longer than 79 characters, backtracking to what it thinks is
-  %% a break point in the string.  Any such wrapping MUST be undone to
-  %% prevent percent-newline from appearing in DOIs and URLs.  The
-  %% output data are intentionally wrapped in \showxxx{} macros at
-  %% beginning of line, and that supply their own punctuation (if they
-  %% are not defined to suppress output entirely), to make it easier for
-  %% other software to recover them from .bbl files.
-  %%
-  %% It also makes it possible to later change the macro definitions
-  %% to suppress particular output values, or alter their appearance.
-  %%
-  %% Note that it is possible for theses, technical reports, and
-  %% manuals to have ISBNs, and anything that has an ISBN may also
-  %% have an ISSN.  When there are no values for these keys, there
-  %% is no output generated for them here.
-
-  "\newblock" writeln
-  after.block 'output.state :=
-
-  output.issue
-  output.isbn
-  output.coden  % CODEN is functionally like ISSN, so output them sequentially
-  output.issn
-  output.lccn
-  output.doi    % DOI is ALWAYS last according to CrossRef DOI documentation
-  output.eprint
-  output.url    % but ACM wants URL last
-}
-
-FUNCTION { output.issue.doi.coden.isxn.lccn.url.eprint.note }
-{ % enter with stack empty, return with empty string on stack
-  output.issue.doi.coden.isxn.lccn.url.eprint
-  note empty.or.unknown
-    { }
-    {
-      "\newblock" writeln
-      output.note
-    }
-  if$
-  ""
-}
-
-FUNCTION { output.issue.doi.coden.isxn.lccn.url.eprint.note.check }
-{ % enter with stack empty, return with empty string on stack
-  output.issue.doi.coden.isxn.lccn.url.eprint
-  note empty.or.unknown
-    { }
-    {
-      "\newblock" writeln
-      output.note.check
-    }
-  if$
-  ""
-}
-
-FUNCTION { article }
-{
-  output.bibitem
-
-  author empty.or.unknown
-    {
-      editor empty.or.unknown
-        { "neither author and editor supplied for " cite$ * warning$ }
-        { format.editors "editor" output.check }
-      if$
-    }
-    { format.authors "author" output.check }
-  if$
-
-  author format.no.key output       % added
-  output.year.check                 % added
-  new.block
-  format.articletitle "title" output.check
-  new.block
-  howpublished empty.or.unknown
-    { }
-    { "\bibinfo{howpublished}{" howpublished "}" * * output }
-  if$
-
-  crossref missing$
-    { format.journal.volume.number.day.month.year output}
-    {
-      "cross reference in @Article{...} is unusual" warning$
-      format.article.crossref output.nonnull
-    }
-  if$
-
-  format.pages.check.without.articleno output
-  format.articleno.numpages output
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION { book }
-{
-  output.bibitem
-  author empty.or.unknown
-    { format.editors "author and editor" output.check }
-    { format.authors output.nonnull
-      crossref missing$
-        { "author and editor" editor either.or.check }
-        'skip$
-      if$
-    }
-  if$
-  output.year.check       % added
-  new.block
-  format.btitle "title" output.check
-  crossref missing$
-    { new.sentence              % jtb: start a new sentence for series/volume
-      format.bvolume output
-      new.block
-      format.number.series output
-      new.sentence
-      publisher "publisher" bibinfo.output.check
-      address "address" bibinfo.output.check    % jtb: require address
-      fin.sentence
-      pages empty.or.unknown
-        { format.bookpages }    % use bookpages when pages empty
-        { format.pages.check "pages" tie.or.space.connect }
-      if$
-      output
-    }
-    { new.block
-      format.book.crossref output.nonnull
-    }
-  if$
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION { booklet }
-{
-  output.bibitem
-  format.authors output
-  author format.key output          % added
-  output.year.check                 % added
-  new.block
-  format.title "title" output.check
-  new.block
-    howpublished empty.or.unknown
-    { }
-    { "\bibinfo{howpublished}{" howpublished "}" * * output }
-  if$
-  address output
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION { inbook }
-{
-  output.bibitem
-  author empty.or.unknown
-    { format.editors
-      "author and editor" output.check
-    }
-    { format.authors output.nonnull
-      crossref missing$
-    { "author and editor" editor either.or.check }
-    'skip$
-      if$
-    }
-  if$
-  output.year.check                 % added
-  new.block
-  format.btitle "title" output.check
-  crossref missing$
-    { new.sentence              % jtb: start a new sentence for series/volume
-      format.bvolume output
-      new.block
-      format.number.series output
-      new.sentence
-      publisher "publisher" bibinfo.output.check
-      address "address" bibinfo.output.check    % jtb: require address
-      format.bookpages output
-      format.chapter.pages
-      "chapter and pages" output.check  % jtb: moved from before publisher
-    }
-    {
-      format.bookpages output
-      format.chapter.pages "chapter and pages" output.check
-      new.block
-      format.book.crossref output.nonnull
-    }
-  if$
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION { incollection }
-{
-  output.bibitem
-  format.authors "author" output.check
-  author format.key output       % added
-  output.year.check              % added
-  new.block
-  format.articletitle "title" output.check
-  new.block
-  crossref missing$
-    { format.in.ed.booktitle "booktitle" output.check
-      new.sentence                % jtb: start a new sentence for series/volume
-      format.bvolume output
-      format.number.series output
-      new.sentence
-      publisher "publisher" bibinfo.output.check
-      address "address" bibinfo.output.check      % jtb: require address
-      format.bookpages output
-      format.chapter.pages output % gnp - was special.output.nonnull
-                                  % left out comma before page numbers
-                                  % jtb: moved from before publisher
-    }
-    {
-      format.incoll.inproc.crossref output.nonnull
-      format.chapter.pages output
-    }
-  if$
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION { inproceedings }
-{
-  output.bibitem
-  format.authors "author" output.check
-  author format.key output            % added
-  output.year.check                   % added
-  new.block
-  format.articletitle "title" output.check
-  howpublished empty.or.unknown
-    { }
-    { "\bibinfo{howpublished}{" howpublished "}" * * output.dot.space }
-  if$
-  crossref missing$
-    {
-      journal missing$          % jtb: proceedings appearing in journals
-        { format.in.emphasize.booktitle format.city "booktitle"  output.check.dot.space
-          format.series output.removenospace
-          format.editors.fml output % BV 2011/09/27 Moved dot to comma
-          format.bvolume.noseries output
-          new.sentence
-          organization output
-          publisher "publisher" bibinfo.output.check % jtb: require publisher (?)
-          address "address" bibinfo.output.check  % jtb: require address
-          format.bookpages output
-        }
-        {
-           format.in.booktitle format.city "booktitle" output.check
-           format.editors.fml output
-           new.sentence
-           format.journal.volume.number.day.month.year output
-        }
-      if$
-      format.articleno output
-      format.pages.check.without.articleno output
-    }
-    {
-      format.incoll.inproc.crossref output.nonnull
-      format.articleno output
-      format.pages.check.without.articleno output
-    }
-  if$
-  format.articleno.numpages output
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION { conference } { inproceedings }
-
-FUNCTION { manual }
-{
-  output.bibitem
-  author empty.or.unknown
-    { editor empty.or.unknown
-      { organization "organization" output.check
-        organization format.key output }  % if all else fails, use key
-      { format.editors "author and editor" output.check }
-      if$
-    }
-    { format.authors output.nonnull }
-    if$
-  output.year.check                 % added
-  new.block
-  format.btitle "title" output.check
-  organization address new.block.checkb
-  % jtb: back to normal style: organization, address
-  organization "organization" output.check
-  address output
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION { mastersthesis }
-{
-  output.bibitem
-  format.authors "author" output.check
-  author format.key output          % added
-  output.year.check                 % added
-  new.block
-  format.title emphasize "title" output.check  % NB: ACM style requires emphasized thesis title
-  new.block
-  "\bibinfo{thesistype}{Master's\ thesis}" format.thesis.type output
-  new.sentence
-  school "school" bibinfo.output.check
-  address empty.or.unknown
-     { }
-     { "\bibinfo{address}{" address * "}" * output }
-  if$
-  new.block
-  format.advisor output
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION { misc }
-{
-  output.bibitem
-  format.authors "author" output.check
-  author format.key output            % added
-  output.year.check                   % added
-  title howpublished new.block.checkb
-  format.title output
-  new.block
-  howpublished empty.or.unknown
-    { }
-    { "\bibinfo{howpublished}{" howpublished "}" * * output }
-  if$
-  "" output.nonnull.dot.space
-  output.day.month.year
-  calc.format.page.count output
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION { online } { misc }
-
-FUNCTION { game } { misc }
-
-
-FUNCTION { phdthesis }
-{
-  output.bibitem
-  format.authors "author" output.check
-  author format.key output          % added
-  output.year.check                 % added
-  new.block
-  format.title emphasize "title" output.check  % NB: ACM style requires emphasized thesis title
-  new.block
-  "\bibinfo{thesistype}{Ph.D. Dissertation}" format.thesis.type output
-  new.sentence
-  school "school" bibinfo.output.check
-  address empty.or.unknown
-     { }
-     { "\bibinfo{address}{" address * "}" * output }
-  if$
-  new.block
-  format.advisor output
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION {format.date}
-{ year empty.or.unknown
-    { month empty.or.unknown
-        {
-          ""                    % output empty date if year/month both empty
-          day empty.or.unknown
-            {  }
-            { "there's a day but no month or year in " cite$ * warning$ }
-          if$
-        }
-        { "there's a month but no year in " cite$ * warning$
-          month
-          day empty.or.unknown
-            { }
-            { " " * day * }
-          if$
-        }
-      if$
-    }
-    { month empty.or.unknown
-        {
-          year                  % output only year if month empty
-          day empty.or.unknown
-            {  }
-            { "there's a day and year but no month in " cite$ * warning$ }
-          if$
-        }
-        {
-          month " " *
-          day empty.or.unknown
-            { }
-            { day * ", " * }
-          if$
-          year *
-        }
-      if$
-    }
-  if$
-}
-
-FUNCTION {new.block.checka}
-{
-  empty.or.unknown
-    'skip$
-    'new.block
-  if$
-}
-
-FUNCTION { periodical }
-{
-  output.bibitem
-  editor empty.or.unknown
-    { organization output }
-    { format.editors output.nonnull }
-  if$
-  new.block
-  output.year.check
-  new.sentence
-  format.articletitle "title" output.check
-  format.journal.volume.number.day.month.year output
-  calc.format.page.count output
-  fin.entry
-}
-
-FUNCTION { proceedings }
-{
-  output.bibitem
-  editor empty.or.unknown
-    { organization output
-      organization format.key output }  % gnp - changed from author format.key
-    { format.editors output.nonnull }
-  if$
-  % author format.key output             % gnp - removed (should be either
-  %                                        editor or organization
-  output.year.check                    % added (newapa)
-  new.block
-  format.btitle format.city "title" output.check        % jtb: added city
-  new.sentence
-  format.bvolume output
-  format.number.series output
-  new.sentence
-  organization output
-  % jtb: normal order: publisher, address
-  publisher empty.or.unknown
-     { }
-     { "\bibinfo{publisher}{" publisher * "}" * output }
-  if$
-  address empty.or.unknown
-     { }
-     { "\bibinfo{address}{" address * "}" * output }
-  if$
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION { collection } { proceedings }
-
-FUNCTION { techreport }
-{
-  output.bibitem
-  format.authors "author" output.check
-  author format.key output             % added
-  output.year.check                    % added
-  new.block
-  format.btitle "title" output.check
-  new.block
-%   format.tr.number output               % jtb: moved month ...
-  format.tr.number output new.sentence    % Gerry  - need dot 2011/09/28
-  institution "institution" bibinfo.output.check
-  address empty.or.unknown
-    { }
-    { "\bibinfo{address}{" address "}" * * output }
-  if$
-  new.sentence
-  format.named.pages output
-  % ACM omits year at end in transactions style
-  % format.day.month.year output.nonnull.dot.space  % jtb: ... to here (no parens)
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note
-  fin.entry
-}
-
-FUNCTION { unpublished }
-{
-  output.bibitem
-  format.authors
-  "author" output.check
-  author format.key output              % added
-  output.year.check                     % added
-  new.block
-  format.title "title" output.check
-  fin.sentence
-  output.day.month.year                 % UTAH
-  calc.format.page.count output
-  fin.block
-  output.issue.doi.coden.isxn.lccn.url.eprint.note.check
-  fin.entry
-}
-
-FUNCTION { default.type } { misc }
-
-%%% ACM journal-style month definitions: full name if 1--5 letters, else
-%%% abbreviation of 3 or 4 characters and a dot
-
-MACRO {jan}             {"Jan."}
-
-MACRO {feb}             {"Feb."}
-
-MACRO {mar}             {"March"}
-
-MACRO {apr}             {"April"}
-
-MACRO {may}             {"May"}
-
-MACRO {jun}             {"June"}
-
-MACRO {jul}             {"July"}
-
-MACRO {aug}             {"Aug."}
-
-MACRO {sep}             {"Sept."}
-
-MACRO {oct}             {"Oct."}
-
-MACRO {nov}             {"Nov."}
-
-MACRO {dec}             {"Dec."}
-
-
-
-READ
-
-FUNCTION { sortify }
-{
-  purify$
-  "l" change.case$
-}
-
-FUNCTION { chop.word }
-{
-  's :=
-  'len :=
-  s #1 len substring$ =
-    { s len #1 + global.max$ substring$ }
-    's
-  if$
-}
-
-FUNCTION { sort.format.names }
-{
-  's :=
-  #1 'nameptr :=
-  ""
-  s num.names$ 'numnames :=
-  numnames 'namesleft :=
-    { namesleft #0 > }
-    { nameptr #1 >
-          { "   " * }
-         'skip$
-      if$
-      s nameptr "{vv{ } }{ll{ }}{  f{ }}{  jj{ }}" format.name$ 't :=
-      nameptr numnames = t "others" = and
-          { " et~al" * }
-          { t sortify * }
-      if$
-      nameptr #1 + 'nameptr :=
-      namesleft #1 - 'namesleft :=
-    }
-  while$
-}
-
-FUNCTION { sort.format.title }
-{
-  't :=
-  "A " #2
-    "An " #3
-      "The " #4 t chop.word
-    chop.word
-  chop.word
-  sortify
-  #1 global.max$ substring$
-}
-
-FUNCTION { author.sort }
-{
-  author empty.or.unknown
-    { key empty.or.unknown
-         { "to sort, need author or key in " cite$ * warning$
-           "" }
-         { key sortify }
-      if$
-    }
-    { author sort.format.names }
-  if$
-}
-
-FUNCTION { author.editor.sort }
-{
-  author empty.or.unknown
-    {
-      editor empty.or.unknown
-         {
-           key empty.or.unknown
-             { "to sort, need author, editor, or key in " cite$ * warning$
-               ""
-             }
-             { key sortify }
-           if$
-         }
-         { editor sort.format.names }
-      if$
-    }
-    { author sort.format.names }
-  if$
-}
-
-FUNCTION { editor.organization.sort }
-{
-  % added - GNP. Stack editor or organization for sorting (from alpha.bst).
-  % Unlike alpha.bst, we need entire names, not abbreviations
-
-  editor empty.or.unknown
-    { organization empty.or.unknown
-        { key empty.or.unknown
-            { "to sort, need editor, organization, or key in " cite$ * warning$
-              ""
-            }
-            { key sortify }
-          if$
-        }
-        { organization sortify }
-      if$
-    }
-    { editor sort.format.names }
-  if$
-}
-
-FUNCTION { author.editor.organization.sort }
-{
-  % added - GNP. Stack author or organization for sorting (from alpha.bst).
-  % Unlike alpha.bst, we need entire names, not abbreviations
-
-  author empty.or.unknown
-    {
-      editor empty.or.unknown
-        { organization empty.or.unknown
-            { key empty.or.unknown
-                { "to sort, need author, editor, or key in " cite$ * warning$
-                ""
-                }
-                { key sortify }
-              if$
-            }
-            { organization sortify }
-          if$
-        }
-        { editor sort.format.names }
-      if$
-    }
-    { author sort.format.names }
-  if$
-}
-
-FUNCTION { presort }
-{
-  % Presort creates the bibentry's label via a call to calc.label, and then
-  % sorts the entries based on entry type. Chicago.bst adds support for
-  % including organizations as the sort key; the following is stolen from
-  % alpha.bst.
-
-  calc.label
-  basic.label.year
-  swap$
-  "    "
-  swap$
-  * *
-  "    "
-  *
-  sortify
-  year field.or.null purify$ #-1 #4 substring$ * % add year
-  "    "
-  *
-  type$ "book" =
-  type$ "inbook" =
-  or
-  type$ "article" =
-  or
-    'author.editor.sort
-    { type$ "proceedings" =
-      type$ "periodical" =
-      or
-        'editor.organization.sort
-        { type$ "manual" =
-            'author.editor.organization.sort
-            'author.sort
-          if$
-        }
-      if$
-    }
-  if$
-  #1 entry.max$ substring$        % added for newapa
-  'sort.label :=                  % added for newapa
-  sort.label                      % added for newapa
-  *
-  "    "
-  *
-  title field.or.null
-  sort.format.title
-  *
-  #1 entry.max$ substring$
-  'sort.key$ :=
-}
-
-
-
-ITERATE { presort }
-
-SORT             % by label, year, author/editor, title
-
-% From plainnat.bst
-STRINGS { longest.label }
-
-INTEGERS { longest.label.width number.label }
-
-FUNCTION {initialize.longest.label}
-{ "" 'longest.label :=
-  #0 int.to.chr$ 'last.label :=
-  "" 'next.extra :=
-  #0 'longest.label.width :=
-  #0 'last.extra.num :=
-  #0 'number.label :=
-}
-
-
-
-FUNCTION { initialize.extra.label.stuff }
-{ #0 int.to.chr$ 'last.label :=
-  "" 'next.extra :=
-  #0 'last.extra.num :=
-}
-
-FUNCTION { forward.pass }
-{
-  % Pass through all entries, comparing current entry to last one.
-  % Need to concatenate year to the stack (done by calc.label) to determine
-  % if two entries are the same (see presort)
-
-  last.label
-  calc.basic.label year field.or.null purify$ #-1 #4 substring$ * % add year
-  #1 entry.max$ substring$ =     % are they equal?
-     { last.extra.num #1 + 'last.extra.num :=
-       last.extra.num int.to.chr$ 'extra.label :=
-     }
-     { "a" chr.to.int$ 'last.extra.num :=
-       "" 'extra.label :=
-       calc.basic.label year field.or.null purify$ #-1 #4 substring$ * % add year
-       #1 entry.max$ substring$ 'last.label := % assign to last.label
-     }
-  if$
-  number.label #1 + 'number.label :=
-}
-
-FUNCTION { reverse.pass }
-{
-  next.extra "b" =
-    { "a" 'extra.label := }
-     'skip$
-  if$
-  label.year extra.label * 'sort.year :=
-  extra.label 'next.extra :=
-}
-
-EXECUTE {initialize.extra.label.stuff}
-EXECUTE {initialize.longest.label}
-
-
-ITERATE {forward.pass}
-
-REVERSE {reverse.pass}
-
-FUNCTION { bib.sort.order }
-{
-  sort.label
-  "    "
-  *
-  year field.or.null sortify
-  *
-  "    "
-  *
-  title field.or.null
-  sort.format.title
-  *
-  #1 entry.max$ substring$
-  'sort.key$ :=
-}
-
-ITERATE { bib.sort.order }
-
-SORT             % by sort.label, year, title --- giving final bib. order.
-
-FUNCTION { begin.bib }
-{
-  %% Set to #0 show 13-digit ISBN in preference to 10-digit ISBN.
-  %% Set to #1 to show both 10-digit and 13-digit ISBNs.
-  #1 'show-isbn-10-and-13 :=
-
-  "%%% -*-BibTeX-*-" writeln
-  "%%% Do NOT edit. File created by BibTeX with style" writeln
-  "%%% ACM-Reference-Format-Journals [18-Jan-2012]." writeln
-  "" writeln
-
-  preamble$ empty.or.unknown
-    'skip$
-    { preamble$ writeln }
-  if$
-  "\begin{thebibliography}{" number.label int.to.str$ * "}" * writeln
-  ""                                                                         writeln
-  "%%% ====================================================================" writeln
-  "%%% NOTE TO THE USER: you can override these defaults by providing"       writeln
-  "%%% customized versions of any of these macros before the \bibliography"  writeln
-  "%%% command.  Each of them MUST provide its own final punctuation,"       writeln
-  "%%% except for \shownote{}, \showDOI{}, and \showURL{}.  The latter two"  writeln
-  "%%% do not use final punctuation, in order to avoid confusing it with"    writeln
-  "%%% the Web address."                                                     writeln
-  "%%%"                                                                      writeln
-  "%%% To suppress output of a particular field, define its macro to expand" writeln
-  "%%% to an empty string, or better, \unskip, like this:"                   writeln
-  "%%%"                                                                      writeln
-  "%%% \newcommand{\showDOI}[1]{\unskip}   % LaTeX syntax"                   writeln
-  "%%%"                                                                      writeln
-  "%%% \def \showDOI #1{\unskip}           % plain TeX syntax"               writeln
-  "%%%"                                                                      writeln
-  "%%% ====================================================================" writeln
-  ""                                                                         writeln
-
-  %% ACM publications do not use CODEN, ISSN, and LCCN data, so their default
-  %% macro wrappers expand to \unskip, discarding their values and unwanted
-  %% space.
-  %%
-  %% For other publications, prior definitions like these may be useful:
-  %%
-  %%     Plain TeX:
-  %%         \def \showCODEN     #1{CODEN #1.}
-  %%         \def \showISSN      #1{ISSN #1.}
-  %%         \def \showLCCN      #1{LCCN #1.}
-  %%
-  %%     LaTeX:
-  %%         \newcommand{\showCODEN}[1]{CODEN #1.}
-  %%         \newcommand{\showISSN}[1]#1{ISSN #1.}
-  %%         \newcommand{\showLCCN}[1]{LCCN #1.}
-
-  "\ifx \showCODEN    \undefined \def \showCODEN     #1{\unskip}     \fi" writeln
-  "\ifx \showDOI      \undefined \def \showDOI       #1{#1}\fi" writeln
-  % ACM styles omit ISBNs, but they can be included by suitable definitions of
-  % \showISBNx and \showISBNxiii before the .bbl file is read
-  "\ifx \showISBNx    \undefined \def \showISBNx     #1{\unskip}     \fi" writeln
-  "\ifx \showISBNxiii \undefined \def \showISBNxiii  #1{\unskip}     \fi" writeln
-  "\ifx \showISSN     \undefined \def \showISSN      #1{\unskip}     \fi" writeln
-  "\ifx \showLCCN     \undefined \def \showLCCN      #1{\unskip}     \fi" writeln
-  "\ifx \shownote     \undefined \def \shownote      #1{#1}          \fi" writeln % NB: final period supplied by add.period$ above
-  "\ifx \showarticletitle \undefined \def \showarticletitle #1{#1}   \fi" writeln
-  "\ifx \showURL      \undefined \def \showURL       {\relax}        \fi" writeln
-  "% The following commands are used for tagged output and should be " writeln
-  "% invisible to TeX" writeln
-  "\providecommand\bibfield[2]{#2}" writeln
-  "\providecommand\bibinfo[2]{#2}" writeln
-  "\providecommand\natexlab[1]{#1}" writeln
-  "\providecommand\showeprint[2][]{arXiv:#2}" writeln
-}
-
-EXECUTE {begin.bib}
-
-EXECUTE {init.state.consts}
-
-ITERATE {call.type$}
-
-FUNCTION { end.bib }
-{
-  newline$
-  "\end{thebibliography}"
-  writeln
-}
-
-EXECUTE {end.bib}

diff --git a/papers/SIGCOMM2018_IoT-SP/abstract.tex b/papers/SIGCOMM2018_IoT-SP/abstract.tex
deleted file mode 100644 (file)
index f024a63..0000000
--- a/papers/SIGCOMM2018_IoT-SP/abstract.tex
+++ /dev/null
@@ -1,3 +0,0 @@
-\begin{abstract}
-{\color{red}This is an abstract.}
-\end{abstract}
\ No newline at end of file

diff --git a/papers/SIGCOMM2018_IoT-SP/acmart.cls b/papers/SIGCOMM2018_IoT-SP/acmart.cls
deleted file mode 100755 (executable)
index 027dd18..0000000
--- a/papers/SIGCOMM2018_IoT-SP/acmart.cls
+++ /dev/null
@@ -1,2561 +0,0 @@
-%%
-%% This is file `acmart.cls',
-%% generated with the docstrip utility.
-%%
-%% The original source files were:
-%%
-%% acmart.dtx  (with options: `class')
-%% 
-%% IMPORTANT NOTICE:
-%% 
-%% For the copyright see the source file.
-%% 
-%% Any modified versions of this file must be renamed
-%% with new filenames distinct from acmart.cls.
-%% 
-%% For distribution of the original source see the terms
-%% for copying and modification in the file acmart.dtx.
-%% 
-%% This generated file may be distributed as long as the
-%% original source files, as listed above, are part of the
-%% same distribution. (The sources need not necessarily be
-%% in the same archive or directory.)
-%% \CharacterTable
-%%  {Upper-case    \A\B\C\D\E\F\G\H\I\J\K\L\M\N\O\P\Q\R\S\T\U\V\W\X\Y\Z
-%%   Lower-case    \a\b\c\d\e\f\g\h\i\j\k\l\m\n\o\p\q\r\s\t\u\v\w\x\y\z
-%%   Digits        \0\1\2\3\4\5\6\7\8\9
-%%   Exclamation   \!     Double quote  \"     Hash (number) \#
-%%   Dollar        \$     Percent       \%     Ampersand     \&
-%%   Acute accent  \'     Left paren    \(     Right paren   \)
-%%   Asterisk      \*     Plus          \+     Comma         \,
-%%   Minus         \-     Point         \.     Solidus       \/
-%%   Colon         \:     Semicolon     \;     Less than     \<
-%%   Equals        \=     Greater than  \>     Question mark \?
-%%   Commercial at \@     Left bracket  \[     Backslash     \\
-%%   Right bracket \]     Circumflex    \^     Underscore    \_
-%%   Grave accent  \`     Left brace    \{     Vertical bar  \|
-%%   Right brace   \}     Tilde         \~}
-\NeedsTeXFormat{LaTeX2e}
-\ProvidesClass{acmart}
-[2018/02/07 v1.50 Typesetting articles for the Association for
-Computing Machinery]
-\def\@classname{acmart}
-\InputIfFileExists{acmart-preload-hook.tex}{%
-  \ClassWarning{\@classname}{%
-    I am loading acmart-preload-hook.tex. You are fully responsible
-    for any problems from now on.}}{}
-\RequirePackage{xkeyval}
-\RequirePackage{xstring}
-\define@choicekey*+{acmart.cls}{format}[\ACM@format\ACM@format@nr]{%
-  manuscript, acmsmall, acmlarge, acmtog, sigconf, siggraph,
-  sigplan, sigchi, sigchi-a}[manuscript]{}{%
-  \ClassError{\@classname}{The option format must be manuscript,
-    acmsmall, acmlarge, acmtog, sigconf, siggraph,
-    sigplan, sigchi or sigchi-a}}
-\def\@DeclareACMFormat#1{\DeclareOptionX{#1}{\setkeys{acmart.cls}{format=#1}}}
-\@DeclareACMFormat{manuscript}
-\@DeclareACMFormat{acmsmall}
-\@DeclareACMFormat{acmlarge}
-\@DeclareACMFormat{acmtog}
-\@DeclareACMFormat{sigconf}
-\@DeclareACMFormat{siggraph}
-\@DeclareACMFormat{sigplan}
-\@DeclareACMFormat{sigchi}
-\@DeclareACMFormat{sigchi-a}
-\ExecuteOptionsX{format}
-\define@boolkey+{acmart.cls}[@ACM@]{screen}[true]{%
-  \if@ACM@screen
-    \PackageInfo{\@classname}{Using screen mode}%
-  \else
-    \PackageInfo{\@classname}{Not using screen mode}%
-  \fi}{\PackageError{\@classname}{The option screen can be either true or
-    false}}
-\ExecuteOptionsX{screen=false}
-\define@boolkey+{acmart.cls}[@ACM@]{acmthm}[true]{%
-  \if@ACM@acmthm
-    \PackageInfo{\@classname}{Requiring acmthm}%
-  \else
-    \PackageInfo{\@classname}{Suppressing acmthm}%
-  \fi}{\PackageError{\@classname}{The option acmthm can be either true or
-    false}}
-\ExecuteOptionsX{acmthm=true}
-\define@boolkey+{acmart.cls}[@ACM@]{review}[true]{%
-  \if@ACM@review
-    \PackageInfo{\@classname}{Using review mode}%
-    \AtBeginDocument{\@ACM@printfoliostrue}%
-  \else
-    \PackageInfo{\@classname}{Not using review mode}%
-  \fi}{\PackageError{\@classname}{The option review can be either true or
-    false}}
-\ExecuteOptionsX{review=false}
-\define@boolkey+{acmart.cls}[@ACM@]{authorversion}[true]{%
-  \if@ACM@authorversion
-    \PackageInfo{\@classname}{Using authorversion mode}%
-  \else
-    \PackageInfo{\@classname}{Not using authorversion mode}%
-  \fi}{\PackageError{\@classname}{The option authorversion can be either true or
-    false}}
-\ExecuteOptionsX{authorversion=false}
-\define@boolkey+{acmart.cls}[@ACM@]{natbib}[true]{%
-  \if@ACM@natbib
-    \PackageInfo{\@classname}{Explicitly selecting natbib mode}%
-  \else
-    \PackageInfo{\@classname}{Explicitly deselecting natbib mode}%
-  \fi}{\PackageError{\@classname}{The option natbib can be either true or
-    false}}
-\ExecuteOptionsX{natbib=true}
-\define@boolkey+{acmart.cls}[@ACM@]{anonymous}[true]{%
-  \if@ACM@anonymous
-    \PackageInfo{\@classname}{Using anonymous mode}%
-  \else
-    \PackageInfo{\@classname}{Not using anonymous mode}%
-  \fi}{\PackageError{\@classname}{The option anonymous can be either true or
-    false}}
-\ExecuteOptionsX{anonymous=false}
-\define@boolkey+{acmart.cls}[@ACM@]{timestamp}[true]{%
-  \if@ACM@timestamp
-    \PackageInfo{\@classname}{Using timestamp mode}%
-  \else
-    \PackageInfo{\@classname}{Not using timestamp mode}%
-  \fi}{\PackageError{\@classname}{The option timestamp can be either true or
-    false}}
-\ExecuteOptionsX{timestamp=false}
-\define@boolkey+{acmart.cls}[@ACM@]{authordraft}[true]{%
-  \if@ACM@authordraft
-    \PackageInfo{\@classname}{Using authordraft mode}%
-    \@ACM@timestamptrue
-    \@ACM@reviewtrue
-  \else
-    \PackageInfo{\@classname}{Not using authordraft mode}%
-  \fi}{\PackageError{\@classname}{The option authordraft can be either true or
-    false}}
-\ExecuteOptionsX{authordraft=false}
-\def\ACM@fontsize{}
-\DeclareOptionX{9pt}{\edef\ACM@fontsize{\CurrentOption}}
-\DeclareOptionX{10pt}{\edef\ACM@fontsize{\CurrentOption}}
-\DeclareOptionX{11pt}{\edef\ACM@fontsize{\CurrentOption}}
-\DeclareOptionX{12pt}{\edef\ACM@fontsize{\CurrentOption}}
-\DeclareOptionX{draft}{\PassOptionsToClass{\CurrentOption}{amsart}}
-\DeclareOptionX{*}{\PassOptionsToClass{\CurrentOption}{amsart}}
-\ProcessOptionsX
-\ClassInfo{\@classname}{Using format \ACM@format, number \ACM@format@nr}
-\newif\if@ACM@manuscript
-\newif\if@ACM@journal
-\newif\if@ACM@sigchiamode
-\ifnum\ACM@format@nr=5\relax % siggraph
-  \ClassWarning{\@classname}{The format siggraph is now obsolete.
-    I am switching to sigconf.}
-  \setkeys{acmart.cls}{format=sigconf}
-\fi
-\ifnum\ACM@format@nr=0\relax
-  \@ACM@manuscripttrue
-\else
-  \@ACM@manuscriptfalse
-\fi
-\@ACM@sigchiamodefalse
-\ifcase\ACM@format@nr
-\relax % manuscript
-  \@ACM@journaltrue
-\or % acmsmall
-  \@ACM@journaltrue
-\or % acmlarge
-  \@ACM@journaltrue
-\or % acmtog
-  \@ACM@journaltrue
-\or % sigconf
-  \@ACM@journalfalse
-\or % siggraph
-  \@ACM@journalfalse
- \or % sigplan
-  \@ACM@journalfalse
- \or % sigchi
-  \@ACM@journalfalse
-\or % sigchi-a
-  \@ACM@journalfalse
-  \@ACM@sigchiamodetrue
-\fi
-\ifx\ACM@fontsize\@empty
-  \ifcase\ACM@format@nr
-  \relax % manuscript
-    \def\ACM@fontsize{9pt}%
-  \or % acmsmall
-    \def\ACM@fontsize{10pt}%
-  \or % acmlarge
-    \def\ACM@fontsize{10pt}%
-  \or % acmtog
-    \def\ACM@fontsize{9pt}%
-  \or % sigconf
-    \def\ACM@fontsize{9pt}%
-  \or % siggraph
-    \def\ACM@fontsize{9pt}%
-   \or % sigplan
-    \def\ACM@fontsize{10pt}%
-   \or % sigchi
-    \def\ACM@fontsize{10pt}%
-  \or % sigchi-a
-    \def\ACM@fontsize{10pt}%
-  \fi
-\fi
-\ClassInfo{\@classname}{Using fontsize \ACM@fontsize}
-\LoadClass[\ACM@fontsize, reqno]{amsart}
-\RequirePackage{microtype}
-\RequirePackage{etoolbox}
-\RequirePackage{refcount}
-\RequirePackage{totpages}
-\RequirePackage{environ}
-\if@ACM@manuscript
-\RequirePackage{setspace}
-\onehalfspacing
-\fi
-\RequirePackage{textcase}
-\if@ACM@natbib
-  \RequirePackage{natbib}
-  \renewcommand{\bibsection}{%
-     \section*{\refname}%
-     \phantomsection\addcontentsline{toc}{section}{\refname}%
-  }
-  \renewcommand{\bibfont}{\bibliofont}
-  \renewcommand\setcitestyle[1]{
-  \@for\@tempa:=#1\do
-  {\def\@tempb{round}\ifx\@tempa\@tempb
-     \renewcommand\NAT@open{(}\renewcommand\NAT@close{)}\fi
-   \def\@tempb{square}\ifx\@tempa\@tempb
-     \renewcommand\NAT@open{[}\renewcommand\NAT@close{]}\fi
-   \def\@tempb{angle}\ifx\@tempa\@tempb
-     \renewcommand\NAT@open{$<$}\renewcommand\NAT@close{$>$}\fi
-   \def\@tempb{curly}\ifx\@tempa\@tempb
-     \renewcommand\NAT@open{\{}\renewcommand\NAT@close{\}}\fi
-   \def\@tempb{semicolon}\ifx\@tempa\@tempb
-     \renewcommand\NAT@sep{;}\fi
-   \def\@tempb{colon}\ifx\@tempa\@tempb
-     \renewcommand\NAT@sep{;}\fi
-   \def\@tempb{comma}\ifx\@tempa\@tempb
-     \renewcommand\NAT@sep{,}\fi
-   \def\@tempb{authoryear}\ifx\@tempa\@tempb
-     \NAT@numbersfalse\fi
-   \def\@tempb{numbers}\ifx\@tempa\@tempb
-     \NAT@numberstrue\NAT@superfalse\fi
-   \def\@tempb{super}\ifx\@tempa\@tempb
-     \NAT@numberstrue\NAT@supertrue\fi
-   \def\@tempb{nobibstyle}\ifx\@tempa\@tempb
-     \let\bibstyle=\@gobble\fi
-   \def\@tempb{bibstyle}\ifx\@tempa\@tempb
-     \let\bibstyle=\@citestyle\fi
-   \def\@tempb{sort}\ifx\@tempa\@tempb
-     \def\NAT@sort{\@ne}\fi
-   \def\@tempb{nosort}\ifx\@tempa\@tempb
-     \def\NAT@sort{\z@}\fi
-   \def\@tempb{compress}\ifx\@tempa\@tempb
-     \def\NAT@cmprs{\@ne}\fi
-   \def\@tempb{nocompress}\ifx\@tempa\@tempb
-     \def\NAT@cmprs{\@z}\fi
-   \def\@tempb{sort&compress}\ifx\@tempa\@tempb
-     \def\NAT@sort{\@ne}\def\NAT@cmprs{\@ne}\fi
-   \def\@tempb{mcite}\ifx\@tempa\@tempb
-     \let\NAT@merge\@ne\fi
-   \def\@tempb{merge}\ifx\@tempa\@tempb
-     \@ifnum{\NAT@merge<\tw@}{\let\NAT@merge\tw@}{}\fi
-   \def\@tempb{elide}\ifx\@tempa\@tempb
-     \@ifnum{\NAT@merge<\thr@@}{\let\NAT@merge\thr@@}{}\fi
-   \def\@tempb{longnamesfirst}\ifx\@tempa\@tempb
-     \NAT@longnamestrue\fi
-   \def\@tempb{nonamebreak}\ifx\@tempa\@tempb
-     \def\NAT@nmfmt#1{\mbox{\NAT@up#1}}\fi
-   \expandafter\NAT@find@eq\@tempa=\relax\@nil
-   \if\@tempc\relax\else
-     \expandafter\NAT@rem@eq\@tempc
-     \def\@tempb{open}\ifx\@tempa\@tempb
-      \xdef\NAT@open{\@tempc}\fi
-     \def\@tempb{close}\ifx\@tempa\@tempb
-      \xdef\NAT@close{\@tempc}\fi
-     \def\@tempb{aysep}\ifx\@tempa\@tempb
-      \xdef\NAT@aysep{\@tempc}\fi
-     \def\@tempb{yysep}\ifx\@tempa\@tempb
-      \xdef\NAT@yrsep{\@tempc}\fi
-     \def\@tempb{notesep}\ifx\@tempa\@tempb
-      \xdef\NAT@cmt{\@tempc}\fi
-     \def\@tempb{citesep}\ifx\@tempa\@tempb
-      \xdef\NAT@sep{\@tempc}\fi
-   \fi
-  }%
-  \NAT@@setcites
-  }
-  \renewcommand\citestyle[1]{%
-    \ifcsname bibstyle@#1\endcsname%
-    \csname bibstyle@#1\endcsname\let\bibstyle\@gobble%
-    \else%
-    \@latex@error{Undefined `#1' citestyle}%
-    \fi
-  }%
-\fi
-\newcommand{\bibstyle@acmauthoryear}{%
-  \setcitestyle{%
-    authoryear,%
-    open={[},close={]},citesep={;},%
-    aysep={},yysep={,},%
-    notesep={, }}}
-\newcommand{\bibstyle@acmnumeric}{%
-  \setcitestyle{%
-    numbers,sort&compress,%
-    open={[},close={]},citesep={,},%
-    notesep={, }}}
-\if@ACM@natbib
-\citestyle{acmnumeric}
-\fi
-\def\@startsection#1#2#3#4#5#6{%
-  \if@noskipsec \leavevmode \fi
-  \par
-  \@tempskipa #4\relax
-  \@afterindenttrue
-  \ifdim \@tempskipa <\z@
-    \@tempskipa -\@tempskipa \@afterindentfalse
-  \fi
-  \if@nobreak
-    \everypar{}%
-  \else
-    \addpenalty\@secpenalty\addvspace\@tempskipa
-  \fi
-  \@ifstar
-    {\@ssect{#3}{#4}{#5}{#6}}%
-    {\@dblarg{\@sect{#1}{#2}{#3}{#4}{#5}{#6}}}}
-\def\@sect#1#2#3#4#5#6[#7]#8{%
-  \edef\@toclevel{\ifnum#2=\@m 0\else\number#2\fi}%
-  \ifnum #2>\c@secnumdepth
-    \let\@svsec\@empty
-  \else
-    \refstepcounter{#1}%
-    \protected@edef\@svsec{\@seccntformat{#1}\relax}%
-  \fi
-  \@tempskipa #5\relax
-  \ifdim \@tempskipa>\z@
-    \begingroup
-      #6{%
-        \@hangfrom{\hskip #3\relax\@svsec}%
-          \interlinepenalty \@M #8\@@par}%
-    \endgroup
-    \csname #1mark\endcsname{#7}%
-    \ifnum #2>\c@secnumdepth \else
-        \@tochangmeasure{\csname the#1\endcsname}%
-    \fi
-    \addcontentsline{toc}{#1}{%
-      \ifnum #2>\c@secnumdepth \else
-        \protect\numberline{\csname the#1\endcsname}%
-      \fi
-      #7}%
-  \else
-    \def\@svsechd{%
-      #6{\hskip #3\relax
-      \@svsec #8}%
-      \csname #1mark\endcsname{#7}%
-      \ifnum #2>\c@secnumdepth \else
-        \@tochangmeasure{\csname the#1\endcsname\space}%
-      \fi
-      \addcontentsline{toc}{#1}{%
-        \ifnum #2>\c@secnumdepth \else
-          \protect\numberline{\csname the#1\endcsname}%
-        \fi
-        #7}}%
-  \fi
-  \@xsect{#5}}
-\def\@xsect#1{%
-  \@tempskipa #1\relax
-  \ifdim \@tempskipa>\z@
-    \par \nobreak
-    \vskip \@tempskipa
-    \@afterheading
-  \else
-    \@nobreakfalse
-    \global\@noskipsectrue
-    \everypar{%
-      \if@noskipsec
-        \global\@noskipsecfalse
-       {\setbox\z@\lastbox}%
-        \clubpenalty\@M
-        \begingroup \@svsechd \endgroup
-        \unskip
-        \@tempskipa #1\relax
-        \hskip -\@tempskipa
-      \else
-        \clubpenalty \@clubpenalty
-        \everypar{}%
-      \fi}%
-  \fi
-  \ignorespaces}
-\def\@seccntformat#1{\csname the#1\endcsname\quad}
-\def\@ssect#1#2#3#4#5{%
-  \@tempskipa #3\relax
-  \ifdim \@tempskipa>\z@
-    \begingroup
-      #4{%
-        \@hangfrom{\hskip #1}%
-          \interlinepenalty \@M #5\@@par}%
-    \endgroup
-  \else
-    \def\@svsechd{#4{\hskip #1\relax #5}}%
-  \fi
-  \@xsect{#3}}
-\def\@starttoc#1#2{\begingroup\makeatletter
-  \setTrue{#1}%
-  \par\removelastskip\vskip\z@skip
-  \@startsection{section}\@M\z@{\linespacing\@plus\linespacing}%
-    {.5\linespacing}{\centering\contentsnamefont}{#2}%
-  \@input{\jobname.#1}%
-  \if@filesw
-    \@xp\newwrite\csname tf@#1\endcsname
-    \immediate\@xp\openout\csname tf@#1\endcsname \jobname.#1\relax
-  \fi
-  \global\@nobreakfalse \endgroup
-  \addvspace{32\p@\@plus14\p@}%
-}
-\def\l@section{\@tocline{1}{0pt}{1pc}{2pc}{}}
-\def\l@subsection{\@tocline{2}{0pt}{1pc}{3pc}{}}
-\def\l@subsubsection{\@tocline{2}{0pt}{1pc}{5pc}{}}
-\let\@footnotemark@nolink\@footnotemark
-\let\@footnotetext@nolink\@footnotetext
-\RequirePackage[bookmarksnumbered,unicode]{hyperref}
-\pdfstringdefDisableCommands{%
-  \def\unskip{}%
-  \def\textbullet{- }%
-  \def\textrightarrow{ -> }%
-  \def\footnotemark{}%
-}
-\urlstyle{rm}
-\ifcase\ACM@format@nr
-\relax % manuscript
-\or % acmsmall
-\or % acmlarge
-\or % acmtog
-\or % sigconf
-\or % siggraph
-\or % sigplan
-  \urlstyle{sf}
-\or % sigchi
-\or % sigchi-a
-  \urlstyle{sf}
-\fi
-\AtEndPreamble{%
-  \if@ACM@screen
-    \hypersetup{colorlinks,
-      linkcolor=ACMRed,
-      citecolor=ACMPurple,
-      urlcolor=ACMDarkBlue,
-      filecolor=ACMDarkBlue}
-    \else
-    \hypersetup{hidelinks}
-  \fi}
-\if@ACM@natbib
-  \let\citeN\cite
-  \let\cite\citep
-  \let\citeANP\citeauthor
-  \let\citeNN\citeyearpar
-  \let\citeyearNP\citeyear
-  \let\citeNP\citealt
-  \DeclareRobustCommand\citeA
-     {\begingroup\NAT@swafalse
-       \let\NAT@ctype\@ne\NAT@partrue\NAT@fullfalse\NAT@open\NAT@citetp}%
-  \providecommand\newblock{}%
-\else
-  \AtBeginDocument{%
-    \let\shortcite\cite%
-    \providecommand\citename[1]{#1}}
-\fi
-\newcommand\shortcite[2][]{%
-  \ifNAT@numbers\cite[#1]{#2}\else\citeyearpar[#1]{#2}\fi}
-\def\bibliographystyle#1{%
-  \ifx\@begindocumenthook\@undefined\else
-    \expandafter\AtBeginDocument
-  \fi
-    {\if@filesw
-       \immediate\write\@auxout{\string\bibstyle{#1}}%
-     \fi}}
-\RequirePackage{graphicx}
-\RequirePackage[prologue]{xcolor}
-\definecolor[named]{ACMBlue}{cmyk}{1,0.1,0,0.1}
-\definecolor[named]{ACMYellow}{cmyk}{0,0.16,1,0}
-\definecolor[named]{ACMOrange}{cmyk}{0,0.42,1,0.01}
-\definecolor[named]{ACMRed}{cmyk}{0,0.90,0.86,0}
-\definecolor[named]{ACMLightBlue}{cmyk}{0.49,0.01,0,0}
-\definecolor[named]{ACMGreen}{cmyk}{0.20,0,1,0.19}
-\definecolor[named]{ACMPurple}{cmyk}{0.55,1,0,0.15}
-\definecolor[named]{ACMDarkBlue}{cmyk}{1,0.58,0,0.21}
-\if@ACM@authordraft
-  \RequirePackage{draftwatermark}
-  \SetWatermarkFontSize{0.5in}
-  \SetWatermarkColor[gray]{.9}
-  \SetWatermarkText{\parbox{12em}{\centering
-      Unpublished working draft.\\
-      Not for distribution.}}
-\fi
-\RequirePackage{geometry}
-\ifcase\ACM@format@nr
-\relax % manuscript
-   \geometry{letterpaper,head=13pt,
-   marginparwidth=6pc,heightrounded}%
-\or % acmsmall
-   \geometry{twoside=true,
-     includeheadfoot, head=13pt, foot=2pc,
-     paperwidth=6.75in, paperheight=10in,
-     top=58pt, bottom=44pt, inner=46pt, outer=46pt,
-     marginparwidth=2pc,heightrounded
-   }%
-\or % acmlarge
-   \geometry{twoside=true, head=13pt, foot=2pc,
-     paperwidth=8.5in, paperheight=11in,
-     includeheadfoot,
-     top=78pt, bottom=114pt, inner=81pt, outer=81pt,
-     marginparwidth=4pc,heightrounded
-     }%
-\or % acmtog
-   \geometry{twoside=true, head=13pt, foot=2pc,
-     paperwidth=8.5in, paperheight=11in,
-     includeheadfoot, columnsep=24pt,
-     top=52pt, bottom=75pt, inner=52pt, outer=52pt,
-     marginparwidth=2pc,heightrounded
-     }%
-\or % sigconf
-   \geometry{twoside=true, head=13pt,
-     paperwidth=8.5in, paperheight=11in,
-     includeheadfoot, columnsep=2pc,
-     top=57pt, bottom=73pt, inner=54pt, outer=54pt,
-     marginparwidth=2pc,heightrounded
-     }%
-\or % siggraph
-   \geometry{twoside=true, head=13pt,
-     paperwidth=8.5in, paperheight=11in,
-     includeheadfoot, columnsep=2pc,
-     top=57pt, bottom=73pt, inner=54pt, outer=54pt,
-     marginparwidth=2pc,heightrounded
-     }%
-\or % sigplan
-   \geometry{twoside=true, head=13pt,
-     paperwidth=8.5in, paperheight=11in,
-     includeheadfoot=false, columnsep=2pc,
-     top=1in, bottom=1in, inner=0.75in, outer=0.75in,
-     marginparwidth=2pc,heightrounded
-     }%
-\or % sigchi
-   \geometry{twoside=true, head=13pt,
-     paperwidth=8.5in, paperheight=11in,
-     includeheadfoot, columnsep=2pc,
-     top=66pt, bottom=73pt, inner=54pt, outer=54pt,
-     marginparwidth=2pc,heightrounded
-     }%
-\or % sigchi-a
-   \geometry{twoside=false, head=13pt,
-     paperwidth=11in, paperheight=8.5in,
-     includeheadfoot, marginparsep=72pt,
-     marginparwidth=170pt, columnsep=20pt,
-     top=72pt, bottom=72pt, left=314pt, right=72pt
-     }%
-     \@mparswitchfalse
-     \reversemarginpar
-\fi
-\setlength\parindent{10\p@}
-\setlength\parskip{\z@}
-\ifcase\ACM@format@nr
-\relax % manuscript
-\or % acmsmall
-\or % acmlarge
-\or % acmtog
-  \setlength\parindent{9\p@}%
-\or % sigconf
-\or % siggraph
-\or % sigplan
-\or % sigchi
-\or % sigchi-a
-\fi
-\setlength\normalparindent{\parindent}
-\def\copyrightpermissionfootnoterule{\kern-3\p@
-  \hrule \@width \columnwidth \kern 2.6\p@}
-\RequirePackage{manyfoot}
-\SelectFootnoteRule[2]{copyrightpermission}
-\DeclareNewFootnote{authorsaddresses}
-\SelectFootnoteRule[2]{copyrightpermission}
-\DeclareNewFootnote{copyrightpermission}
-\def\footnoterule{\kern-3\p@
-  \hrule \@width 4pc \kern 2.6\p@}
-\def\endminipage{%
-    \par
-    \unskip
-    \ifvoid\@mpfootins\else
-      \vskip\skip\@mpfootins
-      \normalcolor
-      \unvbox\@mpfootins
-    \fi
-    \@minipagefalse
-  \color@endgroup
-  \egroup
-  \expandafter\@iiiparbox\@mpargs{\unvbox\@tempboxa}}
-\def\@makefntext{\noindent\@makefnmark}
-\if@ACM@sigchiamode
-\long\def\@footnotetext#1{\marginpar{%
-    \reset@font\small
-    \interlinepenalty\interfootnotelinepenalty
-    \protected@edef\@currentlabel{%
-       \csname p@footnote\endcsname\@thefnmark
-    }%
-    \color@begingroup
-      \@makefntext{%
-        \rule\z@\footnotesep\ignorespaces#1\@finalstrut\strutbox}%
-    \color@endgroup}}%
-\fi
-\long\def\@mpfootnotetext#1{%
-  \global\setbox\@mpfootins\vbox{%
-    \unvbox\@mpfootins
-    \reset@font\footnotesize
-    \hsize\columnwidth
-    \@parboxrestore
-    \protected@edef\@currentlabel
-         {\csname p@mpfootnote\endcsname\@thefnmark}%
-    \color@begingroup\centering
-      \@makefntext{%
-        \rule\z@\footnotesep\ignorespaces#1\@finalstrut\strutbox}%
-    \color@endgroup}}
-\def\@makefnmark{\hbox{\@textsuperscript{\normalfont\@thefnmark}}}
-\def\@textbottom{\vskip \z@ \@plus 1pt}
-\let\@texttop\relax
-\RequirePackage{iftex}
-\ifPDFTeX
-\input{glyphtounicode}
-\pdfglyphtounicode{f_f}{FB00}
-\pdfglyphtounicode{f_f_i}{FB03}
-\pdfglyphtounicode{f_f_l}{FB04}
-\pdfglyphtounicode{f_i}{FB01}
-\pdfglyphtounicode{t_t}{00740074}
-\pdfglyphtounicode{f_t}{00660074}
-\pdfglyphtounicode{T_h}{00540068}
-\pdfgentounicode=1
-\fi
-\RequirePackage{cmap}
-\newif\if@ACM@newfonts
-\@ACM@newfontstrue
-\IfFileExists{libertine.sty}{}{\ClassWarning{\@classname}{You do not
-    have the libertine package installed.  Please upgrade your
-    TeX}\@ACM@newfontsfalse}
-\IfFileExists{zi4.sty}{}{\ClassWarning{\@classname}{You do not
-    have the zi4 package installed.  Please upgrade your
-    TeX}\@ACM@newfontsfalse}
-\IfFileExists{newtxmath.sty}{}{\ClassWarning{\@classname}{You do not
-    have the newtxmath package installed.  Please upgrade your
-    TeX}\@ACM@newfontsfalse}
-\if@ACM@newfonts
-\RequirePackage[tt=false, type1=true]{libertine}
-\RequirePackage[varqu]{zi4}
-\RequirePackage[libertine]{newtxmath}
-\RequirePackage[T1]{fontenc}
-\fi
-\let\liningnums\@undefined
-\AtEndPreamble{%
-  \DeclareTextFontCommand{\liningnums}{\libertineLF}}
-\if@ACM@sigchiamode
-  \renewcommand{\familydefault}{\sfdefault}
-\fi
-\RequirePackage{caption, float}
-\captionsetup[table]{position=top}
-\if@ACM@journal
-  \captionsetup{labelfont={sf, small},
-    textfont={sf, small}, margin=\z@}
-  \captionsetup[figure]{name={Fig.}}
-\else
-  \captionsetup{labelfont={bf},
-    textfont={bf}, labelsep=colon, margin=\z@}
-  \ifcase\ACM@format@nr
-  \relax % manuscript
-  \or % acmsmall
-  \or % acmlarge
-  \or % acmtog
-  \or % sigconf
-  \or % siggraph
-    \captionsetup{textfont={it}}
-  \or % sigplan
-    \captionsetup{labelfont={bf},
-      textfont={normalfont}, labelsep=period, margin=\z@}
-  \or % sigchi
-    \captionsetup[figure]{labelfont={bf, small},
-      textfont={bf, small}}
-  \or % sigchi-a
-    \captionsetup[figure]{labelfont={bf, small},
-      textfont={bf, small}}
-  \fi
-\fi
-\newfloat{sidebar}{}{sbar}
-\floatname{sidebar}{Sidebar}
-\renewenvironment{sidebar}{\Collect@Body\@sidebar}{}
-\long\def\@sidebar#1{\bgroup\captionsetup{type=sidebar}%
-  \marginpar{\small#1}\egroup}
-\newenvironment{marginfigure}{\Collect@Body\@marginfigure}{}
-\long\def\@marginfigure#1{\bgroup\captionsetup{type=figure}%
-  \marginpar{\centering\small#1}\egroup}
-\newenvironment{margintable}{\Collect@Body\@margintable}{}
-\long\def\@margintable#1{\bgroup\captionsetup{type=table}%
-  \marginpar{\centering\small#1}\egroup}
-\newdimen\fulltextwidth
-\fulltextwidth=\dimexpr(\textwidth+\marginparwidth+\marginparsep)
-\if@ACM@sigchiamode
-\def\@dblfloat{\bgroup\columnwidth=\fulltextwidth
-  \let\@endfloatbox\@endwidefloatbox
-  \def\@fpsadddefault{\def\@fps{tp}}%
-  \@float}
-\fi
-\if@ACM@sigchiamode
-\def\end@dblfloat{%
-    \end@float\egroup}
-\fi
-\def\@endwidefloatbox{%
-  \par\vskip\z@skip
-  \@minipagefalse
-  \outer@nobreak
-  \egroup
-  \color@endbox
-  \global\setbox\@currbox=\vbox{\moveleft
-    \dimexpr(\fulltextwidth-\textwidth)\box\@currbox}%
-  \wd\@currbox=\textwidth
-}
-\ifcase\ACM@format@nr
-\relax % manuscript
-\or % acmsmall
-\or % acmlarge
-\or % acmtog
-\or % sigconf
-\or % siggraph
-\or % sigplan
-\def\labelenumi{\theenumi.}
-\def\labelenumii{\theenumii.}
-\def\labelenumiii{\theenumiii.}
-\def\labelenumiv{\theenumiv.}
-\or % sigchi
-\or % sigchi-a
-\fi
-\newdimen\@ACM@labelwidth
-\AtBeginDocument{%
-  \setlength\labelsep{4pt}
-  \setlength{\@ACM@labelwidth}{6.5pt}
-
-  %% First-level list: when beginning after the first line of an
-  %% indented paragraph or ending before an indented paragraph, labels
-  %% should not hang to the left of the preceding/following text.
-  \setlength\leftmargini{\z@}
-  \addtolength\leftmargini{\parindent}
-  \addtolength\leftmargini{2\labelsep}
-  \addtolength\leftmargini{\@ACM@labelwidth}
-
-  %% Second-level and higher lists.
-  \setlength\leftmarginii{\z@}
-  \addtolength\leftmarginii{0.5\labelsep}
-  \addtolength\leftmarginii{\@ACM@labelwidth}
-  \setlength\leftmarginiii{\leftmarginii}
-  \setlength\leftmarginiv{\leftmarginiii}
-  \setlength\leftmarginv{\leftmarginiv}
-  \setlength\leftmarginvi{\leftmarginv}
-  \@listi}
-\newskip\listisep
-\listisep\smallskipamount
-\def\@listI{\leftmargin\leftmargini
-  \labelwidth\leftmargini \advance\labelwidth-\labelsep
-  \listparindent\z@
-  \topsep\listisep}
-\let\@listi\@listI
-\def\@listii{\leftmargin\leftmarginii
-  \labelwidth\leftmarginii \advance\labelwidth-\labelsep
-  \topsep\z@skip}
-\def\@listiii{\leftmargin\leftmarginiii
-  \labelwidth\leftmarginiii \advance\labelwidth-\labelsep}
-\def\@listiv{\leftmargin\leftmarginiv
-  \labelwidth\leftmarginiv \advance\labelwidth-\labelsep}
-\def\@listv{\leftmargin\leftmarginv
-  \labelwidth\leftmarginv \advance\labelwidth-\labelsep}
-\def\@listvi{\leftmargin\leftmarginvi
-  \labelwidth\leftmarginvi \advance\labelwidth-\labelsep}
-\renewcommand{\descriptionlabel}[1]{\upshape\bfseries #1}
-\renewenvironment{description}{\list{}{%
-    \labelwidth\@ACM@labelwidth
-    \let\makelabel\descriptionlabel}%
-}{
-  \endlist
-}
-\let\enddescription=\endlist % for efficiency
-\define@choicekey*+{ACM}{acmJournal}[\@journalCode\@journalCode@nr]{%
-  CIE,%
-  CSUR,%
-  DTRAP,%
-  IMWUT,%
-  JACM,%
-  JDIQ,%
-  JEA,%
-  JERIC,%
-  JETC,%
-  JOCCH,%
-  PACMHCI,%
-  PACMPL,%
-  POMACS,%
-  TAAS,%
-  TACCESS,%
-  TACO,%
-  TALG,%
-  TALLIP,%
-  TAP,%
-  TCPS,%
-  TEAC,%
-  TECS,%
-  THRI,%
-  TIIS,%
-  TISSEC,%
-  TIST,%
-  TKDD,%
-  TMIS,%
-  TOCE,%
-  TOCHI,%
-  TOCL,%
-  TOCS,%
-  TOCT,%
-  TODAES,%
-  TODS,%
-  TOG,%
-  TOIS,%
-  TOIT,%
-  TOMACS,%
-  TOMM,%
-  TOMPECS,%
-  TOMS,%
-  TOPC,%
-  TOPS,%
-  TOPLAS,%
-  TOS,%
-  TOSEM,%
-  TOSN,%
-  TRETS,%
-  TSAS,%
-  TSC,%
-  TSLP,%
-  TWEB%
-}{%
-\ifcase\@journalCode@nr
-\relax % CIE
-  \def\@journalName{ACM Computers in Entertainment}%
-  \def\@journalNameShort{ACM Comput. Entertain.}%
-  \def\@permissionCodeOne{1544-3574}%
-\or % CSUR
-  \def\@journalName{ACM Computing Surveys}%
-  \def\@journalNameShort{ACM Comput. Surv.}%
-  \def\@permissionCodeOne{0360-0300}%
-\or % DTRAP
-  \def\@journalName{Digital Threats: Research and Practice}%
-  \def\@journalNameShort{Digit. Threat. Res. Pract.}%
-  \def\@permissionCodeOne{2576-5337}%
-\or % IMWUT
-  \def\@journalName{Proceedings of the ACM on Interactive, Mobile,
-    Wearable and Ubiquitous Technologies}%
-  \def\@journalNameShort{Proc. ACM Interact. Mob. Wearable Ubiquitous Technol.}%
-  \def\@permissionCodeOne{2474-9567}%
-  \@ACM@screentrue
-  \PackageInfo{\@classname}{Using screen mode due to \@journalCode}%
-\or % JACM
-  \def\@journalName{Journal of the ACM}%
-  \def\@journalNameShort{J. ACM}%
-  \def\@permissionCodeOne{0004-5411}%
-\or % JDIQ
-  \def\@journalName{ACM Journal of Data and Information Quality}%
-  \def\@journalNameShort{ACM J. Data Inform. Quality}%
-  \def\@permissionCodeOne{1936-1955}%
-\or % JEA
-  \def\@journalName{ACM Journal of Experimental Algorithmics}%
-  \def\@journalNameShort{ACM J. Exp. Algor.}%
-  \def\@permissionCodeOne{1084-6654}%
-\or % JERIC
-  \def\@journalName{ACM Journal of Educational Resources in Computing}%
-  \def\@journalNameShort{ACM J. Edu. Resources in Comput.}%
-  \def\@permissionCodeOne{1073-0516}%
-\or % JETC
-  \def\@journalName{ACM Journal on Emerging Technologies in Computing Systems}%
-  \def\@journalNameShort{ACM J. Emerg. Technol. Comput. Syst.}%
-  \def\@permissionCodeOne{1550-4832}%
-\or % JOCCH
-  \def\@journalName{ACM Journal on Computing and Cultural Heritage}%
-  \def\@journalNameShort{ACM J. Comput. Cult. Herit.}%
-\or % PACMHCI
-  \def\@journalName{Proceedings of the ACM on Human-Computer Interaction}%
-  \def\@journalNameShort{Proc. ACM Hum.-Comput. Interact.}%
-  \def\@permissionCodeOne{2573-0142}%
-  \@ACM@screentrue
-  \PackageInfo{\@classname}{Using screen mode due to \@journalCode}%
-\or % PACMPL
-  \def\@journalName{Proceedings of the ACM on Programming Languages}%
-  \def\@journalNameShort{Proc. ACM Program. Lang.}%
-  \def\@permissionCodeOne{2475-1421}%
-  \@ACM@screentrue
-  \PackageInfo{\@classname}{Using screen mode due to \@journalCode}%
-\or % POMACS
-  \def\@journalName{Proceedings of the ACM on Measurement and Analysis of Computing Systems}%
-  \def\@journalNameShort{Proc. ACM Meas. Anal. Comput. Syst.}%
-  \def\@permissionCodeOne{2476-1249}%
-  \@ACM@screentrue
-  \PackageInfo{\@classname}{Using screen mode due to \@journalCode}%
-\or % TAAS
-  \def\@journalName{ACM Transactions on Autonomous and Adaptive Systems}%
-  \def\@journalNameShort{ACM Trans. Autonom. Adapt. Syst.}%
-  \def\@permissionCodeOne{1556-4665}%
-\or % TACCESS
-  \def\@journalName{ACM Transactions on Accessible Computing}%
-  \def\@journalNameShort{ACM Trans. Access. Comput.}%
-  \def\@permissionCodeOne{1936-7228}%
-\or % TACO
-  \def\@journalName{ACM Transactions on Architecture and Code Optimization}%
-  \def\@journalNameShort{ACM Trans. Arch. Code Optim.}%
-\or % TALG
-  \def\@journalName{ACM Transactions on Algorithms}%
-  \def\@journalNameShort{ACM Trans. Algor.}%
-  \def\@permissionCodeOne{1549-6325}%
-\or % TALLIP
-  \def\@journalName{ACM Transactions on Asian and Low-Resource Language Information Processing}%
-  \def\@journalNameShort{ACM Trans. Asian Low-Resour. Lang. Inf. Process.}%
-  \def\@permissionCodeOne{2375-4699}%
-\or % TAP
-  \def\@journalName{ACM Transactions on Applied Perception}%
-\or % TCPS
-  \def\@journalName{ACM Transactions on Cyber-Physical Systems}%
-\or % TEAC
-  \def\@journalName{ACM Transactions on Economics and Computation}%
-\or % TECS
-  \def\@journalName{ACM Transactions on Embedded Computing Systems}%
-  \def\@journalNameShort{ACM Trans. Embedd. Comput. Syst.}%
-  \def\@permissionCodeOne{1539-9087}%
-\or % THRI
-  \def\@journalName{ACM Transactions on Human-Robot Interaction}%
-  \def\@journalNameShort{ACM Trans. Hum.-Robot Interact.}%
-  \def\@permissionCodeOne{2573-9522}%
-\or % TIIS
-  \def\@journalName{ACM Transactions on Interactive Intelligent Systems}%
-  \def\@journalNameShort{ACM Trans. Interact. Intell. Syst.}%
-  \def\@permissionCodeOne{2160-6455}%
-\or % TISSEC
-  \def\@journalName{ACM Transactions on Information and System Security}%
-  \def\@journalNameShort{ACM Trans. Info. Syst. Sec.}%
-  \def\@permissionCodeOne{1094-9224}%
-\or % TIST
-  \def\@journalName{ACM Transactions on Intelligent Systems and Technology}%
-  \def\@journalNameShort{ACM Trans. Intell. Syst. Technol.}%
-  \def\@permissionCodeOne{2157-6904}%
-\or % TKDD
-  \def\@journalName{ACM Transactions on Knowledge Discovery from Data}%
-  \def\@journalNameShort{ACM Trans. Knowl. Discov. Data.}%
-  \def\@permissionCodeOne{1556-4681}%
-\or % TMIS
-  \def\@journalName{ACM Transactions on Management Information Systems}%
-  \def\@journalNameShort{ACM Trans. Manag. Inform. Syst.}%
-  \def\@permissionCodeOne{2158-656X}%
-\or % TOCE
-  \def\@journalName{ACM Transactions on Computing Education}%
-  \def\@journalNameShort{ACM Trans. Comput. Educ.}%
-  \def\@permissionCodeOne{1946-6226}%
-\or % TOCHI
-  \def\@journalName{ACM Transactions on Computer-Human Interaction}%
-  \def\@journalNameShort{ACM Trans. Comput.-Hum. Interact.}%
-  \def\@permissionCodeOne{1073-0516}%
-\or % TOCL
-  \def\@journalName{ACM Transactions on Computational Logic}%
-  \def\@journalNameShort{ACM Trans. Comput. Logic}%
-  \def\@permissionCodeOne{1529-3785}%
-\or % TOCS
-  \def\@journalName{ACM Transactions on Computer Systems}%
-  \def\@journalNameShort{ACM Trans. Comput. Syst.}%
-  \def\@permissionCodeOne{0734-2071}%
-\or % TOCT
-  \def\@journalName{ACM Transactions on Computation Theory}%
-  \def\@journalNameShort{ACM Trans. Comput. Theory}%
-  \def\@permissionCodeOne{1942-3454}%
-\or % TODAES
-  \def\@journalName{ACM Transactions on Design Automation of Electronic Systems}%
-  \def\@journalNameShort{ACM Trans. Des. Autom. Electron. Syst.}%
-  \def\@permissionCodeOne{1084-4309}%
-\or % TODS
-  \def\@journalName{ACM Transactions on Database Systems}%
-  \def\@journalNameShort{ACM Trans. Datab. Syst.}%
-  \def\@permissionCodeOne{0362-5915}%
-\or % TOG
-  \def\@journalName{ACM Transactions on Graphics}%
-  \def\@journalNameShort{ACM Trans. Graph.}%
-  \def\@permissionCodeOne{0730-0301}
-\or % TOIS
-  \def\@journalName{ACM Transactions on Information Systems}%
-  \def\@permissionCodeOne{1046-8188}%
-\or % TOIT
-  \def\@journalName{ACM Transactions on Internet Technology}%
-  \def\@journalNameShort{ACM Trans. Internet Technol.}%
-  \def\@permissionCodeOne{1533-5399}%
-\or % TOMACS
-  \def\@journalName{ACM Transactions on Modeling and Computer Simulation}%
-  \def\@journalNameShort{ACM Trans. Model. Comput. Simul.}%
-\or % TOMM
-  \def\@journalName{ACM Transactions on Multimedia Computing, Communications and Applications}%
-  \def\@journalNameShort{ACM Trans. Multimedia Comput. Commun. Appl.}%
-  \def\@permissionCodeOne{1551-6857}%
-  \def\@permissionCodeTwo{0100}%
-\or % TOMPECS
-  \def\@journalName{ACM Transactions on Modeling and Performance Evaluation of Computing Systems}%
-  \def\@journalNameShort{ACM Trans. Model. Perform. Eval. Comput. Syst.}%
-  \def\@permissionCodeOne{2376-3639}%
-\or % TOMS
-  \def\@journalName{ACM Transactions on Mathematical Software}%
-  \def\@journalNameShort{ACM Trans. Math. Softw.}%
-  \def\@permissionCodeOne{0098-3500}%
-\or % TOPC
-  \def\@journalName{ACM Transactions on Parallel Computing}%
-  \def\@journalNameShort{ACM Trans. Parallel Comput.}%
-  \def\@permissionCodeOne{1539-9087}%
-\or % TOPS
-  \def\@journalName{ACM Transactions on Privacy and Security}%
-  \def\@journalNameShort{ACM Trans. Priv. Sec.}%
-  \def\@permissionCodeOne{2471-2566}%
-\or % TOPLAS
-  \def\@journalName{ACM Transactions on Programming Languages and Systems}%
-  \def\@journalNameShort{ACM Trans. Program. Lang. Syst.}%
-  \def\@permissionCodeOne{0164-0925}%
-\or % TOS
-  \def\@journalName{ACM Transactions on Storage}%
-  \def\@journalNameShort{ACM Trans. Storage}%
-  \def\@permissionCodeOne{1553-3077}%
-\or % TOSEM
-  \def\@journalName{ACM Transactions on Software Engineering and Methodology}%
-  \def\@journalNameShort{ACM Trans. Softw. Eng. Methodol.}%
-  \def\@permissionCodeOne{1049-331X}%
-\or % TOSN
-  \def\@journalName{ACM Transactions on Sensor Networks}%
-  \def\@journalNameShort{ACM Trans. Sensor Netw.}%
-  \def\@permissionCodeOne{1550-4859}%
-\or % TRETS
-  \def\@journalName{ACM Transactions on Reconfigurable Technology and Systems}%
-  \def\@journalNameShort{ACM Trans. Reconfig. Technol. Syst.}%
-  \def\@permissionCodeOne{1936-7406}%
-\or % TSAS
-  \def\@journalName{ACM Transactions on Spatial Algorithms and Systems}%
-  \def\@journalNameShort{ACM Trans. Spatial Algorithms Syst.}%
-  \def\@permissionCodeOne{2374-0353}%
-\or % TSC
-  \def\@journalName{ACM Transactions on Social Computing}%
-  \def\@journalNameShort{ACM Trans. Soc. Comput.}%
-  \def\@permissionCodeOne{2469-7818}%
-\or % TSLP
-  \def\@journalName{ACM Transactions on Speech and Language Processing}%
-  \def\@journalNameShort{ACM Trans. Speech Lang. Process.}%
-  \def\@permissionCodeOne{1550-4875}%
-\or % TWEB
-  \def\@journalName{ACM Transactions on the Web}%
-  \def\@journalNameShort{ACM Trans. Web}%
-  \def\@permissionCodeOne{1559-1131}%
-\fi
-\ClassInfo{\@classname}{Using journal code \@journalCode}%
-}{%
-  \ClassError{\@classname}{Incorrect journal #1}%
-}%
-\def\acmJournal#1{\setkeys{ACM}{acmJournal=#1}}
-\def\@journalCode@nr{0}
-\def\@journalName{}%
-\def\@journalNameShort{\@journalName}%
-\def\@permissionCodeOne{XXXX-XXXX}%
-\def\@permissionCodeTwo{}%
-\newcommand\acmConference[4][]{%
-  \gdef\acmConference@shortname{#1}%
-  \gdef\acmConference@name{#2}%
-  \gdef\acmConference@date{#3}%
-  \gdef\acmConference@venue{#4}%
-  \ifx\acmConference@shortname\@empty
-    \gdef\acmConference@shortname{#2}%
-  \fi}
-\acmConference[Conference'17]{ACM Conference}{July 2017}{Washington,
-  DC, USA}
-\def\acmBooktitle#1{\gdef\@acmBooktitle{#1}}
-\acmBooktitle{Proceedings of \acmConference@name
-       \ifx\acmConference@name\acmConference@shortname\else
-         \ (\acmConference@shortname)\fi}
-\def\@editorsAbbrev{(Ed.)}
-\def\@acmEditors{}
-\def\editor#1{\ifx\@acmEditors\@empty
-    \gdef\@acmEditors{#1}%
-  \else
-    \gdef\@editorsAbbrev{(Eds.)}%
-    \g@addto@macro\@acmEditors{\and#1}%
-\fi}
-\def\subtitle#1{\def\@subtitle{#1}}
-\subtitle{}
-\newcount\num@authorgroups
-\num@authorgroups=0\relax
-\newcount\num@authors
-\num@authors=0\relax
-\newif\if@insideauthorgroup
-\@insideauthorgroupfalse
-\renewcommand\author[2][]{%
-  \global\advance\num@authors by 1\relax
-  \if@insideauthorgroup\else
-    \global\advance\num@authorgroups by 1\relax
-    \global\@insideauthorgrouptrue
-  \fi
-  \ifx\addresses\@empty
-    \if@ACM@anonymous
-      \gdef\addresses{\@author{Anonymous Author(s)}}%
-      \gdef\authors{Anonymous Author(s)}%
-    \else
-      \gdef\addresses{\@author{#2}}%
-      \gdef\authors{#2}%
-    \fi
-  \else
-    \if@ACM@anonymous\else
-      \g@addto@macro\addresses{\and\@author{#2}}%
-      \g@addto@macro\authors{\and#2}%
-    \fi
-  \fi
-  \if@ACM@anonymous
-    \ifx\shortauthors\@empty
-      \gdef\shortauthors{Anon.}%
-    \fi
-  \else
-    \def\@tempa{#1}%
-    \ifx\@tempa\@empty
-      \ifx\shortauthors\@empty
-        \gdef\shortauthors{#2}%
-      \else
-        \g@addto@macro\shortauthors{\and#2}%
-      \fi
-    \else
-      \ifx\shortauthors\@empty
-        \gdef\shortauthors{#1}%
-      \else
-        \g@addto@macro\shortauthors{\and#1}%
-      \fi
-    \fi
-  \fi}
-\newcommand{\affiliation}[2][]{%
-  \global\@insideauthorgroupfalse
-  \if@ACM@anonymous\else
-    \g@addto@macro\addresses{\affiliation{#1}{#2}}%
-  \fi}
-\define@boolkey+{@ACM@affiliation@}[@ACM@affiliation@]{obeypunctuation}%
-[true]{}{\ClassError{\@classname}{The option obeypunctuation can be either true or false}}
-\def\additionalaffiliation#1{\authornote{\@additionalaffiliation{#1}}}
-\def\@additionalaffiliation#1{\bgroup
-  \def\position##1{\ignorespaces}%
-  \def\institution##1{##1\ignorespaces}%
-  \def\department{\@ifnextchar[{\@department}{\@department[]}}%
-  \def\@department[##1]##2{\unskip, ##2\ignorespaces}%
-  \let\streetaddress\position
-  \let\city\position
-  \let\state\position
-  \let\postcode\position
-  \let\country\position
-  Also with #1\unskip.\egroup}
-\renewcommand{\email}[2][]{%
-  \if@ACM@anonymous\else
-    \g@addto@macro\addresses{\email{#1}{#2}}%
-  \fi}
-\def\orcid#1{\unskip\ignorespaces}
-\def\authorsaddresses#1{\def\@authorsaddresses{#1}}
-\authorsaddresses{\@mkauthorsaddresses}
-\def\@titlenotes{}
-\def\titlenote#1{%
-  \g@addto@macro\@title{\footnotemark}%
-  \if@ACM@anonymous
-    \g@addto@macro\@titlenotes{%
-      \stepcounter{footnote}\footnotetext{Title note}}%
-  \else
-    \g@addto@macro\@titlenotes{\stepcounter{footnote}\footnotetext{#1}}%
-  \fi}
-\def\@subtitlenotes{}
-\def\subtitlenote#1{%
-  \g@addto@macro\@subtitle{\footnotemark}%
-  \if@ACM@anonymous
-    \g@addto@macro\@subtitlenotes{%
-      \stepcounter{footnote}\footnotetext{Subtitle note}}%
-  \else
-    \g@addto@macro\@subtitlenotes{%
-      \stepcounter{footnote}\footnotetext{#1}}%
-  \fi}
-\def\@authornotes{}
-\def\authornote#1{%
-  \if@ACM@anonymous\else
-    \g@addto@macro\addresses{\@authornotemark}%
-    \g@addto@macro\@authornotes{%
-      \stepcounter{footnote}\footnotetext{#1}}%
-  \fi}
-\newcommand\authornotemark[1][\relax]{%
-  \ifx#1\relax\relax\relax
-  \g@addto@macro\addresses{\@authornotemark}%
-  \else
-  \g@addto@macro\addresses{\@@authornotemark{#1}}%
-  \fi}
-\def\acmVolume#1{\def\@acmVolume{#1}}
-\acmVolume{1}
-\def\acmNumber#1{\def\@acmNumber{#1}}
-\acmNumber{1}
-\def\acmArticle#1{\def\@acmArticle{#1}}
-\acmArticle{}
-\def\acmArticleSeq#1{\def\@acmArticleSeq{#1}}
-\acmArticleSeq{\@acmArticle}
-\def\acmYear#1{\def\@acmYear{#1}}
-\acmYear{\the\year}
-\def\acmMonth#1{\def\@acmMonth{#1}}
-\acmMonth{\the\month}
-\def\@acmPubDate{\ifcase\@acmMonth\or
-  January\or February\or March\or April\or May\or June\or
-  July\or August\or September\or October\or November\or
-  December\fi~\@acmYear}
-\def\acmPrice#1{\def\@acmPrice{#1}}
-\acmPrice{15.00}
-\def\acmSubmissionID#1{\def\@acmSubmissionID{#1}}
-\acmSubmissionID{}
-\def\acmISBN#1{\def\@acmISBN{#1}}
-\acmISBN{978-x-xxxx-xxxx-x/YY/MM}
-\def\acmDOI#1{\def\@acmDOI{#1}}
-\acmDOI{10.1145/nnnnnnn.nnnnnnn}
-\newif\if@ACM@badge
-\@ACM@badgefalse
-\newlength\@ACM@badge@width
-\setlength\@ACM@badge@width{5pc}
-\newlength\@ACM@title@width
-\newlength\@ACM@badge@skip
-\setlength\@ACM@badge@skip{1pc}
-\newcommand\acmBadgeR[2][]{\@ACM@badgetrue
-  \def\@acmBadgeR@url{#1}%
-  \def\@acmBadgeR@image{#2}}
-\def\@acmBadgeR@url{}
-\def\@acmBadgeR@image{}
-\newcommand\acmBadgeL[2][]{\@ACM@badgetrue
-  \def\@acmBadgeL@url{#1}%
-  \def\@acmBadgeL@image{#2}}
-\def\@acmBadgeL@url{}
-\def\@acmBadgeL@image{}
-\def\startPage#1{\def\@startPage{#1}}
-\startPage{}
-\def\terms#1{\ClassWarning{\@classname}{The command \string\terms{} is
-    obsolete.  I am going to ignore it}}
-\def\keywords#1{\def\@keywords{#1}}
-\keywords{}
-\renewenvironment{abstract}{\Collect@Body\@saveabstract}{}
-\long\def\@saveabstract#1{\long\gdef\@abstract{#1}}
-\@saveabstract{}
-\long\def\@lempty{}
-\define@boolkey+{@ACM@topmatter@}[@ACM@]{printccs}[true]{%
-  \if@ACM@printccs
-    \ClassInfo{\@classname}{Printing CCS}%
-  \else
-    \ClassInfo{\@classname}{Suppressing CCS}%
-  \fi}{\ClassError{\@classname}{The option printccs can be either true or false}}
-\define@boolkey+{@ACM@topmatter@}[@ACM@]{printacmref}[true]{%
-  \if@ACM@printacmref
-    \ClassInfo{\@classname}{Printing bibformat}%
-  \else
-    \ClassInfo{\@classname}{Suppressing bibformat}%
-  \fi}{\ClassError{\@classname}{The option printacmref can be either true or false}}
-\define@boolkey+{@ACM@topmatter@}[@ACM@]{printfolios}[true]{%
-  \if@ACM@printfolios
-    \ClassInfo{\@classname}{Printing folios}%
-  \else
-    \ClassInfo{\@classname}{Suppressing folios}%
-  \fi}{\ClassError{\@classname}{The option printfolios can be either true or false}}
-\define@cmdkey{@ACM@topmatter@}[@ACM@]{authorsperrow}[0]{%
-  \IfInteger{#1}{\ClassInfo{\@classname}{Setting authorsperrow to
-      #1}}{\ClassWarning{\@classname}{The parameter authorsperrow must be
-      numerical. Ignoring the input #1}\gdef\@ACM@authorsperrow{0}}}
-\def\settopmatter#1{\setkeys{@ACM@topmatter@}{#1}}
-\settopmatter{printccs=true, printacmref=true}
-\if@ACM@manuscript
-  \settopmatter{printfolios=true}
-\else
-  \if@ACM@journal
-    \settopmatter{printfolios=true}
-  \else
-    \settopmatter{printfolios=false}
-  \fi
-\fi
-\settopmatter{authorsperrow=0}
-\def\@received{}
-\newcommand\received[2][]{\def\@tempa{#1}%
-  \ifx\@tempa\@empty
-    \ifx\@received\@empty
-      \gdef\@received{Received #2}%
-    \else
-      \g@addto@macro{\@received}{; revised #2}%
-    \fi
-  \else
-    \ifx\@received\@empty
-      \gdef\@received{#1 #2}%
-    \else
-      \g@addto@macro{\@received}{; #1 #2}%
-    \fi
-  \fi}
-\AtEndDocument{%
-  \ifx\@received\@empty\else
-    \par\bigskip\noindent\small\normalfont\@received\par
-  \fi}
-\RequirePackage{comment}
-\excludecomment{CCSXML}
-\let\@concepts\@empty
-\newcommand\ccsdesc[2][100]{%
-  \ccsdesc@parse#1~#2~~\ccsdesc@parse@end}
-\RequirePackage{textcomp}
-\def\ccsdesc@parse#1~#2~#3~{%
-  \expandafter\ifx\csname CCS@General@#2\endcsname\relax
-    \expandafter\gdef\csname CCS@General@#2\endcsname{\textbullet\
-      \textbf{#2}}%
-    \expandafter\gdef\csname CCS@Punctuation@#2\endcsname{; }%
-    \expandafter\gdef\csname CCS@Specific@#2\endcsname{}%
-  \g@addto@macro{\@concepts}{\csname CCS@General@#2\endcsname
-    \csname CCS@Punctuation@#2\endcsname
-    \csname CCS@Specific@#2\endcsname}%
-  \fi
-  \ifx#3\relax\relax\else
-    \expandafter\gdef\csname CCS@Punctuation@#2\endcsname{
-      \textrightarrow\ }%
-    \expandafter\g@addto@macro\expandafter{\csname CCS@Specific@#2\endcsname}{%
-     \ifnum#1>499\textbf{#3}; \else
-     \ifnum#1>299\textit{#3}; \else
-     #3; \fi\fi}%
-  \fi
-\ccsdesc@parse@finish}
-\def\ccsdesc@parse@finish#1\ccsdesc@parse@end{}
-\newif\if@printcopyright
-\@printcopyrighttrue
-\newif\if@printpermission
-\@printpermissiontrue
-\newif\if@acmowned
-\@acmownedtrue
-\define@choicekey*{ACM@}{acmcopyrightmode}[%
-  \acm@copyrightinput\acm@copyrightmode]{none,%
-    acmcopyright,acmlicensed,rightsretained,%
-    usgov,usgovmixed,cagov,cagovmixed,licensedusgovmixed,%
-    licensedcagov,licensedcagovmixed,othergov,licensedothergov,%
-    iw3c2w3,iw3c2w3g}{%
-  \@printpermissiontrue
-  \@printcopyrighttrue
-  \@acmownedtrue
-  \ifnum\acm@copyrightmode=0\relax % none
-   \@printpermissionfalse
-   \@printcopyrightfalse
-   \@acmownedfalse
-  \fi
-  \ifnum\acm@copyrightmode=2\relax % acmlicensed
-   \@acmownedfalse
-  \fi
-  \ifnum\acm@copyrightmode=3\relax % rightsretained
-   \@acmownedfalse
-   \acmPrice{}%
-  \fi
-  \ifnum\acm@copyrightmode=4\relax % usgov
-   \@printpermissiontrue
-   \@printcopyrightfalse
-   \@acmownedfalse
-   \acmPrice{}%
-  \fi
-  \ifnum\acm@copyrightmode=6\relax % cagov
-   \@acmownedfalse
-  \fi
-  \ifnum\acm@copyrightmode=8\relax % licensedusgovmixed
-   \@acmownedfalse
-  \fi
-  \ifnum\acm@copyrightmode=9\relax % licensedcagov
-   \@acmownedfalse
-  \fi
-  \ifnum\acm@copyrightmode=10\relax % licensedcagovmixed
-   \@acmownedfalse
-  \fi
-  \ifnum\acm@copyrightmode=11\relax % othergov
-   \@acmownedtrue
-  \fi
-  \ifnum\acm@copyrightmode=12\relax % licensedothergov
-   \@acmownedfalse
-  \fi
-  \ifnum\acm@copyrightmode=13\relax % iw3c2w3
-   \@acmownedfalse
-  \fi
-  \ifnum\acm@copyrightmode=14\relax % iw3c2w3g
-   \@acmownedfalse
-  \fi}
-\def\setcopyright#1{\setkeys{ACM@}{acmcopyrightmode=#1}}
-\setcopyright{acmcopyright}
-\def\@copyrightowner{%
-  \ifcase\acm@copyrightmode\relax % none
-  \or % acmcopyright
-  Association for Computing Machinery.
-  \or % acmlicensed
-  Copyright held by the owner/author(s). Publication rights licensed to
-  the Association for Computing Machinery.
-  \or % rightsretained
-  Copyright held by the owner/author(s).
-  \or % usgov
-  \or % usgovmixed
-  Association for Computing Machinery.
-  \or % cagov
-  Crown in Right of Canada.
-  \or %cagovmixed
-  Association for Computing Machinery.
-  \or %licensedusgovmixed
-  Copyright held by the owner/author(s). Publication rights licensed to
-  the Association for Computing Machinery.
-  \or % licensedcagov
-  Crown in Right of Canada. Publication rights licensed to
-  the Association for Computing Machinery.
-  \or %licensedcagovmixed
-  Copyright held by the owner/author(s). Publication rights licensed to
-  the Association for Computing Machinery.
-  \or % othergov
-  Association for Computing Machinery.
-  \or % licensedothergov
-  Copyright held by the owner/author(s). Publication rights licensed to
-  the Association for Computing Machinery.
-  \or % ic2w3www
-  IW3C2 (International World Wide Web Conference Committee), published
-  under Creative Commons CC~BY~4.0 License.
-  \or % ic2w3wwwgoogle
-  IW3C2 (International World Wide Web Conference Committee), published
-  under Creative Commons CC~BY-NC-ND~4.0 License.
-  \fi}
-\def\@formatdoi#1{\url{https://doi.org/#1}}
-\def\@copyrightpermission{%
-  \ifcase\acm@copyrightmode\relax % none
-  \or % acmcopyright
-   Permission to make digital or hard copies of all or part of this
-   work for personal or classroom use is granted without fee provided
-   that copies are not made or distributed for profit or commercial
-   advantage and that copies bear this notice and the full citation on
-   the first page. Copyrights for components of this work owned by
-   others than ACM must be honored. Abstracting with credit is
-   permitted. To copy otherwise, or republish, to post on servers or to
-   redistribute to lists, requires prior specific permission
-   and\hspace*{.5pt}/or  a fee. Request permissions from
-   permissions@acm.org.
-  \or % acmlicensed
-   Permission to make digital or hard copies of all or part of this
-   work for personal or classroom use is granted without fee provided
-   that copies are not made or distributed for profit or commercial
-   advantage and that copies bear this notice and the full citation on
-   the first page. Copyrights for components of this work owned by
-   others than the author(s) must be honored. Abstracting with credit
-   is permitted.  To copy otherwise, or republish, to post on servers
-   or to  redistribute to lists, requires prior specific permission
-   and\hspace*{.5pt}/or  a fee. Request permissions from
-   permissions@acm.org.
-  \or % rightsretained
-   Permission to make digital or hard copies of part or all of this work
-   for personal or classroom use is granted without fee provided that
-   copies are not made or distributed for profit or commercial advantage
-   and that copies bear this notice and the full citation on the first
-   page. Copyrights for third-party components of this work must be
-   honored. For all other uses, contact the
-   owner\hspace*{.5pt}/author(s).
-  \or % usgov
-   This paper is authored by an employee(s) of the United States
-   Government and is in the public domain. Non-exclusive copying or
-   redistribution is allowed, provided that the article citation is
-   given and the authors and agency are clearly identified as its
-   source.
-  \or % usgovmixed
-   ACM acknowledges that this contribution was authored or co-authored
-   by an employee, contractor, or affiliate of the United States government. As such,
-   the United States government retains a nonexclusive, royalty-free right to
-   publish or reproduce this article, or to allow others to do so, for
-   government purposes only.
-  \or % cagov
-   This article was authored by employees of the Government of Canada.
-   As such, the Canadian government retains all interest in the
-   copyright to this work and grants to ACM a nonexclusive,
-   royalty-free right to publish or reproduce this article, or to allow
-   others to do so, provided that clear attribution is given both to
-   the authors and the Canadian government agency employing them.
-   Permission to make digital or hard copies for personal or classroom
-   use is granted. Copies must bear this notice and the full citation
-   on the first page.  Copyrights for components of this work owned by
-   others than the Canadian Government must be honored. To copy
-   otherwise, distribute, republish, or post, requires prior specific
-   permission and\hspace*{.5pt}/or a fee. Request permissions from
-   permissions@acm.org.
-  \or % cagovmixed
-   ACM acknowledges that this contribution was co-authored by an
-   affiliate of the national government of Canada. As such, the Crown
-   in Right of Canada retains an equal interest in the copyright.
-   Reprints must include clear attribution to ACM and the author's
-   government agency affiliation.  Permission to make digital or hard
-   copies for personal or classroom use is granted.  Copies must bear
-   this notice and the full citation on the first page. Copyrights for
-   components of this work owned by others than ACM must be honored.
-   To copy otherwise, distribute, republish, or post, requires prior
-   specific permission and\hspace*{.5pt}/or a fee. Request permissions
-   from permissions@acm.org.
-  \or % licensedusgovmixed
-   Publication rights licensed to ACM\@. ACM acknowledges that this
-   contribution was authored or co-authored by an employee, contractor
-   or affiliate of the United States government. As such, the
-   Government retains a nonexclusive, royalty-free right to publish or
-   reproduce this article, or to allow others to do so, for Government
-   purposes only.
-  \or % licensedcagov
-   This article was authored by employees of the Government of Canada.
-   As such, the Canadian government retains all interest in the
-   copyright to this work and grants to ACM a nonexclusive,
-   royalty-free right to publish or reproduce this article, or to allow
-   others to do so, provided that clear attribution is given both to
-   the authors and the Canadian government agency employing them.
-   Permission to make digital or hard copies for personal or classroom
-   use is granted. Copies must bear this notice and the full citation
-   on the first page.  Copyrights for components of this work owned by
-   others than the Canadian Government must be honored. To copy
-   otherwise, distribute, republish, or post, requires prior specific
-   permission and\hspace*{.5pt}/or a fee. Request permissions from
-   permissions@acm.org.
-  \or % licensedcagovmixed
-   Publication rights licensed to ACM\@. ACM acknowledges that this
-   contribution was authored or co-authored by an employee, contractor
-   or affiliate of the national government of Canada. As such, the
-   Government retains a nonexclusive, royalty-free right to publish or
-   reproduce this article, or to allow others to do so, for Government
-   purposes only.
-  \or % othergov
-   ACM acknowledges that this contribution was authored or co-authored
-   by an employee, contractor or affiliate of a national government. As
-   such, the Government retains a nonexclusive, royalty-free right to
-   publish or reproduce this article, or to allow others to do so, for
-   Government purposes only.
-  \or % licensedothergov
-   Publication rights licensed to ACM\@. ACM acknowledges that this
-   contribution was authored or co-authored by an employee, contractor
-   or affiliate of a national government. As such, the Government
-   retains a nonexclusive, royalty-free right to publish or reproduce
-   this article, or to allow others to do so, for Government purposes
-   only.
- \or % iw3c2w3
-   This paper is published under the Creative Commons Attribution~4.0
-   International (CC~BY~4.0) license. Authors reserve their rights to
-   disseminate the work on their personal and corporate Web sites with
-   the appropriate attribution.
- \or % iw3c2w3g
-   This paper is published under the Creative Commons
-   Attribution-NonCommercial-NoDerivs~4.0 International
-   (CC~BY-NC-ND~4.0) license. Authors reserve their rights to
-   disseminate the work on their personal and corporate Web sites with
-   the appropriate attribution.
- \fi}
-\def\copyrightyear#1{\def\@copyrightyear{#1}}
-\copyrightyear{\@acmYear}
-\def\@teaserfigures{}
-\newenvironment{teaserfigure}{\Collect@Body\@saveteaser}{}
-\long\def\@saveteaser#1{\g@addto@macro\@teaserfigures{\@teaser{#1}}}
-\renewcommand{\thanks}[1]{%
-  \@ifnotempty{#1}{%
-    \if@ACM@anonymous
-      \g@addto@macro\thankses{\thanks{A note}}%
-   \else
-    \g@addto@macro\thankses{\thanks{#1}}%
-   \fi}}
-\newbox\mktitle@bx
-\def\maketitle{%
-  \if@ACM@anonymous
-    % Anonymize omission of \author-s
-    \ifnum\num@authorgroups=0\author{}\fi
-  \fi
-  \begingroup
-  \let\@footnotemark\@footnotemark@nolink
-  \let\@footnotetext\@footnotetext@nolink
-  \renewcommand\thefootnote{\@fnsymbol\c@footnote}%
-  \global\@topnum\z@ % this prevents floats from falling
-                     % at the top of page 1
-  \global\@botnum\z@ % we do not want them to be on the bottom either
-  \hsize=\textwidth
-  \def\@makefnmark{\hbox{\@textsuperscript{\@thefnmark}}}%
-  \@mktitle\if@ACM@sigchiamode\else\@mkauthors\fi\@mkteasers
-  \@printtopmatter
-  \if@ACM@sigchiamode\@mkauthors\fi
-  \setcounter{footnote}{0}%
-  \def\@makefnmark{\hbox{\@textsuperscript{\normalfont\@thefnmark}}}%
-  \@titlenotes
-  \@subtitlenotes
-  \@authornotes
-  \let\@makefnmark\relax
-  \let\@thefnmark\relax
-  \let\@makefntext\noindent
-  \ifx\@empty\thankses\else
-    \footnotetextauthorsaddresses{%
-      \def\par{\let\par\@par}\parindent\z@\@setthanks}%
-  \fi
-  \ifx\@empty\@authorsaddresses\else
-     \if@ACM@anonymous\else
-       \if@ACM@journal
-         \footnotetextauthorsaddresses{%
-           \def\par{\let\par\@par}\parindent\z@\@setauthorsaddresses}%
-       \fi
-     \fi
-  \fi
-  \footnotetextcopyrightpermission{%
-    \if@ACM@authordraft
-        \raisebox{-2ex}[\z@][\z@]{\makebox[0pt][l]{\large\bfseries
-            Unpublished working draft. Not for distribution.}}%
-       \color[gray]{0.9}%
-    \fi
-    \parindent\z@\parskip0.1\baselineskip
-    \if@ACM@authorversion\else
-      \if@printpermission\@copyrightpermission\par\fi
-    \fi
-    \if@ACM@manuscript\else
-       \if@ACM@journal\else % Print the conference information
-         {\itshape \acmConference@shortname, \acmConference@date, \acmConference@venue}\par
-       \fi
-    \fi
-    \if@printcopyright
-      \copyright\ \@copyrightyear\ \@copyrightowner\\
-    \else
-     \@copyrightyear.\
-    \fi
-    \if@ACM@manuscript
-      Manuscript submitted to ACM\\
-    \else
-      \if@ACM@authorversion
-          This is the author's version of the work. It is posted here for
-          your personal use. Not for redistribution. The definitive Version
-          of Record was published in
-          \if@ACM@journal
-            \emph{\@journalName}%
-          \else
-            \emph{\@acmBooktitle}%
-          \fi
-          \ifx\@acmDOI\@empty
-          .
-          \else
-            , \@formatdoi{\@acmDOI}.
-          \fi\\
-        \else
-          \if@ACM@journal
-            \@permissionCodeOne/\@acmYear/\@acmMonth-ART\@acmArticle
-            \ifx\@acmPrice\@empty\else\ \$\@acmPrice\fi\\
-            \@formatdoi{\@acmDOI}%
-          \else % Conference
-            \ifx\@acmISBN\@empty\else ACM~ISBN~\@acmISBN
-            \ifx\@acmPrice\@empty.\else\dots\$\@acmPrice\fi\\\fi
-            \ifx\@acmDOI\@empty\else\@formatdoi{\@acmDOI}\fi%
-          \fi
-        \fi
-      \fi}
-  \endgroup
-  \setcounter{footnote}{0}%
-  \@mkabstract
-  \if@ACM@printccs
-    \ifx\@concepts\@empty\else\bgroup
-      {\@specialsection{CCS Concepts}%
-         \@concepts\par}\egroup
-     \fi
-   \fi
-   \ifx\@keywords\@empty\else\bgroup
-      {\if@ACM@journal
-         \@specialsection{Additional Key Words and Phrases}%
-       \else
-         \@specialsection{Keywords}%
-       \fi
-         \@keywords}\par\egroup
-   \fi
-  \andify\authors
-  \andify\shortauthors
-  \global\let\authors=\authors
-  \global\let\shortauthors=\shortauthors
-  \if@ACM@printacmref
-     \@mkbibcitation
-  \fi
-  \hypersetup{%
-    pdflang={English},
-    pdfdisplaydoctitle,
-    pdfauthor={\authors},
-    pdftitle={\@title},
-    pdfsubject={\@concepts},
-    pdfkeywords={\@keywords},
-    pdfcreator={LaTeX with acmart
-      \csname ver@acmart.cls\endcsname\space
-      and hyperref
-      \csname ver@hyperref.sty\endcsname}}%
-  \@printendtopmatter
-  \@afterindentfalse
-  \@afterheading
-}
-\def\@specialsection#1{%
-  \ifcase\ACM@format@nr
-  \relax % manuscript
-    \par\medskip\small\noindent#1: %
-  \or % acmsmall
-    \par\medskip\small\noindent#1: %
-  \or % acmlarge
-    \par\medskip\small\noindent#1: %
-  \or % acmtog
-    \par\medskip\small\noindent#1: %
-  \or % sigconf
-    \section*{#1}%
-  \or % siggraph
-    \section*{#1}%
-  \or % sigplan
-    \paragraph*{#1}%
-  \or % sigchi
-    \section*{#1}%
-  \or % sigchi-a
-    \section*{#1}%
-  \fi}
-\def\@printtopmatter{%
-  \ifx\@startPage\@empty
-     \gdef\@startPage{1}%
-  \else
-     \setcounter{page}{\@startPage}%
-  \fi
-  \thispagestyle{firstpagestyle}%
-  \noindent
-  \ifcase\ACM@format@nr
-  \relax % manuscript
-    \box\mktitle@bx\par
-  \or % acmsmall
-    \box\mktitle@bx\par
-  \or % acmlarge
-    \box\mktitle@bx\par
-  \or % acmtog
-    \twocolumn[\box\mktitle@bx]%
-  \or % sigconf
-    \twocolumn[\box\mktitle@bx]%
-  \or % siggraph
-    \twocolumn[\box\mktitle@bx]%
-  \or % sigplan
-    \twocolumn[\box\mktitle@bx]%
-  \or % sigchi
-    \twocolumn[\box\mktitle@bx]%
-  \or % sigchi-a
-    \par\box\mktitle@bx\par\bigskip
-    \if@ACM@badge
-       \marginpar{\noindent
-         \ifx\@acmBadgeL@image\@empty\else
-           \href{\@acmBadgeL@url}{%
-             \includegraphics[width=\@ACM@badge@width]{\@acmBadgeL@image}}%
-            \hskip\@ACM@badge@skip
-          \fi
-         \ifx\@acmBadgeR@image\@empty\else
-           \href{\@acmBadgeR@url}{%
-             \includegraphics[width=\@ACM@badge@width]{\@acmBadgeR@image}}%
-          \fi}%
-    \fi
-  \fi
-}
-\def\@mktitle{%
-  \ifcase\ACM@format@nr
-  \relax % manuscript
-    \@mktitle@i
-  \or % acmsmall
-    \@mktitle@i
-  \or % acmlarge
-    \@mktitle@i
-  \or % acmtog
-    \@mktitle@i
-  \or % sigconf
-    \@mktitle@iii
-  \or % siggraph
-    \@mktitle@iii
-  \or % sigplan
-    \@mktitle@iii
-  \or % sigchi
-    \@mktitle@iii
-  \or % sigchi-a
-    \@mktitle@iv
-  \fi
-}
-\def\@titlefont{%
-  \ifcase\ACM@format@nr
-  \relax % manuscript
-    \LARGE\sffamily\bfseries
-  \or % acmsmall
-    \LARGE\sffamily\bfseries
-  \or % acmlarge
-    \LARGE\sffamily\bfseries
-  \or % acmtog
-    \Huge\sffamily
-  \or % sigconf
-    \Huge\sffamily\bfseries
-  \or % siggraph
-    \Huge\sffamily\bfseries
-  \or % sigplan
-    \Huge\bfseries
-  \or % sigchi
-    \Huge\sffamily\bfseries
-  \or % sigchi-a
-     \Huge\bfseries
-  \fi}
-\def\@subtitlefont{\normalsize
-  \ifcase\ACM@format@nr
-  \relax % manuscript
-    \mdseries
-  \or % acmsmall
-    \mdseries
-  \or % acmlarge
-    \mdseries
-  \or % acmtog
-     \LARGE
-  \or % sigconf
-     \LARGE\mdseries
-  \or % siggraph
-     \LARGE\mdseries
-  \or % sigplan
-     \LARGE\mdseries
-  \or % sigchi
-     \LARGE\mdseries
-  \or % sigchi-a
-     \mdseries
-  \fi}
-\def\@mktitle@i{\hsize=\textwidth
-  \@ACM@title@width=\hsize
-  \ifx\@acmBadgeL@image\@empty\else
-    \advance\@ACM@title@width by -\@ACM@badge@width
-    \advance\@ACM@title@width by -\@ACM@badge@skip
-  \fi
-  \ifx\@acmBadgeR@image\@empty\else
-    \advance\@ACM@title@width by -\@ACM@badge@width
-    \advance\@ACM@title@width by -\@ACM@badge@skip
-  \fi
-  \setbox\mktitle@bx=\vbox{\noindent\@titlefont
-    \ifx\@acmBadgeL@image\@empty\else
-      \raisebox{-.5\baselineskip}[\z@][\z@]{\href{\@acmBadgeL@url}{%
-          \includegraphics[width=\@ACM@badge@width]{\@acmBadgeL@image}}}%
-      \hskip\@ACM@badge@skip
-    \fi
-    \parbox[t]{\@ACM@title@width}{\raggedright
-      \@titlefont\noindent
-      \@title
-  \ifx\@subtitle\@empty\else
-    \par\noindent{\@subtitlefont\@subtitle}
-  \fi}%
-  \ifx\@acmBadgeR@image\@empty\else
-    \hskip\@ACM@badge@skip
-    \raisebox{-.5\baselineskip}[\z@][\z@]{\href{\@acmBadgeR@url}{%
-        \includegraphics[width=\@ACM@badge@width]{\@acmBadgeR@image}}}%
-  \fi
-  \par\bigskip}}%
-\def\@mktitle@iii{\hsize=\textwidth
-    \setbox\mktitle@bx=\vbox{\@titlefont\centering
-      \@ACM@title@width=\hsize
-      \if@ACM@badge
-        \advance\@ACM@title@width by -2\@ACM@badge@width
-        \advance\@ACM@title@width by -2\@ACM@badge@skip
-        \parbox[b]{\@ACM@badge@width}{\strut
-          \ifx\@acmBadgeL@image\@empty\else
-            \raisebox{-.5\baselineskip}[\z@][\z@]{\href{\@acmBadgeL@url}{%
-                \includegraphics[width=\@ACM@badge@width]{\@acmBadgeL@image}}}%
-          \fi}%
-        \hskip\@ACM@badge@skip
-      \fi
-      \parbox[t]{\@ACM@title@width}{\centering\@titlefont
-        \@title
-        \ifx\@subtitle\@empty\else
-          \par\noindent{\@subtitlefont\@subtitle}
-        \fi
-      }%
-      \if@ACM@badge
-        \hskip\@ACM@badge@skip
-        \parbox[b]{\@ACM@badge@width}{\strut
-          \ifx\@acmBadgeR@image\@empty\else
-            \raisebox{-.5\baselineskip}[\z@][\z@]{\href{\@acmBadgeR@url}{%
-                \includegraphics[width=\@ACM@badge@width]{\@acmBadgeR@image}}}%
-          \fi}%
-      \fi
-      \par\bigskip}}%
-\def\@mktitle@iv{\hsize=\textwidth
-    \setbox\mktitle@bx=\vbox{\raggedright\leftskip5pc\@titlefont
-      \noindent\leavevmode\leaders\hrule height 2pt\hfill\kern0pt\par
-      \noindent\@title
-     \ifx\@subtitle\@empty\else
-       \par\noindent\@subtitlefont\@subtitle
-     \fi
-     \par\bigskip}}%
-\newbox\@ACM@commabox
-\def\@ACM@addtoaddress#1{%
-  \ifvmode\else
-    \if@ACM@affiliation@obeypunctuation\else
-    \setbox\@ACM@commabox=\hbox{, }%
-    \unskip\cleaders\copy\@ACM@commabox\hskip\wd\@ACM@commabox
-  \fi\fi
-  #1}
-\def\streetaddress#1{\unskip\ignorespaces}
-\def\postcode#1{\unskip\ignorespaces}
-\if@ACM@journal
-  \def\position#1{\unskip\ignorespaces}
-  \def\institution#1{\unskip~#1\ignorespaces}
-  \def\city#1{\unskip\ignorespaces}
-  \def\state#1{\unskip\ignorespaces}
-  \newcommand\department[2][0]{\unskip\ignorespaces}
-  \def\country#1{\if@ACM@affiliation@obeypunctuation\else, \fi#1\ignorespaces}
-\else
-  \def\position#1{\if@ACM@affiliation@obeypunctuation#1\else#1\par\fi}%
-  \def\institution#1{\if@ACM@affiliation@obeypunctuation#1\else#1\par\fi}%
-  \newcommand\department[2][0]{\if@ACM@affiliation@obeypunctuation
-    #2\else#2\par\fi}%
-  \let\city\@ACM@addtoaddress
-  \let\state\@ACM@addtoaddress
-  \let\country\@ACM@addtoaddress
-\fi
-\def\@mkauthors{\begingroup
-  \hsize=\textwidth
-  \ifcase\ACM@format@nr
-  \relax % manuscript
-    \@mkauthors@i
-  \or % acmsmall
-    \@mkauthors@i
-  \or % acmlarge
-    \@mkauthors@i
-  \or % acmtog
-    \@mkauthors@i
-  \or % sigconf
-    \@mkauthors@iii
-  \or % siggraph
-    \@mkauthors@iii
-  \or % sigplan
-    \@mkauthors@iii
-  \or % sigchi
-    \@mkauthors@iii
-  \or % sigchi-a
-    \@mkauthors@iv
-  \fi
-  \endgroup
-}
-\def\@authorfont{\Large\sffamily}
-\def\@affiliationfont{\normalsize\normalfont}
-\ifcase\ACM@format@nr
-\relax % manuscript
-\or % acmsmall
-  \def\@authorfont{\large\sffamily}
-  \def\@affiliationfont{\small\normalfont}
-\or % acmlarge
-\or % acmtog
-  \def\@authorfont{\LARGE\sffamily}
-  \def\@affiliationfont{\large}
-\or % sigconf
-  \def\@authorfont{\LARGE}
-  \def\@affiliationfont{\large}
-\or % siggraph
-  \def\@authorfont{\normalsize\normalfont}
-  \def\@affiliationfont{\normalsize\normalfont}
-\or % sigplan
-  \def\@authorfont{\Large\normalfont}
-  \def\@affiliationfont{\normalsize\normalfont}
-\or % sigchi
-  \def\@authorfont{\bfseries}
-  \def\@affiliationfont{\mdseries}
-\or % sigchi-a
-  \def\@authorfont{\bfseries}
-  \def\@affiliationfont{\mdseries}
-\fi
-\def\@typeset@author@line{%
-  \andify\@currentauthors\par\noindent
-  \@currentauthors\def\@currentauthors{}%
-  \ifx\@currentaffiliations\@empty\else
-    \andify\@currentaffiliations
-      \unskip, {\@currentaffiliations}\par
-  \fi
-  \def\@currentaffiliations{}}
-\def\@mkauthors@i{%
-  \def\@currentauthors{}%
-  \def\@currentaffiliations{}%
-  \global\let\and\@typeset@author@line
-  \def\@author##1{%
-    \ifx\@currentauthors\@empty
-      \gdef\@currentauthors{\@authorfont\MakeTextUppercase{##1}}%
-    \else
-       \g@addto@macro{\@currentauthors}{\and\MakeTextUppercase{##1}}%
-    \fi
-    \gdef\and{}}%
-  \def\email##1##2{}%
-  \def\affiliation##1##2{%
-    \def\@tempa{##2}\ifx\@tempa\@empty\else
-       \ifx\@currentaffiliations\@empty
-          \gdef\@currentaffiliations{%
-            \setkeys{@ACM@affiliation@}{obeypunctuation=false}%
-            \setkeys{@ACM@affiliation@}{##1}%
-            \@affiliationfont##2}%
-       \else
-         \g@addto@macro{\@currentaffiliations}{\and
-           \setkeys{@ACM@affiliation@}{obeypunctuation=false}%
-           \setkeys{@ACM@affiliation@}{##1}##2}%
-      \fi
-    \fi
-     \global\let\and\@typeset@author@line}%
-  \global\setbox\mktitle@bx=\vbox{\noindent\box\mktitle@bx\par\medskip
-    \noindent\addresses\@typeset@author@line
-   \par\medskip}%
-}
-\newbox\author@bx
-\newdimen\author@bx@wd
-\newskip\author@bx@sep
-\author@bx@sep=1pc\relax
-\def\@typeset@author@bx{\bgroup\hsize=\author@bx@wd\def\and{\par}%
-  \global\setbox\author@bx=\vtop{\if@ACM@sigchiamode\else\centering\fi
-    \@authorfont\@currentauthors\par\@affiliationfont
-    \@currentaffiliation}\egroup
-  \box\author@bx\hspace{\author@bx@sep}%
-  \gdef\@currentauthors{}%
-  \gdef\@currentaffiliation{}}
-\def\@mkauthors@iii{%
-  \author@bx@wd=\textwidth\relax
-  \advance\author@bx@wd by -\author@bx@sep\relax
-  \ifnum\@ACM@authorsperrow>0\relax
-    \divide\author@bx@wd by \@ACM@authorsperrow\relax
-  \else
-    \ifcase\num@authorgroups
-    \relax % 0?
-    \or  % 1=one author per row
-    \or  % 2=two authors per row
-       \divide\author@bx@wd by \num@authorgroups\relax
-    \or  % 3=three authors per row
-       \divide\author@bx@wd by \num@authorgroups\relax
-    \or  % 4=two authors per row (!)
-       \divide\author@bx@wd by 2\relax
-    \else % three authors per row
-       \divide\author@bx@wd by 3\relax
-    \fi
-  \fi
-  \advance\author@bx@wd by -\author@bx@sep\relax
-  \gdef\@currentauthors{}%
-  \gdef\@currentaffiliation{}%
-  \def\@author##1{\ifx\@currentauthors\@empty
-    \gdef\@currentauthors{\par##1}%
-  \else
-    \g@addto@macro\@currentauthors{\par##1}%
-  \fi
-  \gdef\and{}}%
-  \def\email##1##2{\ifx\@currentaffiliation\@empty
-    \gdef\@currentaffiliation{\nolinkurl{##2}}%
-  \else
-    \g@addto@macro\@currentaffiliation{\par\nolinkurl{##2}}%
-  \fi}%
-  \def\affiliation##1##2{\ifx\@currentaffiliation\@empty
-    \gdef\@currentaffiliation{%
-      \setkeys{@ACM@affiliation@}{obeypunctuation=false}%
-      \setkeys{@ACM@affiliation@}{##1}##2}%
-  \else
-    \g@addto@macro\@currentaffiliation{\par
-      \setkeys{@ACM@affiliation@}{obeypunctuation=false}%
-      \setkeys{@ACM@affiliation@}{##1}##2}%
-  \fi
-  \global\let\and\@typeset@author@bx
-}%
-  \hsize=\textwidth
-  \global\setbox\mktitle@bx=\vbox{\noindent
-    \box\mktitle@bx\par\medskip\leavevmode
-    \lineskip=1pc\relax\centering\hspace*{-1em}%
-    \addresses\let\and\@typeset@author@bx\and\par\bigskip}}
-\def\@mkauthors@iv{%
-  \author@bx@wd=\columnwidth\relax
-  \advance\author@bx@wd by -\author@bx@sep\relax
-  \ifnum\@ACM@authorsperrow>0\relax
-    \divide\author@bx@wd by \@ACM@authorsperrow\relax
-  \else
-    \ifcase\num@authorgroups
-    \relax % 0?
-    \or  % 1=one author per row
-    \else  % 2=two authors per row
-       \divide\author@bx@wd by 2\relax
-    \fi
-  \fi
-  \advance\author@bx@wd by -\author@bx@sep\relax
-  \gdef\@currentauthors{}%
-  \gdef\@currentaffiliation{}%
-  \def\@author##1{\ifx\@currentauthors\@empty
-    \gdef\@currentauthors{\par##1}%
-  \else
-    \g@addto@macro\@currentauthors{\par##1}%
-  \fi
-  \gdef\and{}}%
-  \def\email##1##2{\ifx\@currentaffiliation\@empty
-    \gdef\@currentaffiliation{\nolinkurl{##2}}%
-  \else
-    \g@addto@macro\@currentaffiliation{\par\nolinkurl{##2}}%
-  \fi}%
-  \def\affiliation##1##2{\ifx\@currentaffiliation\@empty
-    \gdef\@currentaffiliation{%
-      \setkeys{@ACM@affiliation@}{obeypunctuation=false}%
-           \setkeys{@ACM@affiliation@}{##1}##2}%
-  \else
-    \g@addto@macro\@currentaffiliation{\par
-      \setkeys{@ACM@affiliation@}{obeypunctuation=false}%
-      \setkeys{@ACM@affiliation@}{##1}##2}%
-  \fi
-  \global\let\and\@typeset@author@bx}%
-    \bgroup\hsize=\columnwidth
-    \par\raggedright\leftskip=\z@
-    \lineskip=1pc\noindent
-    \addresses\let\and\@typeset@author@bx\and\par\bigskip\egroup}
-\def\@mkauthorsaddresses{%
-  \ifnum\num@authors>1\relax
-  Authors' \else Author's \fi
-  \ifnum\num@authorgroups>1\relax
-  addresses: \else address: \fi
-  \bgroup
-  \def\streetaddress##1{\unskip\@addpunct, ##1}%
-  \def\postcode##1{\unskip\@addpunct, ##1}%
-  \def\position##1{\unskip\ignorespaces}%
-  \def\institution##1{\unskip\@addpunct, ##1}%
-  \def\city##1{\unskip\@addpunct, ##1}%
-  \def\state##1{\unskip\@addpunct, ##1}%
-  \renewcommand\department[2][0]{\unskip\@addpunct, ##2}%
-  \def\country##1{\unskip\@addpunct, ##1}%
-  \def\and{\unskip\@addpunct; }%
-  \def\@author##1{##1}%
-  \def\email##1##2{\unskip\@addpunct, \nolinkurl{##2}}%
-  \addresses
-  \egroup}
-\def\@setaddresses{}
-\def\@authornotemark{\g@addto@macro\@currentauthors{\footnotemark\relax}}
-\def\@@authornotemark#1{\g@addto@macro\@currentauthors{\footnotemark[#1]}}
-\def\@mkteasers{%
-  \ifx\@teaserfigures\@empty\else
-    \def\@teaser##1{\par\bigskip\bgroup
-      \captionsetup{type=figure}##1\egroup\par}
-    \global\setbox\mktitle@bx=\vbox{\noindent\box\mktitle@bx\par
-    \noindent\@teaserfigures\par\medskip}%
-  \fi}
-\def\@mkabstract{\bgroup
-  \ifx\@abstract\@lempty\else
-  {\phantomsection\addcontentsline{toc}{section}{Abstract}%
-    \if@ACM@journal
-       \everypar{\setbox\z@\lastbox\everypar{}}\small
-    \else
-      \section*{Abstract}%
-    \fi
-   \ignorespaces\@abstract\par}%
-  \fi\egroup}
-\def\@mkbibcitation{\bgroup
-  \def\@pages@word{\ifnum\getrefnumber{TotPages}=1\relax page\else pages\fi}%
-  \def\footnotemark{}%
-  \def\\{\unskip{} \ignorespaces}%
-  \def\footnote{\ClassError{\@classname}{Please do note use footnotes
-      inside a \string\title{} or \string\author{} command! Use
-      \string\titlenote{} or \string\authornote{} instead!}}%
-  \def\@article@string{\ifx\@acmArticle\@empty{\ }\else,
-    Article~\@acmArticle\ \fi}%
-  \par\medskip\small\noindent{\bfseries ACM Reference Format:}\par\nobreak
-  \noindent\authors. \@acmYear. \@title
-  \ifx\@subtitle\@empty. \else: \@subtitle. \fi
-  \if@ACM@journal
-     \textit{\@journalNameShort}
-     \@acmVolume, \@acmNumber \@article@string (\@acmPubDate),
-     \ref{TotPages}~\@pages@word.
-  \else
-     In \textit{\@acmBooktitle}%
-     \ifx\@acmEditors\@empty\textit{.}\else
-       \andify\@acmEditors\textit{, }\@acmEditors~\@editorsAbbrev.%
-     \fi\
-     ACM, New York, NY, USA%
-       \@article@string\unskip, \ref{TotPages}~\@pages@word.
-  \fi
-  \ifx\@acmDOI\@empty\else\@formatdoi{\@acmDOI}\fi
-\par\egroup}
-\def\@printendtopmatter{\par\bigskip}
-\def\@setthanks{\long\def\thanks##1{\par##1\@addpunct.}\thankses}
-\def\@setauthorsaddresses{\@authorsaddresses\unskip\@addpunct.}
-\RequirePackage{fancyhdr}
-\if@ACM@review
-  \newsavebox{\ACM@linecount@bx}
-  \newlength\ACM@linecount@bxht
-  \newcount\ACM@linecount
-  \ACM@linecount\@ne\relax
-  \def\ACM@mk@linecount{%
-    \savebox{\ACM@linecount@bx}[4em][t]{\parbox[t]{4em}{%
-        \setlength{\ACM@linecount@bxht}{0pt}%
-        \loop{\color{red}\scriptsize\the\ACM@linecount}\\
-        \global\advance\ACM@linecount by \@ne
-        \addtolength{\ACM@linecount@bxht}{\baselineskip}%
-        \ifdim\ACM@linecount@bxht<\textheight\repeat
-        {\color{red}\scriptsize\the\ACM@linecount}\hfill
-        \global\advance\ACM@linecount by \@ne}}}
-\fi
-\def\ACM@linecountL{%
-  \if@ACM@review
-  \ACM@mk@linecount
-  \begin{picture}(0,0)%
-    \put(-26,-22){\usebox{\ACM@linecount@bx}}%
-  \end{picture}%
-  \fi}
-\def\ACM@linecountR{%
-  \if@ACM@review
-  \ACM@mk@linecount
-  \begin{picture}(0,0)%
-    \put(20,-22){\usebox{\ACM@linecount@bx}}%
-  \end{picture}%
-  \fi}
-\if@ACM@timestamp
-  % Subtracting 30 from \time gives us the effect of rounding down despite
-  % \numexpr rounding to nearest
-  \newcounter{ACM@time@hours}
-  \setcounter{ACM@time@hours}{\numexpr (\time - 30) / 60 \relax}
-  \newcounter{ACM@time@minutes}
-  \setcounter{ACM@time@minutes}{\numexpr \time - \theACM@time@hours * 60 \relax}
-  \newcommand\ACM@timestamp{%
-    \footnotesize%
-    \ifx\@acmSubmissionID\@empty\relax\else
-    Submission ID: \@acmSubmissionID.{ }%
-    \fi
-    \the\year-\two@digits{\the\month}-\two@digits{\the\day}{ }%
-    \two@digits{\theACM@time@hours}:\two@digits{\theACM@time@minutes}{. }%
-    Page \thepage\ of \@startPage--\pageref*{TotPages}.%
-  }
-\fi
-\def\@shortauthors{\if@ACM@anonymous Anon.\else\shortauthors\fi}
-\def\@headfootfont{\sffamily}
-\fancypagestyle{standardpagestyle}{%
-  \fancyhf{}%
-  \renewcommand{\headrulewidth}{\z@}%
-  \renewcommand{\footrulewidth}{\z@}%
-  \ifcase\ACM@format@nr
-  \relax % manuscript
-    \fancyhead[LE]{\ACM@linecountL\if@ACM@printfolios\thepage\fi}%
-    \fancyhead[RO]{\if@ACM@printfolios\thepage\fi}%
-    \fancyhead[RE]{\@shortauthors}%
-    \fancyhead[LO]{\ACM@linecountL\shorttitle}%
-    \fancyfoot[RO,LE]{\footnotesize Manuscript submitted to ACM}%
-  \or % acmsmall
-    \fancyhead[LE]{\ACM@linecountL\@headfootfont\@acmArticle\if@ACM@printfolios:\thepage\fi}%
-    \fancyhead[RO]{\@headfootfont\@acmArticle\if@ACM@printfolios:\thepage\fi}%
-    \fancyhead[RE]{\@headfootfont\@shortauthors}%
-    \fancyhead[LO]{\ACM@linecountL\@headfootfont\shorttitle}%
-    \fancyfoot[RO,LE]{\footnotesize \@journalName, Vol. \@acmVolume, No.
-    \@acmNumber, Article \@acmArticle.  Publication date: \@acmPubDate.}%
-  \or % acmlarge
-    \fancyhead[LE]{\ACM@linecountL\@headfootfont
-      \@acmArticle\if@ACM@printfolios:\thepage\fi\quad\textbullet\quad\@shortauthors}%
-    \fancyhead[LO]{\ACM@linecountL}%
-    \fancyhead[RO]{\@headfootfont
-      \shorttitle\quad\textbullet\quad\@acmArticle\if@ACM@printfolios:\thepage\fi}%
-    \fancyfoot[RO,LE]{\footnotesize \@journalName, Vol. \@acmVolume, No.
-    \@acmNumber, Article \@acmArticle.  Publication date: \@acmPubDate.}%
-  \or % acmtog
-    \fancyhead[LE]{\ACM@linecountL\@headfootfont
-      \@acmArticle\if@ACM@printfolios:\thepage\fi\quad\textbullet\quad\@shortauthors}%
-    \fancyhead[LO]{\ACM@linecountL}%
-    \fancyhead[RE]{\ACM@linecountR}%
-    \fancyhead[RO]{\@headfootfont
-      \shorttitle\quad\textbullet\quad\@acmArticle\if@ACM@printfolios:\thepage\fi\ACM@linecountR}%
-    \fancyfoot[RO,LE]{\footnotesize \@journalName, Vol. \@acmVolume, No.
-    \@acmNumber, Article \@acmArticle.  Publication date: \@acmPubDate.}%
-  \else % Proceedings
-    \fancyfoot[C]{\if@ACM@printfolios\footnotesize\thepage\fi}%
-    \fancyhead[LO]{\ACM@linecountL\@headfootfont\shorttitle}%
-    \fancyhead[RE]{\@headfootfont\@shortauthors\ACM@linecountR}%
-    \fancyhead[LE]{\ACM@linecountL\@headfootfont\acmConference@shortname,
-      \acmConference@date, \acmConference@venue}%
-    \fancyhead[RO]{\@headfootfont\acmConference@shortname,
-      \acmConference@date, \acmConference@venue\ACM@linecountR}%
-  \fi
-  \if@ACM@sigchiamode
-     \fancyheadoffset[L]{\dimexpr(\marginparsep+\marginparwidth)}%
-  \fi
-  \if@ACM@timestamp
-     \fancyfoot[LO,RE]{\ACM@timestamp}
-  \fi
-}
-\pagestyle{standardpagestyle}
-\newdimen\@folio@wd
-\@folio@wd=\z@
-\newdimen\@folio@ht
-\@folio@ht=\z@
-\newdimen\@folio@voffset
-\@folio@voffset=\z@
-\def\@folio@max{1}
-\ifcase\ACM@format@nr
-\relax % manuscript
-\or % acmsmall
-  \@folio@wd=45.75pt\relax
-  \@folio@ht=1.25in\relax
-  \@folio@voffset=.2in\relax
-  \def\@folio@max{8}
-\or % acmlarge
-  \@folio@wd=43.25pt\relax
-  \@folio@ht=79pt\relax
-  \@folio@voffset=.55in\relax
-  \def\@folio@max{10}
-\fi
-\def\@folioblob{\@tempcnta=0\@acmArticleSeq\relax
-  \ifnum\@tempcnta=0\relax\else
-  \loop
-     \ifnum\@tempcnta>\@folio@max\relax
-      \advance\@tempcnta by - \@folio@max
-   \repeat
-    \advance\@tempcnta by -1\relax
-    \@tempdima=\@folio@ht\relax
-    \multiply\@tempdima by \the\@tempcnta\relax
-    \advance\@tempdima by -\@folio@voffset\relax
-    \begin{picture}(0,0)
-    \makebox[\z@]{\raisebox{-\@tempdima}{%
-        \rlap{%
-          \raisebox{-0.45\@folio@ht}[\z@][\z@]{%
-            \rule{\@folio@wd}{\@folio@ht}}}%
-        \parbox{\@folio@wd}{%
-          \centering
-          \textcolor{white}{\LARGE\sffamily\bfseries\@acmArticle}}}}
-  \end{picture}\fi}
-
-\fancypagestyle{firstpagestyle}{%
-  \fancyhf{}%
-  \renewcommand{\headrulewidth}{\z@}%
-  \renewcommand{\footrulewidth}{\z@}%
-  \ifcase\ACM@format@nr
-  \relax % manuscript
-    \fancyhead[L]{\ACM@linecountL}%
-    \fancyfoot[RO,LE]{\if@ACM@printfolios\small\thepage\fi}%
-    \fancyfoot[RE,LO]{\footnotesize Manuscript submitted to ACM}%
-  \or % acmsmall
-    \fancyfoot[RO,LE]{\footnotesize \@journalName, Vol. \@acmVolume, No.
-    \@acmNumber, Article \@acmArticle.  Publication date:
-    \@acmPubDate.}%
-    \fancyhead[LE]{\ACM@linecountL\@folioblob}%
-    \fancyhead[LO]{\ACM@linecountL}%
-    \fancyhead[RO]{\@folioblob}%
-    \fancyheadoffset[RO,LE]{0.6\@folio@wd}%
-  \or % acmlarge
-    \fancyfoot[RO,LE]{\footnotesize \@journalName, Vol. \@acmVolume, No.
-    \@acmNumber, Article \@acmArticle.  Publication date:
-    \@acmPubDate.}%
-    \fancyhead[RO]{\@folioblob}%
-    \fancyhead[LE]{\ACM@linecountL\@folioblob}%
-    \fancyhead[LO]{\ACM@linecountL}%
-    \fancyheadoffset[RO,LE]{1.4\@folio@wd}%
-  \or % acmtog
-    \fancyfoot[RO,LE]{\footnotesize \@journalName, Vol. \@acmVolume, No.
-    \@acmNumber, Article \@acmArticle.  Publication date:
-    \@acmPubDate.}%
-    \fancyhead[L]{\ACM@linecountL}%
-    \fancyhead[R]{\ACM@linecountR}%
-  \else % Conference proceedings
-    \fancyhead[L]{\ACM@linecountL}%
-    \fancyhead[R]{\ACM@linecountR}%
-    \fancyfoot[C]{\if@ACM@printfolios\footnotesize\thepage\fi}%
-  \fi
-  \if@ACM@timestamp
-    \ifnum\ACM@format@nr=0\relax % Manuscript
-    \fancyfoot[LO,RE]{\ACM@timestamp\quad
-      \footnotesize Manuscript submitted to ACM}
-    \else
-    \fancyfoot[LO,RE]{\ACM@timestamp}
-    \fi
-  \fi
-}
-\let\ACM@ps@plain\ps@plain
-\let\ACM@ps@myheadings\ps@myheadings
-\let\ACM@ps@headings\ps@headings
-\def\ACM@restore@pagestyle{%
-  \let\ps@plain\ACM@ps@plain
-  \let\ps@myheadings\ACM@ps@myheadings
-  \let\ps@headings\ACM@ps@headings}
-\AtBeginDocument{\ACM@restore@pagestyle}
-\renewcommand\section{\@startsection{section}{1}{\z@}%
-  {-.75\baselineskip \@plus -2\p@ \@minus -.2\p@}%
-  {.25\baselineskip}%
-  {\@secfont}}
-\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
-  {-.75\baselineskip \@plus -2\p@ \@minus -.2\p@}%
-  {.25\baselineskip}%
-  {\@subsecfont}}
-\renewcommand\subsubsection{\@startsection{subsubsection}{3}{10pt}%
-  {-.5\baselineskip \@plus -2\p@ \@minus -.2\p@}%
-  {-3.5\p@}%
-  {\@subsubsecfont\@adddotafter}}
-\renewcommand\paragraph{\@startsection{paragraph}{4}{\parindent}%
-  {-.5\baselineskip \@plus -2\p@ \@minus -.2\p@}%
-  {-3.5\p@}%
-  {\@parfont\@adddotafter}}
-\renewcommand\part{\@startsection{part}{9}{\z@}%
-  {-10\p@ \@plus -4\p@ \@minus -2\p@}%
-  {4\p@}%
-  {\@parfont}}
-\def\section@raggedright{\@rightskip\@flushglue
-  \rightskip\@rightskip
-  \leftskip\z@skip
-  \parindent\z@}
-\def\@secfont{\sffamily\bfseries\section@raggedright\MakeTextUppercase}
-\def\@subsecfont{\sffamily\bfseries\section@raggedright}
-\def\@subsubsecfont{\sffamily\itshape}
-\def\@parfont{\itshape}
-\setcounter{secnumdepth}{3}
-\ifcase\ACM@format@nr
-\relax % manuscript
-\or % acmsmall
-\or % acmlarge
- \def\@secfont{\sffamily\large\section@raggedright\MakeTextUppercase}
- \def\@subsecfont{\sffamily\large\section@raggedright}
-\or % acmtog
- \def\@secfont{\sffamily\large\section@raggedright\MakeTextUppercase}
- \def\@subsecfont{\sffamily\large\section@raggedright}
-\or % sigconf
- \def\@secfont{\bfseries\Large\section@raggedright\MakeTextUppercase}
- \def\@subsecfont{\bfseries\Large\section@raggedright}
-\or % siggraph
- \def\@secfont{\sffamily\bfseries\Large\section@raggedright\MakeTextUppercase}
- \def\@subsecfont{\sffamily\bfseries\Large\section@raggedright}
-\or % sigplan
- \def\@secfont{\bfseries\Large\section@raggedright}
- \def\@subsecfont{\bfseries\section@raggedright}
- \renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
-   {-.75\baselineskip \@plus -2\p@ \@minus -.2\p@}%
-   {.25\baselineskip}%
-   {\@subsubsecfont}}
- \def\@subsubsecfont{\bfseries\section@raggedright}
- \renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
-   {-.5\baselineskip \@plus -2\p@ \@minus -.2\p@}%
-   {-3.5\p@}%
-   {\@parfont\@addspaceafter}}
- \def\@parfont{\bfseries\itshape}
- \renewcommand\subparagraph{\@startsection{subparagraph}{5}{\z@}%
-   {-.5\baselineskip \@plus -2\p@ \@minus -.2\p@}%
-   {-3.5\p@}%
-   {\@subparfont\@addspaceafter}}
- \def\@subparfont{\itshape}
-\or % sigchi
- \setcounter{secnumdepth}{1}
- \def\@secfont{\sffamily\bfseries\section@raggedright\MakeTextUppercase}
- \def\@subsecfont{\sffamily\bfseries\section@raggedright}
-\or % sigchi-a
- \setcounter{secnumdepth}{0}
- \def\@secfont{\sffamily\bfseries\section@raggedright\MakeTextUppercase}
- \def\@subsecfont{\sffamily\bfseries\section@raggedright}
-\fi
-\def\@adddotafter#1{#1\@addpunct{.}}
-\def\@addspaceafter#1{#1\@addpunct{\enspace}}
-\providecommand*\@dotsep{4.5}
-\def\@acmplainbodyfont{\itshape}
-\def\@acmplainindent{\parindent}
-\def\@acmplainheadfont{\scshape}
-\def\@acmplainnotefont{\@empty}
-\ifcase\ACM@format@nr
-\relax % manuscript
-\or % acmsmall
-\or % acmlarge
-\or % acmtog
-\or % sigconf
-\or % siggraph
-\or % sigplan
-  \def\@acmplainbodyfont{\itshape}
-  \def\@acmplainindent{\z@}
-  \def\@acmplainheadfont{\bfseries}
-  \def\@acmplainnotefont{\normalfont}
-\or % sigchi
-\or % sigchi-a
-\fi
-\newtheoremstyle{acmplain}%
-  {.5\baselineskip\@plus.2\baselineskip
-    \@minus.2\baselineskip}% space above
-  {.5\baselineskip\@plus.2\baselineskip
-    \@minus.2\baselineskip}% space below
-  {\@acmplainbodyfont}% body font
-  {\@acmplainindent}% indent amount
-  {\@acmplainheadfont}% head font
-  {.}% punctuation after head
-  {.5em}% spacing after head
-  {\thmname{#1}\thmnumber{ #2}\thmnote{ {\@acmplainnotefont(#3)}}}% head spec
-\def\@acmdefinitionbodyfont{\normalfont}
-\def\@acmdefinitionindent{\parindent}
-\def\@acmdefinitionheadfont{\itshape}
-\def\@acmdefinitionnotefont{\@empty}
-\ifcase\ACM@format@nr
-\relax % manuscript
-\or % acmsmall
-\or % acmlarge
-\or % acmtog
-\or % sigconf
-\or % siggraph
-\or % sigplan
-  \def\@acmdefinitionbodyfont{\normalfont}
-  \def\@acmdefinitionindent{\z@}
-  \def\@acmdefinitionheadfont{\bfseries}
-  \def\@acmdefinitionnotefont{\normalfont}
-\or % sigchi
-\or % sigchi-a
-\fi
-\newtheoremstyle{acmdefinition}%
-  {.5\baselineskip\@plus.2\baselineskip
-    \@minus.2\baselineskip}% space above
-  {.5\baselineskip\@plus.2\baselineskip
-    \@minus.2\baselineskip}% space below
-  {\@acmdefinitionbodyfont}% body font
-  {\@acmdefinitionindent}% indent amount
-  {\@acmdefinitionheadfont}% head font
-  {.}% punctuation after head
-  {.5em}% spacing after head
-  {\thmname{#1}\thmnumber{ #2}\thmnote{ {\@acmdefinitionnotefont(#3)}}}% head spec
-\theoremstyle{acmplain}
-\AtEndPreamble{%
-  \if@ACM@acmthm
-  \theoremstyle{acmplain}
-  \@ifundefined{theorem}{%
-  \newtheorem{theorem}{Theorem}[section]
-  }{}
-  \@ifundefined{conjecture}{%
-  \newtheorem{conjecture}[theorem]{Conjecture}
-  }{}
-  \@ifundefined{proposition}{%
-  \newtheorem{proposition}[theorem]{Proposition}
-  }{}
-  \@ifundefined{lemma}{%
-  \newtheorem{lemma}[theorem]{Lemma}
-  }{}
-  \@ifundefined{corollary}{%
-  \newtheorem{corollary}[theorem]{Corollary}
-  }{}
-  \theoremstyle{acmdefinition}
-  \@ifundefined{example}{%
-  \newtheorem{example}[theorem]{Example}
-  }{}
-  \@ifundefined{definition}{%
-  \newtheorem{definition}[theorem]{Definition}
-  }{}
-  \fi
-  \theoremstyle{acmplain}
-}
-\def\@proofnamefont{\scshape}
-\def\@proofindent{\indent}
-\ifcase\ACM@format@nr
-\relax % manuscript
-\or % acmsmall
-\or % acmlarge
-\or % acmtog
-\or % sigconf
-\or % siggraph
-\or % sigplan
-  \def\@proofnamefont{\itshape}
-  \def\@proofindent{\noindent}
-\or % sigchi
-\or % sigchi-a
-\fi
-\renewenvironment{proof}[1][\proofname]{\par
-  \pushQED{\qed}%
-  \normalfont \topsep6\p@\@plus6\p@\relax
-  \trivlist
-  \item[\@proofindent\hskip\labelsep
-        {\@proofnamefont #1\@addpunct{.}}]\ignorespaces
-}{%
-  \popQED\endtrivlist\@endpefalse
-}
-\specialcomment{acks}{%
-  \begingroup
-  \section*{Acknowledgments}
-  \phantomsection\addcontentsline{toc}{section}{Acknowledgments}
-}{%
-  \endgroup
-}
-\def\grantsponsor#1#2#3{#2}
-\newcommand\grantnum[3][]{#3%
-  \def\@tempa{#1}\ifx\@tempa\@empty\else\space(\url{#1})\fi}
-\AtEndPreamble{%
-\if@ACM@screen
-  \includecomment{screenonly}
-  \excludecomment{printonly}
-\else
-  \excludecomment{screenonly}
-  \includecomment{printonly}
-\fi
-\if@ACM@anonymous
-  \excludecomment{anonsuppress}
-  \excludecomment{acks}
-\else
-  \includecomment{anonsuppress}
-\fi}
-\newcommand\showeprint[2][arxiv]{%
-  \def\@tempa{#1}%
-  \ifx\@tempa\@empty\def\@tempa{arxiv}\fi
-  \def\@tempb{arxiv}%
-  \ifx\@tempa\@tempb
-     arXiv:\href{http://arxiv.org/abs/#2}{#2}\else arXiv:#2%
-  \fi}
-\normalsize\normalfont\frenchspacing
-\endinput
-%%
-%% End of file `acmart.cls'.

diff --git a/papers/SIGCOMM2018_IoT-SP/conclusion.tex b/papers/SIGCOMM2018_IoT-SP/conclusion.tex
deleted file mode 100644 (file)
index 5be1c64..0000000
--- a/papers/SIGCOMM2018_IoT-SP/conclusion.tex
+++ /dev/null
@@ -1,2 +0,0 @@
-\section{Conclusion}
-\label{sect:conclusion}
\ No newline at end of file

diff --git a/papers/SIGCOMM2018_IoT-SP/experiments.tex b/papers/SIGCOMM2018_IoT-SP/experiments.tex
deleted file mode 100644 (file)
index b07e35a..0000000
--- a/papers/SIGCOMM2018_IoT-SP/experiments.tex
+++ /dev/null
@@ -1,21 +0,0 @@
-\section{Experiments}
-We examine five different smart plugs from four different manufacturers: the Wemo Switch Smart Plug (belkin), the Wemo Insight (belkin), the TP-Link Smart Plug, the D-Link Smart Plug, and the Samsung SmartThings Outlet {\color{red}[TODO: verify model names, add model numbers]}.
-The purpose of examining a diverse set of smart plugs is twofold.
-First, it lets us uncover commonalities in the design (of the network protocols) of smart plugs across vendors.
-Second, it allows us to compare the security and privacy of the different smart plugs with the ultimate goal of providing a recommendation to end users who are concerned with these aspects.
-
-For each smart plug, we perform the following set of actions... For each action, we note the time...
-
-%\subsection{}
-
-
-
-\subsection{Data Collection}
-{
-\color{red}
-Description + diagram of how we collect data at the router:
-\begin{itemize}
-\item Router OS
-\item Interfaces logged
-\end{itemize}
-}
\ No newline at end of file

diff --git a/papers/SIGCOMM2018_IoT-SP/figures/ST-plug-OFF-local-phone.png b/papers/SIGCOMM2018_IoT-SP/figures/ST-plug-OFF-local-phone.png
deleted file mode 100644 (file)
index 5861b3b..0000000
Binary files a/papers/SIGCOMM2018_IoT-SP/figures/ST-plug-OFF-local-phone.png and /dev/null differ

diff --git a/papers/SIGCOMM2018_IoT-SP/figures/ST-plug-ON-local-phone.png b/papers/SIGCOMM2018_IoT-SP/figures/ST-plug-ON-local-phone.png
deleted file mode 100644 (file)
index 6cf1817..0000000
Binary files a/papers/SIGCOMM2018_IoT-SP/figures/ST-plug-ON-local-phone.png and /dev/null differ

diff --git a/papers/SIGCOMM2018_IoT-SP/future-work.tex b/papers/SIGCOMM2018_IoT-SP/future-work.tex
deleted file mode 100644 (file)
index 76012e2..0000000
--- a/papers/SIGCOMM2018_IoT-SP/future-work.tex
+++ /dev/null
@@ -1,8 +0,0 @@
-\section{Future Work}
-\label{sect:future-work}
-{\color{red}
-\begin{itemize}
-\item Machine learning to speed up / automate traffic pattern detection.
-\item Call for encryption techniques that pads packets so that all packets are of same length (e.g. MSS) or randomizes packet lengths? However, full length of conversation (even with padding/randomization) may still expose some information.
-\end{itemize}
-}
\ No newline at end of file

diff --git a/papers/SIGCOMM2018_IoT-SP/introduction.tex b/papers/SIGCOMM2018_IoT-SP/introduction.tex
deleted file mode 100755 (executable)
index 76cb478..0000000
--- a/papers/SIGCOMM2018_IoT-SP/introduction.tex
+++ /dev/null
@@ -1,3 +0,0 @@
-\section{Introduction}
-\label{sect:introduction}
-TODO \cite{TeXFAQ}.

diff --git a/papers/SIGCOMM2018_IoT-SP/main.tex b/papers/SIGCOMM2018_IoT-SP/main.tex
deleted file mode 100755 (executable)
index 5025164..0000000
--- a/papers/SIGCOMM2018_IoT-SP/main.tex
+++ /dev/null
@@ -1,212 +0,0 @@
-\documentclass[sigconf]{acmart}
-
-\usepackage{booktabs} % For formal tables
-
-
-% Copyright
-%\setcopyright{none}
-%\setcopyright{acmcopyright}
-%\setcopyright{acmlicensed}
-\setcopyright{rightsretained}
-%\setcopyright{usgov}
-%\setcopyright{usgovmixed}
-%\setcopyright{cagov}
-%\setcopyright{cagovmixed}
-
-
-% DOI
-\acmDOI{PLACEHOLDER}
-
-% ISBN
-\acmISBN{PLACEHOLDER}
-
-%Conference
-\acmConference[SIGCOMM'18]{ACM SIGCOMM conference}{August 2018}{Budapest, Hungary}
-\acmYear{2018}
-\copyrightyear{2018}
-
-
-\acmArticle{4}
-\acmPrice{15.00}
-
-% These commands are optional
-%\acmBooktitle{Transactions of the ACM Woodstock conference}
-%\editor{Jennifer B. Sartor}
-%\editor{Theo D'Hondt}
-%\editor{Wolfgang De Meuter}
-
-
-\begin{document}
-\title{On Network Activity of Smart Plugs}
-\titlenote{Produces the permission block, and
-  copyright information}
-\subtitle{The Secrets that Encryption Cannot Protect}
-\subtitlenote{The full version of the author's guide is available as
-  \texttt{acmart.pdf} document}
-
-
-\author{Rahmadi Trimananda}
-%\authornote{Dr.~Trovato insisted his name be first.}
-%\orcid{1234-5678-9012}
-\affiliation{%
-  \institution{University of California, Irvine}
-  %\streetaddress{P.O. Box 1212}
-  \city{Irvine}
-  \state{California}
-  %\postcode{43017-6221}
-}
-\email{rtrimana@uci.edu}
-
-\author{Athina Markopoulou }
-%\authornote{Dr.~Trovato insisted his name be first.}
-%\orcid{1234-5678-9012}
-\affiliation{%
-  \institution{University of California, Irvine}
-  %\streetaddress{P.O. Box 1212}
-  \city{Irvine}
-  \state{California}
-  %\postcode{43017-6221}
-}
-\email{athina@uci.edu}
-
-\author{Brian Demsky}
-%\authornote{Dr.~Trovato insisted his name be first.}
-%\orcid{1234-5678-9012}
-\affiliation{%
-  \institution{University of California, Irvine}
-  %\streetaddress{P.O. Box 1212}
-  \city{Irvine}
-  \state{California}
-  %\postcode{43017-6221}
-}
-\email{bdemsky@uci.edu}
-
-\author{Janus Varmarken}
-%\authornote{Dr.~Trovato insisted his name be first.}
-%\orcid{1234-5678-9012}
-\affiliation{%
-  \institution{University of California, Irvine}
-  %\streetaddress{P.O. Box 1212}
-  \city{Irvine}
-  \state{California}
-  %\postcode{43017-6221}
-}
-\email{jvarmark@uci.edu}
-
-%\author{G.K.M. Tobin}
-%\authornote{The secretary disavows any knowledge of this author's actions.}
-%\affiliation{%
-%  \institution{Institute for Clarity in Documentation}
-%  \streetaddress{P.O. Box 1212}
-%  \city{Dublin}
-%  \state{Ohio}
-%  \postcode{43017-6221}
-%}
-%\email{webmaster@marysville-ohio.com}
-%
-%\author{Lars Th{\o}rv{\"a}ld}
-%\authornote{This author is the
-%  one who did all the really hard work.}
-%\affiliation{%
-%  \institution{The Th{\o}rv{\"a}ld Group}
-%  \streetaddress{1 Th{\o}rv{\"a}ld Circle}
-%  \city{Hekla}
-%  \country{Iceland}}
-%\email{larst@affiliation.org}
-%
-%\author{Valerie B\'eranger}
-%\affiliation{%
-%  \institution{Inria Paris-Rocquencourt}
-%  \city{Rocquencourt}
-%  \country{France}
-%}
-%\author{Aparna Patel}
-%\affiliation{%
-% \institution{Rajiv Gandhi University}
-% \streetaddress{Rono-Hills}
-% \city{Doimukh}
-% \state{Arunachal Pradesh}
-% \country{India}}
-%\author{Huifen Chan}
-%\affiliation{%
-%  \institution{Tsinghua University}
-%  \streetaddress{30 Shuangqing Rd}
-%  \city{Haidian Qu}
-%  \state{Beijing Shi}
-%  \country{China}
-%}
-%
-%\author{Charles Palmer}
-%\affiliation{%
-%  \institution{Palmer Research Laboratories}
-%  \streetaddress{8600 Datapoint Drive}
-%  \city{San Antonio}
-%  \state{Texas}
-%  \postcode{78229}}
-%\email{cpalmer@prl.com}
-%
-%\author{John Smith}
-%\affiliation{\institution{The Th{\o}rv{\"a}ld Group}}
-%\email{jsmith@affiliation.org}
-%
-%\author{Julius P.~Kumquat}
-%\affiliation{\institution{The Kumquat Consortium}}
-%\email{jpkumquat@consortium.net}
-
-% The default list of authors is too long for headers.
-\renewcommand{\shortauthors}{B. Trovato et al.}
-
-\include{abstract}
-
-%
-% The code below should be generated by the tool at
-% http://dl.acm.org/ccs.cfm
-% Please copy and paste the code instead of the example below.
-%
-\begin{CCSXML}
-<ccs2012>
- <concept>
-  <concept_id>10010520.10010553.10010562</concept_id>
-  <concept_desc>Computer systems organization~Embedded systems</concept_desc>
-  <concept_significance>500</concept_significance>
- </concept>
- <concept>
-  <concept_id>10010520.10010575.10010755</concept_id>
-  <concept_desc>Computer systems organization~Redundancy</concept_desc>
-  <concept_significance>300</concept_significance>
- </concept>
- <concept>
-  <concept_id>10010520.10010553.10010554</concept_id>
-  <concept_desc>Computer systems organization~Robotics</concept_desc>
-  <concept_significance>100</concept_significance>
- </concept>
- <concept>
-  <concept_id>10003033.10003083.10003095</concept_id>
-  <concept_desc>Networks~Network reliability</concept_desc>
-  <concept_significance>100</concept_significance>
- </concept>
-</ccs2012>
-\end{CCSXML}
-
-\ccsdesc[500]{Computer systems organization~Embedded systems}
-\ccsdesc[300]{Computer systems organization~Redundancy}
-\ccsdesc{Computer systems organization~Robotics}
-\ccsdesc[100]{Networks~Network reliability}
-
-
-\keywords{ACM proceedings, \LaTeX, text tagging}
-
-
-\maketitle
-
-\input{introduction}
-\input{related-work}
-\input{experiments}
-\input{Results}
-\input{future-work}
-\input{conclusion}
-
-\bibliographystyle{ACM-Reference-Format}
-\bibliography{references}
-
-\end{document}

diff --git a/papers/SIGCOMM2018_IoT-SP/references.bib b/papers/SIGCOMM2018_IoT-SP/references.bib
deleted file mode 100755 (executable)
index f323abe..0000000
--- a/papers/SIGCOMM2018_IoT-SP/references.bib
+++ /dev/null
@@ -1,88 +0,0 @@
-@Misc{TeXFAQ,
-  title =        {{UK} List of {\TeX} Frequently Asked Questions},
-  author =       {{UK \TeX{} Users Group}},
-  year =         2016,
-  howpublished = {\url{http://www.tex.ac.uk}}
-}
-
-@Manual{Downes04:amsart,
-  title =        {The \textsf{amsart}, \textsf{amsproc}, and
-                  \textsf{amsbook} document~classes},
-  author =       {Michael Downes and Barbara Beeton},
-  organization = {American Mathematical Society},
-  year =         2004,
-  month =        aug,
-  note =         {\url{http://www.ctan.org/pkg/amslatex}}
-}
-
-@Manual{Fiorio15,
-  title =        {{a}lgorithm2e.sty---package for algorithms},
-  author =       {Cristophe Fiorio},
-  year =         2015,
-  month =        oct,
-  note =         {\url{http://www.ctan.org/pkg/algorithm2e}}
-}
-
-@Manual{Brito09,
-  title =        {The algorithms bundle},
-  author =       {Rog\'erio Brito},
-  year =         2009,
-  month =        aug,
-  note =         {\url{http://www.ctan.org/pkg/algorithms}}
-}
-
-@Manual{Heinz15,
-  title =        {The Listings Package},
-  author =       {Carsten Heinz and Brooks Moses and Jobst Hoffmann},
-  year =         2015,
-  month =        jun,
-  note =         {\url{http://www.ctan.org/pkg/listings}}
-}
-
-@Manual{Fear05,
-  title =        {Publication quality tables in {\LaTeX}},
-  author =       {Simon Fear},
-  year =         2005,
-  month =        apr,
-  note =         {\url{http://www.ctan.org/pkg/booktabs}}
-}
-
-@Manual{ACMIdentityStandards,
-  title =        {{ACM} Visual Identity Standards},
-  organization = {Association for Computing Machinery},
-  year =         2007,
-  note =         {\url{http://identitystandards.acm.org}}
-}
-
-@Manual{Sommerfeldt13:Subcaption,
-  title =        {The subcaption package},
-  author =       {Axel Sommerfeldt},
-  year =         2013,
-  month =        apr,
-  note =         {\url{http://www.ctan.org/pkg/subcaption}}
-}
-
-@Manual{Nomencl,
-  title =        {A package to create a nomenclature},
-  author =       {Boris Veytsman and Bern Schandl and Lee Netherton
-                  and C. V. Radhakrishnan},
-  year =         2005,
-  month =        sep,
-  note =         {\url{http://www.ctan.org/pkg/nomencl}}
-}
-
-@Manual{Talbot16:Glossaries,
-  title =        {User Manual for glossaries.sty v4.25},
-  author =       {Nicola L. C. Talbot},
-  year =         2016,
-  month =        jun,
-  note =         {\url{http://www.ctan.org/pkg/subcaption}}
-}
-
-@Manual{Carlisle04:Textcase,
-  title =        {The \textsl{textcase} package},
-  author =       {David Carlisle},
-  month =        oct,
-  year =         2004,
-  note =         {\url{http://www.ctan.org/pkg/textcase}}
-}

diff --git a/papers/SIGCOMM2018_IoT-SP/related-work.tex b/papers/SIGCOMM2018_IoT-SP/related-work.tex
deleted file mode 100644 (file)
index 89de0c4..0000000
--- a/papers/SIGCOMM2018_IoT-SP/related-work.tex
+++ /dev/null
@@ -1,16 +0,0 @@
-\section{Related Work}
-\label{sect:related-work}
-
-{\color{red}
-Princeton paper:
-\begin{itemize}
-\item Recognize that they can perform activity detection by observing changes in traffic volume over time
-\item However, they cannot distinguish on/off from each other
-\item Proposed traffic shaping does not prevent activity inference from the observation of packet lengths in specific sequences (assuming no VPN)
-\end{itemize}
-Cisco paper:
-\begin{itemize}
-\item Also uses DNS for contextual information
-\item Refers to previous work that considers packet lengths and sequences of packets (and uses this themselves)
-\end{itemize}
-}
\ No newline at end of file

diff --git a/papers/SIGCOMM2018_IoT-SP/results.tex b/papers/SIGCOMM2018_IoT-SP/results.tex
deleted file mode 100644 (file)
index 1b0382b..0000000
--- a/papers/SIGCOMM2018_IoT-SP/results.tex
+++ /dev/null
@@ -1,40 +0,0 @@
-\section{Results}
-\label{sect:results}
-{\color{red}[TODO: perhaps heading should be ``Data Analysis'' -- or perhaps two sections?]}
-
-{\color{red}
-Presentation of analysis methods in an incremental/progressive manner:
-\begin{enumerate}
-\item Timeseries plots of traffic volume reveals that \emph{some} event occurred, but does not allow for differentiation between specific events. In addition, this approach does not work for all devices.
-\item Observing for phone to cloud, cloud to plug traffic allows us to determine if plug is toggled from home or afar (assuming phone has wifi enabled) for some plugs (those which are exclusively controlled by the cloud server).
-\item Observing lengths of packets exchanged between phone, cloud, and plug (coupled with DNS request+response+subsequent connection to IP) reveals the occurrence of specific events for some devices.
-\end{enumerate}
-}
-
-\begin{figure}
-  \caption{SmartThings Plug toggled ON using a phone connected to the local network.}
-  \label{fig:st-plug-on-local-phone}
-  \centering
-    \includegraphics[width=0.5\linewidth]{figures/ST-plug-ON-local-phone.png}
-\end{figure}
-
-\begin{figure}
-  \caption{SmartThings Plug toggled OFF using a phone connected to the local network.}
-  \label{fig:st-plug-off-local-phone}
-  \centering
-    \includegraphics[width=0.5\linewidth]{figures/ST-plug-OFF-local-phone.png}
-\end{figure}
-
-
-% below subfigure style should be possible once we figure out how to include subcaption package.
-%\begin{figure}
-%\begin{minipage}[b]{0.5\textwidth}
-%\includegraphics{figures/ST-plug-ON-local-phone.png}\\
-%\subcaption{A subfigure}
-%\end{minipage}%
-%\begin{minipage}[b]{0.5\textwidth}
-%\includegraphics{figures/ST-plug-OFF-local-phone.png}\\
-%\subcaption{Another subfigure}
-%\end{minipage}%
-%\caption{Several figures}
-%\end{figure}
\ No newline at end of file

diff --git a/parser/__init__.py b/parser/__init__.py
deleted file mode 100644 (file)
index e69de29..0000000

diff --git a/parser/parse_dns.py b/parser/parse_dns.py
deleted file mode 100644 (file)
index 4b88337..0000000
--- a/parser/parse_dns.py
+++ /dev/null
@@ -1,206 +0,0 @@
-#!/usr/bin/python
-
-"""
-Script that takes a file (output by wireshark/tshark, in JSON format) with DNS traffic
-and constructs a map (dictionary) in which a hostname points to a set that contains the
-IP addresses that is associated with that hostname.
-"""
-
-import sys
-import json
-from collections import defaultdict
-from decimal import *
-
-ROUTER_MAC = "b0:b9:8a:73:69:8e"
-
-JSON_KEY_SOURCE = "_source"
-JSON_KEY_LAYERS = "layers"
-JSON_KEY_DNS = "dns"
-JSON_KEY_QUERIES = "Queries"
-JSON_KEY_ANSWERS = "Answers"
-JSON_KEY_DNS_RESP_TYPE = "dns.resp.type"
-JSON_KEY_DNS_A = "dns.a" # Key for retrieving IP. 'a' for type A DNS record.
-JSON_KEY_DNS_RESP_NAME = "dns.resp.name"
-JSON_KEY_DNS_CNAME = "dns.cname"
-JSON_KEY_ETH = "eth"
-JSON_KEY_ETH_DST = "eth.dst"
-JSON_KEY_FRAME = "frame"
-JSON_KEY_FRAME_TIME_EPOCH = "frame.time_epoch"
-
-def main():
-       if len(sys.argv) < 2:
-               print "Usage: python", sys.argv[0], "input_file"
-               return
-       mac_to_ddm = parse_json_dns(sys.argv[1])
-       for mac in mac_to_ddm:
-               ddm = mac_to_ddm[mac]
-               ddm.print_mappings()
-       # maps_tuple = parse_json_dns(sys.argv[1])
-       
-       # # print hostname to ip map
-       # hn_ip_map = maps_tuple[0]
-       # for hn in hn_ip_map.keys():
-       #       print "====================================================================="
-       #       print hn, "maps to:"
-       #       for ip in hn_ip_map[hn]:
-       #               print "    -", ip
-       # print "====================================================================="
-       
-       # print " "
-
-       # # print ip to hostname map
-       # ip_hn_map = maps_tuple[1]
-       # for ip in ip_hn_map.keys():
-       #       print "====================================================================="
-       #       print ip, "maps to:"
-       #       for hn in ip_hn_map[ip]:
-       #               print "    -", hn
-       # print "====================================================================="
-
-class DeviceDNSMap:
-       def __init__(self, mac_address):
-               # MAC address of device
-               self.mac = mac_address
-               # Maps an external IP to a list of (timestamp,hostname) tuples.
-               # Entries in the list should be interpreted as follows:
-               # the timestamp indicates WHEN this device mapped the given ip (key in dict) to the hostname.
-               self.ip_mappings = defaultdict(list)
-
-       def hostname_for_ip_at_time(self, ip, timestamp):
-               # Does device have a mapping for the given IP?
-               if not ip in self.ip_mappings:
-                       return None
-               if not self.ip_mappings[ip]:
-                       # If list of (timestamp,hostname) tuples is empty, there is no mapping to report.
-                       return None
-               # Best fit mapping: the mapping immediately BEFORE timestamp parameter.
-               # Start with random pick (element 0).
-               best_fit = self.ip_mappings[ip][0]
-               for t in self.ip_mappings[ip]:
-                       # t is a (timestamp,hostname) tuple
-                       if t[0] < timestamp and t[0] > best_fit[0]:
-                               # t is a better fit if it happened BEFORE the input timestamp
-                               # and is LATER than the current best_fit
-                               best_fit = t
-               # return the matching hostname
-               return best_fit[1]
-
-       def add_mapping(self, ip, timestamp_hostname_tuple):
-               self.ip_mappings[ip].append(timestamp_hostname_tuple)
-
-       def print_mappings(self):
-               count = 0
-               print "### Mappings for MAC = ", self.mac, "###"
-               for ip in self.ip_mappings:
-                       print "--- IP ", ip, " maps to: ---"
-                       for t in self.ip_mappings[ip]:
-                               print t[1], "at epoch time =", t[0]
-                               count += 1
-               print "### Total of", count, "mappings for", self.mac, "###"
-
-       # --------------------------------------------------------------------------
-       # Define eq and hash such that instances of the class can be used as keys in dictionaries.
-       # Equality is based on MAC as a MAC uniquely identifies the device.
-       def __eq__(self, another):
-               return hasattr(another, 'mac') and self.mac == another.mac
-       def __hash__(self):
-               return hash(self.data)
-       # --------------------------------------------------------------------------
-
-
-def parse_json_dns(file_path):
-       # Our end output: dictionary of MAC addresses with DeviceDNSMaps as values.
-       # Each DeviceDNSMap contains DNS lookups performed by the device with the corresponding MAC.
-       result = defaultdict()
-       with open(file_path) as jf:
-               # Read JSON.
-        # data becomes reference to root JSON object (or in our case json array)
-               data = json.load(jf)
-               # Loop through json objects in data
-               # Each entry is a pcap entry (request/response (packet) and associated metadata)
-               for p in data:
-                       # p is a JSON object, not an index
-                       # Drill down to DNS part: _source->layers->dns
-                       layers = p[JSON_KEY_SOURCE][JSON_KEY_LAYERS]
-                       dns = layers.get(JSON_KEY_DNS, None)
-                       # Skip any non DNS traffic
-                       if dns is None:
-                               #print "[ WARNING: Non DNS traffic ]"
-                               continue
-                       # We only care about DNS responses as these also contain a copy of the query that they answer
-                       answers = dns.get(JSON_KEY_ANSWERS, None)
-                       if answers is None:
-                               continue
-                       ## Now that we know that it is an answer, the queries should also be available.
-                       queries = dns.get(JSON_KEY_QUERIES)
-                       if len(queries.keys()) > 1:
-                               # Unclear if script will behave correctly for DNS lookups with multiple queries
-                               print "[ WARNING: Multi query DNS lookup ]"
-                       # Get ethernet information for identifying the device performing the DNS lookup.
-                       eth = layers.get(JSON_KEY_ETH, None)
-                       if eth is None:
-                               print "[ WARNING: eth data not found ]"
-                               continue
-                       # As this is a response to a DNS query, the IoT device is the destination.
-                       # Get the device MAC of that device.
-                       device_mac = eth.get(JSON_KEY_ETH_DST, None)
-                       if device_mac is None:
-                               print "[ WARNING: eth.dst data not found ]"
-                               continue
-                       # Get the router's timestamp for this packet
-                       # so that we can mark when the DNS mapping occurred
-                       timestamp = Decimal(layers[JSON_KEY_FRAME][JSON_KEY_FRAME_TIME_EPOCH])
-                       for ak in answers.keys():
-                               a = answers[ak]
-                               # We are looking for type A records as these are the ones that contain the IP.
-                               # Type A == type 1
-                               if a[JSON_KEY_DNS_RESP_TYPE] == "1":
-                                       # get the IP
-                                       ip = a[JSON_KEY_DNS_A]
-                                       # The answer may be the canonical name.
-                                       # Now trace back the answer stack, looking for any higher level aliases.
-                                       hostname = find_alias_hostname(answers, a[JSON_KEY_DNS_RESP_NAME])
-                                       # Create the tuple that indicates WHEN the ip to hostname mapping occurred
-                                       timestamp_hostname_tuple = (timestamp,hostname)
-                                       if device_mac in result:
-                                               # If we already have DNS data for the device with this MAC:
-                                               # Add the mapping to the DeviceDNSMap that is already present in the dict.
-                                               result[device_mac].add_mapping(ip, timestamp_hostname_tuple)
-                                       else:
-                                               # No DNS data for this device yet:
-                                               # Create a new DeviceDNSMap, add the mapping, and at it to the dict.
-                                               ddm = DeviceDNSMap(device_mac)
-                                               ddm.add_mapping(ip, timestamp_hostname_tuple)
-                                               result[device_mac] = ddm
-       return result
-
-# Recursively traverse set of answers trying to find the top most alias for a canonical name
-def find_alias_hostname(answers, hostname):
-       for ak in answers.keys():
-               a = answers[ak]
-               cname = a.get(JSON_KEY_DNS_CNAME, None)
-               # We only care about type=CNAME records
-               if cname is None:
-                       continue
-               if cname == hostname:
-                       # Located the right answer, perform recursive search for higher level aliases.
-                       return find_alias_hostname(answers, a[JSON_KEY_DNS_RESP_NAME])
-       return hostname
-
-if __name__ == '__main__':
-       main()
-
-# ================================================================================================
-# Notes/brainstorming how to do ip to host mappings.
-
-# Maps IPs to hostnames. Uses a dictionary of dictionaries.
-# IP lookup in the outer dictionary returns a dictionary that has hostnames as keys.
-# Looking up a hostname in the inner dictionary returns a set of timestamps.
-# Each timestamp indicate the time at which the IP<->hostname mapping was determined by a DNS query.
-# Note that the keyset of the inner dictionary will be of size 1 in most cases.
-# When this is the case, the value (the set of timestamps) can be ignored.
-# The values are only relevant when one IP maps to more than 1 hostname.
-# When this the case, the timestamps must be considered to find the most recent mapping.
-# ip_host_mappings = defaultdict(defaultdict(set))
-
-# ================================================================================================
\ No newline at end of file

diff --git a/parser/parse_inter_arrival_time.py b/parser/parse_inter_arrival_time.py
deleted file mode 100644 (file)
index 7fe6b9c..0000000
--- a/parser/parse_inter_arrival_time.py
+++ /dev/null
@@ -1,137 +0,0 @@
-#!/usr/bin/python
-
-"""
-Script that takes a file (output by wireshark/tshark, in JSON format) and analyze
-the packet inter-arrival times of a certain device at a certain time.
-"""
-
-import sys
-import json
-import numpy as np
-from collections import defaultdict
-from dateutil import parser
-from decimal import *
-
-JSON_KEY_SOURCE = "_source"
-JSON_KEY_LAYERS = "layers"
-
-JSON_KEY_ETH = "eth"
-JSON_KEY_ETH_DST = "eth.dst"
-JSON_KEY_ETH_SRC = "eth.src"
-JSON_KEY_FRAME = "frame"
-JSON_KEY_FRAME_TIME = "frame.time_epoch"
-TABLE_HEADER_X = "Packet number"
-TABLE_HEADER_Y = "Time (seconds)"
-INCOMING_APPENDIX = "_incoming"
-OUTGOING_APPENDIX = "_outgoing"
-FILE_APPENDIX = ".dat"
-
-
-def save_to_file(tblheader, timestamp_list, filenameout):
-    """ Show summary of statistics of PCAP file
-        Args:
-            tblheader: header for the saved table
-            dictionary: dictionary to be saved
-            filename_out: file name to save
-    """
-    # Appending, not overwriting!
-    f = open(filenameout, 'a')
-    # Write the table header
-    f.write("# " + tblheader + "\n")
-    f.write("# " + TABLE_HEADER_X + " " + TABLE_HEADER_Y + "\n")
-    # Write "0 0" if dictionary is empty
-    if not timestamp_list:
-        f.write("0 0")
-        f.close()
-        print "Writing zeroes to file: ", filenameout
-        return
-    ind = 0
-    # Iterate over list and write index-value pairs
-    for val in timestamp_list:
-        # Space separated
-        f.write(str(ind) + " " + str(timestamp_list[ind]) + "\n")
-        ind += 1
-    f.close()
-    print "Writing output to file: ", filenameout
-
-
-def main():
-    """ Main function
-    """
-    if len(sys.argv) < 5:
-        print "Usage: python", sys.argv[0], "<input_file> <output_file> <device_name> <mac_address>"
-        return
-    # Parse the file for the specified MAC address
-    timestamplist_incoming = parse_json(sys.argv[1], sys.argv[4], True)
-    timestamplist_outgoing = parse_json(sys.argv[1], sys.argv[4], False)
-    # Write statistics into file
-    print "====================================================================="
-    print "==> Analyzing incoming traffic ..."
-    save_to_file(sys.argv[3] + INCOMING_APPENDIX, timestamplist_incoming, sys.argv[2] + INCOMING_APPENDIX + FILE_APPENDIX)
-    print "====================================================================="
-    print "==> Analyzing outgoing traffic ..."
-    save_to_file(sys.argv[3] + OUTGOING_APPENDIX, timestamplist_outgoing, sys.argv[2] + OUTGOING_APPENDIX + FILE_APPENDIX)
-    print "====================================================================="
-
-
-# Convert JSON file containing DNS traffic to a map in which a hostname points to its set of associated IPs.
-def parse_json(filepath, macaddress, incomingoutgoing):
-    """ Show summary of statistics of PCAP file
-        Args:
-            filepath: path of the read file
-            macaddress: MAC address of a device to analyze
-    """
-    # Maps timestamps to frequencies of packets
-    timestamplist = list()
-    with open(filepath) as jf:
-        # Read JSON.
-        # data becomes reference to root JSON object (or in our case json array)
-        data = json.load(jf)
-        # Loop through json objects in data
-        # Each entry is a pcap entry (request/response (packet) and associated metadata)
-        # Preserve two pointers prev and curr to iterate over the timestamps
-        prev = None
-        curr = None
-        for p in data:
-            # p is a JSON object, not an index
-            layers = p[JSON_KEY_SOURCE][JSON_KEY_LAYERS]
-            # Get timestamp
-            frame = layers.get(JSON_KEY_FRAME, None)
-            timestamp = Decimal(frame.get(JSON_KEY_FRAME_TIME, None))
-            # Get into the Ethernet address part
-            eth = layers.get(JSON_KEY_ETH, None)
-            # Skip any non DNS traffic
-            if eth is None:
-                print "[ WARNING: Packet has no ethernet address! ]"
-                continue
-            # Get source and destination MAC addresses
-            src = eth.get(JSON_KEY_ETH_SRC, None)
-            dst = eth.get(JSON_KEY_ETH_DST, None)
-            # Get and count the traffic for the specified MAC address
-            if incomingoutgoing:
-                if dst == macaddress:
-                    # Check if timestamp already exists in the map
-                    # If yes, then just increment the frequency value...
-                    print str(timestamp) + " - src:" + str(src) + " - dest:" + str(dst)
-                    curr = timestamp
-                    if prev is not None:
-                        inter_arrival_time = curr - prev
-                        timestamplist.append(inter_arrival_time)
-                    prev = curr
-            else:
-                if src == macaddress:
-                    # Check if timestamp already exists in the map
-                    # If yes, then just increment the frequency value...
-                    print str(timestamp) + " - src:" + str(src) + " - dest:" + str(dst)
-                    curr = timestamp
-                    if prev is not None:
-                        inter_arrival_time = curr - prev
-                        timestamplist.append(inter_arrival_time)
-                    prev = curr
-
-    return timestamplist
-
-
-if __name__ == '__main__':
-    main()
-

diff --git a/parser/parse_packet_frequency.py b/parser/parse_packet_frequency.py
deleted file mode 100644 (file)
index d6ab9d4..0000000
--- a/parser/parse_packet_frequency.py
+++ /dev/null
@@ -1,296 +0,0 @@
-#!/usr/bin/python
-
-"""
-Script that takes a file (output by wireshark/tshark, in JSON format) and analyze
-the traffic frequency of a certain device at a certain time.
-"""
-
-import sys
-import json
-import numpy as np
-from collections import defaultdict
-from dateutil import parser
-from datetime import datetime
-from decimal import *
-
-JSON_KEY_SOURCE = "_source"
-JSON_KEY_LAYERS = "layers"
-
-JSON_KEY_ETH = "eth"
-JSON_KEY_ETH_DST = "eth.dst"
-JSON_KEY_ETH_SRC = "eth.src"
-JSON_KEY_FRAME = "frame"
-JSON_KEY_FRAME_TIME = "frame.time"
-JSON_KEY_FRAME_LEN = "frame.len"
-TABLE_HEADER_X = "Timestamp (hh:mm:ss)"
-TABLE_HEADER_Y = "Packet frequency"
-INCOMING_APPENDIX = "_incoming"
-OUTGOING_APPENDIX = "_outgoing"
-FILE_APPENDIX = ".dat"
-
-# Use this constant as a flag
-WINDOW_SIZE = 5
-USE_MOVING_AVERAGE = False
-USE_BINNING = True
-# Range = 6, i.e. 3 to left and 3 to right (in seconds)
-#TOTAL_RANGE = 60 # TOTAL_RANGE = 2 x RANGE
-#RANGE = 30
-TOTAL_RANGE = 20 # TOTAL_RANGE = 2 x RANGE
-RANGE = 10
-
-def moving_average(array, window=3):
-    """ Calculate moving average
-        Args:
-            array: array of numbers
-            window: window of moving average (default = 3)
-        Adapted from: 
-            https://stackoverflow.com/questions/14313510/how-to-calculate-moving-average-using-numpy
-    """
-    # Check if window > len(array)
-    if window > len(array):
-        window = len(array)
-    # Calculate cumulative sum of each array element
-    retarr = np.cumsum(array, dtype=float)
-    # Adjust cumulative sum of each array element
-    #   based on window size
-    retarr[window:] = retarr[window:] - retarr[:-window]
-    # Pad the first array elements with zeroes
-    retarr[:window - 1] = np.zeros(window - 1)
-    # Calculate moving average starting from the element
-    #   at window size, e.g. element 4 for window=5
-    retarr[window - 1:] = retarr[window - 1:] / window
-    return retarr
-
-def hms_to_seconds(t):
-    """ Calculate hms to seconds
-        Args:
-            t = time in hh:mm:ss string
-        Adapted from:
-            https://stackoverflow.com/questions/10742296/python-time-conversion-hms-to-seconds
-    """
-    h, m, s = [int(i) for i in t.split(':')]
-    return 3600*h + 60*m + s
-    
-def seconds_to_hms(t):
-    """ Calculate seconds to hms
-        Args:
-            t = time in seconds
-        Adapted from:
-            https://stackoverflow.com/questions/10742296/python-time-conversion-hms-to-seconds
-    """
-    h = t / 3600
-    m = (t - (h * 3600)) / 60
-    s = t - (h * 3600) - (m * 60)
-    hh = str(h)
-    if len(hh) is 1:
-        hh = "0" + hh
-    mm = str(m)
-    if len(mm) is 1:
-        mm = "0" + mm
-    ss = str(s) 
-    if len(ss) is 1:
-        ss = "0" + ss
-    return hh + ":" + mm + ":" + ss
-    
-def include_timestamps_zero_packets(timelen):
-    """ Include every second that has zero packets (no packets/transmission)
-        Args:
-            timelen = dictionary that maps timestamps to packet length
-    """
-    sortedkeylist = []
-    for key in sorted(timelen):
-        sortedkeylist.append(key)
-    first = sortedkeylist[0]
-    last = sortedkeylist[len(sortedkeylist)-1]
-    # Calculate the number of seconds between first and last packets
-    first_seconds = hms_to_seconds(first)
-    last_seconds = hms_to_seconds(last)
-    seconds = last_seconds - first_seconds
-    # Start counting and filling in timestamps with zero packets
-    counter = 0
-    while counter < seconds:
-        timestamp = seconds_to_hms(first_seconds + counter)
-        if timestamp not in timelen:
-            timelen[timestamp] = 0
-        counter += 1
-    return timelen
-    
-
-def save_to_file(tblheader, dictionary, filenameout):
-    """ Show summary of statistics of PCAP file
-        Args:
-            tblheader: header for the saved table
-            dictionary: dictionary to be saved
-            filename_out: file name to save
-    """
-    # Appending, not overwriting!
-    f = open(filenameout, 'a')
-    # Write the table header
-    f.write("# " + tblheader + "\n")
-    f.write("# " + TABLE_HEADER_X + " " + TABLE_HEADER_Y + "\n")
-    # Write "0 0" if dictionary is empty
-    if not dictionary:
-        f.write("0 0")
-        f.close()
-        print "Writing zeroes to file: ", filenameout
-        return
-
-    if USE_MOVING_AVERAGE:
-        # Use moving average if this flag is true
-        sortedarr = []
-        for key in sorted(dictionary):
-            sortedarr.append(dictionary[key])
-        valarr = moving_average(sortedarr, WINDOW_SIZE)
-        #print vallist
-        # Iterate over dictionary and write (key, value) pairs
-        ind = 0
-        for key in sorted(dictionary):
-            # Space separated
-            f.write(str(key) + " " + str(valarr[ind]) + "\n")
-            ind += 1
-
-    elif USE_BINNING:
-        sortedlist = []
-        # Iterate over dictionary and write (key, value) pairs
-        ind = 0
-        first = 0
-        last = 0
-        for key in sorted(dictionary):
-            sortedlist.append(key)
-            print "Key: ", key, " - Value: ", dictionary[key], " - Ind: ", ind
-            ind += 1
-        first = hms_to_seconds(sortedlist[0])
-        #print "First: ", key
-        last = hms_to_seconds(sortedlist[ind-1])
-        #print "Last: ", key
-        resultdict = dict()
-        # Put new binning keys
-        time_ind = first
-        ind = 0
-        while time_ind < last:
-            # Initialize with the first key in the list
-            curr_key = sortedlist[ind]
-            curr_key_secs = hms_to_seconds(curr_key)
-            # Initialize with 0 first
-            resultdict[time_ind] = 0
-            # Check if this is still within RANGE - bin the value if it is
-            while time_ind - RANGE <= curr_key_secs and curr_key_secs <= time_ind + RANGE:
-                resultdict[time_ind] += dictionary[curr_key]
-                print "Time index: ", seconds_to_hms(time_ind), " Value: ", resultdict[time_ind]
-                ind += 1
-                if ind > len(dictionary)-1:
-                    break
-                # Initialize with the key in the list
-                curr_key = sortedlist[ind]
-                curr_key_secs = hms_to_seconds(curr_key)
-            # Increment time index
-            time_ind += TOTAL_RANGE
-        # Now write to file after binning
-        for key in sorted(resultdict):
-            # Space separated
-            f.write(seconds_to_hms(key) + " " + str(resultdict[key]) + "\n")
-            #print seconds_to_hms(key) + " " + str(resultdict[key])
-
-    else:
-        # Iterate over dictionary and write (key, value) pairs
-        for key in sorted(dictionary):
-            # Space separated
-            f.write(str(key) + " " + str(dictionary[key]) + "\n")
-    f.close()
-    print "Writing output to file: ", filenameout
-
-
-def main():
-    """ Main function
-    """
-    if len(sys.argv) < 5:
-        print "Usage: python", sys.argv[0], "<input_file> <output_file> <device_name> <mac_address>"
-        return
-    # Parse the file for the specified MAC address
-    print "====================================================================="
-    print "Analyzing file: ", sys.argv[1]
-    timelen_incoming = parse_json(sys.argv[1], sys.argv[4], True)
-    if len(timelen_incoming) > 0:
-        timelen_incoming = include_timestamps_zero_packets(timelen_incoming)
-        print "==> Printing incoming traffic ..."
-        save_to_file(sys.argv[3] + INCOMING_APPENDIX, timelen_incoming, sys.argv[2] + INCOMING_APPENDIX + FILE_APPENDIX)
-    else:
-        print "No incoming traffic to this MAC address!"
-    print "====================================================================="
-    timelen_outgoing = parse_json(sys.argv[1], sys.argv[4], False)
-    if len(timelen_outgoing) > 0:
-        timelen_outgoing = include_timestamps_zero_packets(timelen_outgoing)
-        print "==> Printing outgoing traffic ..."
-        save_to_file(sys.argv[3] + OUTGOING_APPENDIX, timelen_outgoing, sys.argv[2] + OUTGOING_APPENDIX + FILE_APPENDIX)
-    else:
-        print "No outgoing traffic from this MAC address!"
-    print "====================================================================="
-    #for time in time_freq.keys():
-    #for key in sorted(time_freq):
-    #    print key, " => ", time_freq[key]
-    #print "====================================================================="
-
-
-# Convert JSON file containing DNS traffic to a map in which a hostname points to its set of associated IPs.
-def parse_json(filepath, macaddress, incomingoutgoing):
-    """ Show summary of statistics of PCAP file
-        Args:
-            filepath: path of the read file
-            macaddress: MAC address of a device to analyze
-            incomingoutgoing: boolean to define whether we collect incoming or outgoing traffic
-                              True = incoming, False = outgoing
-    """
-    # Maps timestamps to lengths of packets
-    timelen = dict()
-    with open(filepath) as jf:
-        # Read JSON.
-        # data becomes reference to root JSON object (or in our case json array)
-        data = json.load(jf)
-        # Loop through json objects in data
-        # Each entry is a pcap entry (request/response (packet) and associated metadata)
-        for p in data:
-            # p is a JSON object, not an index
-            layers = p[JSON_KEY_SOURCE][JSON_KEY_LAYERS]
-            # Get timestamp
-            frame = layers.get(JSON_KEY_FRAME, None)
-            datetime = frame.get(JSON_KEY_FRAME_TIME, None)
-            # Get frame length
-            length = frame.get(JSON_KEY_FRAME_LEN, None)
-            # Get into the Ethernet address part
-            eth = layers.get(JSON_KEY_ETH, None)
-            # Skip any non DNS traffic
-            if eth is None:
-                print "[ WARNING: Packet has no ethernet address! ]"
-                continue
-            # Get source and destination MAC addresses
-            src = eth.get(JSON_KEY_ETH_SRC, None)
-            dst = eth.get(JSON_KEY_ETH_DST, None)
-            # Get just the time part
-            datetimeobj = parser.parse(datetime)
-            # Remove the microsecond part
-            timestr = str(datetimeobj.time())[:8]
-            #print str(timestr) + " - src:" + str(src) + " - dest:" + str(dst) + " - length: ", length
-            # Get and count the traffic for the specified MAC address
-            if incomingoutgoing:           
-                if dst == macaddress:
-                    # Check if timestamp already exists in the map
-                    # If yes, then just increment the frequency value...
-                    if timestr in timelen:
-                        timelen[timestr] = timelen[timestr] + int(length)
-                    else: # If not, then put the value one there
-                        timelen[timestr] = int(length)
-            else:
-                if src == macaddress:
-                    # Check if timestamp already exists in the map
-                    # If yes, then just increment the frequency value...
-                    if timestr in timelen:
-                        timelen[timestr] = timelen[timestr] + int(length)
-                    else: # If not, then put the value one there
-                        timelen[timestr] = int(length)
-
-    return timelen
-
-
-if __name__ == '__main__':
-    main()
-

diff --git a/parser/parse_packet_size.py b/parser/parse_packet_size.py
deleted file mode 100644 (file)
index 84cc107..0000000
--- a/parser/parse_packet_size.py
+++ /dev/null
@@ -1,128 +0,0 @@
-#!/usr/bin/python
-
-"""
-Script that takes a file (output by wireshark/tshark, in JSON format) and analyze
-the variety of packet sizes of a certain device at a certain time.
-"""
-
-import sys
-import json
-import numpy as np
-from collections import defaultdict
-from dateutil import parser
-
-JSON_KEY_SOURCE = "_source"
-JSON_KEY_LAYERS = "layers"
-
-JSON_KEY_ETH = "eth"
-JSON_KEY_ETH_DST = "eth.dst"
-JSON_KEY_ETH_SRC = "eth.src"
-JSON_KEY_FRAME = "frame"
-JSON_KEY_FRAME_TIME = "frame.time"
-JSON_KEY_FRAME_LENGTH = "frame.len"
-TABLE_HEADER_X = "Timestamp (hh:mm:ss)"
-TABLE_HEADER_Y = "Packet sizes (bytes)"
-INCOMING_APPENDIX = "_incoming"
-OUTGOING_APPENDIX = "_outgoing"
-FILE_APPENDIX = ".dat"
-
-
-def save_to_file(tblheader, dictionary, filenameout):
-    """ Show summary of statistics of PCAP file
-        Args:
-            tblheader: header for the saved table
-            dictionary: dictionary to be saved
-            filename_out: file name to save
-    """
-    # Appending, not overwriting!
-    f = open(filenameout, 'a')
-    # Write the table header
-    f.write("# " + tblheader + "\n")
-    f.write("# " + TABLE_HEADER_X + " " + TABLE_HEADER_Y + "\n")
-    # Write "0 0" if dictionary is empty
-    if not dictionary:
-        f.write("0 0")
-        f.close()
-        print "Writing zeroes to file: ", filenameout
-        return
-
-    # Iterate over dictionary and write (key, value) pairs
-    for key in sorted(dictionary):
-        # Space separated
-        f.write(str(key) + " " + str(dictionary[key]) + "\n")
-    f.close()
-    print "Writing output to file: ", filenameout
-
-
-def main():
-    """ Main function
-    """
-    if len(sys.argv) < 5:
-        print "Usage: python", sys.argv[0], "<input_file> <output_file> <device_name> <mac_address>"
-        return
-    # Parse the file for the specified MAC address
-    timefreq_incoming = parse_json(sys.argv[1], sys.argv[4], True)
-    timefreq_outgoing = parse_json(sys.argv[1], sys.argv[4], False)
-    # Write statistics into file
-    print "====================================================================="
-    print "==> Analyzing incoming traffic ..."
-    save_to_file(sys.argv[3] + INCOMING_APPENDIX, timefreq_incoming, sys.argv[2] + INCOMING_APPENDIX + FILE_APPENDIX)
-    print "====================================================================="
-    print "==> Analyzing outgoing traffic ..."
-    save_to_file(sys.argv[3] + OUTGOING_APPENDIX, timefreq_outgoing, sys.argv[2] + OUTGOING_APPENDIX + FILE_APPENDIX)
-    print "====================================================================="
-
-
-# Convert JSON file containing DNS traffic to a map in which a hostname points to its set of associated IPs.
-def parse_json(filepath, macaddress, incomingoutgoing):
-    """ Show summary of statistics of PCAP file
-        Args:
-            filepath: path of the read file
-            macaddress: MAC address of a device to analyze
-            incomingoutgoing: boolean to define whether we collect incoming or outgoing traffic
-                              True = incoming, False = outgoing
-    """
-    # Maps timestamps to frequencies of packets
-    packetsize = dict()
-    with open(filepath) as jf:
-        # Read JSON.
-        # data becomes reference to root JSON object (or in our case json array)
-        data = json.load(jf)
-        # Loop through json objects in data
-        # Each entry is a pcap entry (request/response (packet) and associated metadata)
-        for p in data:
-            # p is a JSON object, not an index
-            layers = p[JSON_KEY_SOURCE][JSON_KEY_LAYERS]
-            # Get timestamp
-            frame = layers.get(JSON_KEY_FRAME, None)
-            datetime = frame.get(JSON_KEY_FRAME_TIME, None)
-            length = frame.get(JSON_KEY_FRAME_LENGTH, None)
-            # Get into the Ethernet address part
-            eth = layers.get(JSON_KEY_ETH, None)
-            # Skip any non DNS traffic
-            if eth is None:
-                print "[ WARNING: Packet has no ethernet address! ]"
-                continue
-            # Get source and destination MAC addresses
-            src = eth.get(JSON_KEY_ETH_SRC, None)
-            dst = eth.get(JSON_KEY_ETH_DST, None)
-            # Get just the time part
-            datetimeobj = parser.parse(datetime)
-            timestr = str(datetimeobj.time())
-            print str(timestr) + " - src:" + str(src) + " - dest:" + str(dst)
-            # Get and count the traffic for the specified MAC address
-            if incomingoutgoing:           
-                if dst == macaddress:
-                    # Put the time frequency in the dictionary
-                    packetsize[timestr] = length
-            else:
-                if src == macaddress:
-                    # Put the time frequency in the dictionary
-                    packetsize[timestr] = length
-
-    return packetsize
-
-
-if __name__ == '__main__':
-    main()
-

diff --git a/parser/parse_packet_total_bytes.py b/parser/parse_packet_total_bytes.py
deleted file mode 100644 (file)
index 7acb21b..0000000
--- a/parser/parse_packet_total_bytes.py
+++ /dev/null
@@ -1,184 +0,0 @@
-#!/usr/bin/python
-
-"""
-Script that takes a file (output by wireshark/tshark, in JSON format) and analyze
-the traffic total bytes of a certain device at a certain time.
-"""
-
-import sys
-import json
-import numpy as np
-from collections import defaultdict
-from dateutil import parser
-from decimal import *
-
-JSON_KEY_SOURCE = "_source"
-JSON_KEY_LAYERS = "layers"
-
-JSON_KEY_ETH = "eth"
-JSON_KEY_ETH_DST = "eth.dst"
-JSON_KEY_ETH_SRC = "eth.src"
-JSON_KEY_FRAME = "frame"
-JSON_KEY_FRAME_TIME = "frame.time"
-JSON_KEY_FRAME_LENGTH = "frame.len"
-TABLE_HEADER_X = "Timestamp (hh:mm:ss)"
-TABLE_HEADER_Y = "Total bytes (bytes)"
-INCOMING_APPENDIX = "_incoming"
-OUTGOING_APPENDIX = "_outgoing"
-FILE_APPENDIX = ".dat"
-
-# Use this constant as a flag
-WINDOW_SIZE = 5
-USE_MOVING_AVERAGE = False
-
-
-def moving_average(array, window=3):
-    """ Calculate moving average
-        Args:
-            array: array of numbers
-            window: window of moving average (default = 3)
-        Adapted from: 
-            https://stackoverflow.com/questions/14313510/how-to-calculate-moving-average-using-numpy
-    """
-    # Check if window > len(array)
-    if window > len(array):
-        window = len(array)
-    # Calculate cumulative sum of each array element
-    retarr = np.cumsum(array, dtype=float)
-    # Adjust cumulative sum of each array element
-    #   based on window size
-    retarr[window:] = retarr[window:] - retarr[:-window]
-    # Pad the first array elements with zeroes
-    retarr[:window - 1] = np.zeros(window - 1)
-    # Calculate moving average starting from the element
-    #   at window size, e.g. element 4 for window=5
-    retarr[window - 1:] = retarr[window - 1:] / window
-    return retarr
-
-
-def save_to_file(tblheader, dictionary, filenameout):
-    """ Show summary of statistics of PCAP file
-        Args:
-            tblheader: header for the saved table
-            dictionary: dictionary to be saved
-            filename_out: file name to save
-    """
-    # Appending, not overwriting!
-    f = open(filenameout, 'a')
-    # Write the table header
-    f.write("# " + tblheader + "\n")
-    f.write("# " + TABLE_HEADER_X + " " + TABLE_HEADER_Y + "\n")
-    # Write "0 0" if dictionary is empty
-    if not dictionary:
-        f.write("0 0")
-        f.close()
-        print "Writing zeroes to file: ", filenameout
-        return
-
-    if USE_MOVING_AVERAGE:
-        # Use moving average if this flag is true
-        sortedarr = []
-        for key in sorted(dictionary):
-            sortedarr.append(dictionary[key])
-        valarr = moving_average(sortedarr, WINDOW_SIZE)
-        #print vallist
-        # Iterate over dictionary and write (key, value) pairs
-        ind = 0
-        for key in sorted(dictionary):
-            # Space separated
-            f.write(str(key) + " " + str(valarr[ind]) + "\n")
-            ind += 1
-    else:
-        # Iterate over dictionary and write (key, value) pairs
-        for key in sorted(dictionary):
-            # Space separated
-            f.write(str(key) + " " + str(dictionary[key]) + "\n")
-    f.close()
-    print "Writing output to file: ", filenameout
-
-
-def main():
-    """ Main function
-    """
-    if len(sys.argv) < 5:
-        print "Usage: python", sys.argv[0], "<input_file> <output_file> <device_name> <mac_address>"
-        return
-    # Parse the file for the specified MAC address
-    timefreq_incoming = parse_json(sys.argv[1], sys.argv[4], True)
-    timefreq_outgoing = parse_json(sys.argv[1], sys.argv[4], False)
-    # Write statistics into file
-    print "====================================================================="
-    print "==> Analyzing incoming traffic ..."
-    save_to_file(sys.argv[3] + INCOMING_APPENDIX, timefreq_incoming, sys.argv[2] + INCOMING_APPENDIX + FILE_APPENDIX)
-    print "====================================================================="
-    print "==> Analyzing outgoing traffic ..."
-    save_to_file(sys.argv[3] + OUTGOING_APPENDIX, timefreq_outgoing, sys.argv[2] + OUTGOING_APPENDIX + FILE_APPENDIX)
-    print "====================================================================="
-    #for time in time_freq.keys():
-    #for key in sorted(time_freq):
-    #    print key, " => ", time_freq[key]
-    #print "====================================================================="
-
-
-# Convert JSON file containing DNS traffic to a map in which a hostname points to its set of associated IPs.
-def parse_json(filepath, macaddress, incomingoutgoing):
-    """ Show summary of statistics of PCAP file
-        Args:
-            filepath: path of the read file
-            macaddress: MAC address of a device to analyze
-            incomingoutgoing: boolean to define whether we collect incoming or outgoing traffic
-                              True = incoming, False = outgoing
-    """
-    # Maps timestamps to frequencies of packets
-    packetbytes = dict()
-    with open(filepath) as jf:
-        # Read JSON.
-        # data becomes reference to root JSON object (or in our case json array)
-        data = json.load(jf)
-        # Loop through json objects in data
-        # Each entry is a pcap entry (request/response (packet) and associated metadata)
-        for p in data:
-            # p is a JSON object, not an index
-            layers = p[JSON_KEY_SOURCE][JSON_KEY_LAYERS]
-            # Get timestamp
-            frame = layers.get(JSON_KEY_FRAME, None)
-            datetime = frame.get(JSON_KEY_FRAME_TIME, None)
-            bytes = frame.get(JSON_KEY_FRAME_LENGTH, None)
-            # Get into the Ethernet address part
-            eth = layers.get(JSON_KEY_ETH, None)
-            # Skip any non DNS traffic
-            if eth is None:
-                print "[ WARNING: Packet has no ethernet address! ]"
-                continue
-            # Get source and destination MAC addresses
-            src = eth.get(JSON_KEY_ETH_SRC, None)
-            dst = eth.get(JSON_KEY_ETH_DST, None)
-            # Get just the time part
-            datetimeobj = parser.parse(datetime)
-            # Remove the microsecond part
-            timestr = str(datetimeobj.time())[:8]
-            print str(timestr) + " - src:" + str(src) + " - dest:" + str(dst)
-            # Get and count the traffic for the specified MAC address
-            if incomingoutgoing:           
-                if dst == macaddress:
-                    # Check if timestamp already exists in the map
-                    # If yes, then just accumulate the value
-                    if timestr in packetbytes:
-                        packetbytes[timestr] = packetbytes[timestr] + Decimal(bytes)
-                    else: # If not, then put the value there
-                        packetbytes[timestr] = Decimal(bytes)
-            else:
-                if src == macaddress:
-                    # Check if timestamp already exists in the map
-                    # If yes, then just accumulate the value
-                    if timestr in packetbytes:
-                        packetbytes[timestr] = packetbytes[timestr] + Decimal(bytes)
-                    else: # If not, then put the value there
-                        packetbytes[timestr] = Decimal(bytes)
-
-    return packetbytes
-
-
-if __name__ == '__main__':
-    main()
-

diff --git a/plot_scripts/plot_ia_graph b/plot_scripts/plot_ia_graph
deleted file mode 100644 (file)
index 848f242..0000000
--- a/plot_scripts/plot_ia_graph
+++ /dev/null
@@ -1,36 +0,0 @@
-# Script to plot inter-arrival timestamp graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Fall 2017
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-#set terminal postscript landscape "Arial, 18"
-#set terminal postscript eps font 'Helvetica,20' enhanced color 
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-unset key
-unset log
-unset label
-set xtics auto
-set ytics auto
-set xlabel "Packet Number"
-set ylabel "Time (seconds)"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo switch
-#set output '../result_ia/wemo_switch_incoming.ps'
-#set output '../result_ia/wemo_switch_incoming.eps'
-set output '../result_ia/wemo_switch_inter_arrival_incoming.png'
-set title "WeMo Switch Inter-Arrival Incoming Traffic"
-plot "../result_ia/wemo_switch_incoming.dat" using 1:2 with lines
-set output '../result_ia/wemo_switch_inter_arrival_outgoing.png'
-set title "WeMo Switch Inter-Arrival Outgoing Traffic"
-plot "../result_ia/wemo_switch_outgoing.dat" using 1:2 with lines
-

diff --git a/plot_scripts/plot_ps_graph b/plot_scripts/plot_ps_graph
deleted file mode 100644 (file)
index 600cc50..0000000
--- a/plot_scripts/plot_ps_graph
+++ /dev/null
@@ -1,40 +0,0 @@
-# Script to plot packet size graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Fall 2017
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-#set terminal postscript landscape "Arial, 18"
-#set terminal postscript eps font 'Helvetica,20' enhanced color 
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-unset key
-unset log
-unset label
-set xtics 600
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-#set xrange ["06:00:00":"10:00:00"]
-#set yrange [0:200]
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo switch
-#set output '../result_ps/wemo_switch_incoming.ps'
-#set output '../result_ps/wemo_switch_incoming.eps'
-set output '../result_ps/wemo_switch_packet_size_incoming.png'
-set title "WeMo Switch Packet Size Incoming Traffic"
-plot "../result_ps/wemo_switch_incoming.dat" using 1:2
-set output '../result_ps/wemo_switch_packet_size_outgoing.png'
-set title "WeMo Switch Packet Size Outgoing Traffic"
-plot "../result_ps/wemo_switch_outgoing.dat" using 1:2
-

diff --git a/plot_scripts/plot_tb_graph b/plot_scripts/plot_tb_graph
deleted file mode 100644 (file)
index 0d3e155..0000000
--- a/plot_scripts/plot_tb_graph
+++ /dev/null
@@ -1,41 +0,0 @@
-# Script to plot total bytes graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Fall 2017
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-#set terminal postscript landscape "Arial, 18"
-#set terminal postscript eps font 'Helvetica,20' enhanced color 
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-unset key
-unset log
-unset label
-set logscale y 2
-set xtics 600
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Bytes (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-#set xrange ["06:00:00":"10:00:00"]
-#set yrange [0:200]
-set xrange [:]
-set yrange [1:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo switch
-#set output '../result_tb/wemo_switch_incoming.ps'
-#set output '../result_tb/wemo_switch_incoming.eps'
-set output '../result_tb/wemo_switch_packet_size_incoming.png'
-set title "WeMo Switch Total Bytes Incoming Traffic"
-plot "../result_tb/wemo_switch_incoming.dat" using 1:2 with lines
-set output '../result_tb/wemo_switch_packet_size_outgoing.png'
-set title "WeMo Switch Total Bytes Outgoing Traffic"
-plot "../result_tb/wemo_switch_outgoing.dat" using 1:2 with lines
-

diff --git a/plot_scripts/plot_ts_graph b/plot_scripts/plot_ts_graph
deleted file mode 100644 (file)
index bd5e31f..0000000
--- a/plot_scripts/plot_ts_graph
+++ /dev/null
@@ -1,195 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Fall 2017
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-#set terminal postscript landscape "Arial, 18"
-#set terminal postscript eps font 'Helvetica,20' enhanced color 
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-unset key
-unset log
-unset label
-set xtics 600
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Frequency (pps)"
-set xdata time
-set timefmt "%H:%M:%S"
-#set xrange ["06:00:00":"10:00:00"]
-#set yrange [0:200]
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo switch
-#set output '../result_ts/wemo_switch_incoming.ps'
-#set output '../result_ts/wemo_switch_incoming.eps'
-set output '../result_ts/wemo_switch_timestamp_incoming.png'
-set title "WeMo Switch Incoming Traffic"
-plot "../result_ts/wemo_switch_incoming.dat" using 1:2 with lines
-set output '../result_ts/wemo_switch_timestamp_outgoing.png'
-set title "WeMo Switch Outgoing Traffic"
-plot "../result_ts/wemo_switch_outgoing.dat" using 1:2 with lines
-
-
-# WeMo Insight
-#set output '../result_ts/wemo_insight_incoming.eps'
-set output '../result_ts/wemo_insight_timestamp_incoming.png'
-set title "WeMo Insight Incoming Traffic"
-plot "../result_ts/wemo_insight_incoming.dat" using 1:2 with lines
-set output '../result_ts/wemo_insight_timestamp_outgoing.png'
-set title "WeMo Insight Outgoing Traffic"
-plot "../result_ts/wemo_insight_outgoing.dat" using 1:2 with lines
-
-# TP-Link switch
-#set output '../result_ts/tplink_switch_incoming.eps'
-set output '../result_ts/tplink_switch_timestamp_incoming.png'
-set title "TP-Link Switch Incoming Traffic"
-plot "../result_ts/tplink_switch_incoming.dat" using 1:2 with lines
-set output '../result_ts/tplink_switch_timestamp_outgoing.png'
-set title "TP-Link Switch Outgoing Traffic"
-plot "../result_ts/tplink_switch_outgoing.dat" using 1:2 with lines
-
-# D-Link switch
-#set output '../result_ts/dlink_switch_incoming.eps'
-set output '../result_ts/dlink_switch_timestamp_incoming.png'
-set title "D-Link Switch Incoming Traffic"
-plot "../result_ts/dlink_switch_incoming.dat" using 1:2 with lines
-set output '../result_ts/dlink_switch_timestamp_outgoing.png'
-set title "D-Link Switch Outgoing Traffic"
-plot "../result_ts/dlink_switch_outgoing.dat" using 1:2 with lines
-
-
-# Amcrest camera
-#set output '../result_ts/amcrest_camera_incoming.eps'
-set output '../result_ts/amcrest_camera_timestamp_incoming.png'
-set title "Amcrest Camera Incoming Traffic"
-plot "../result_ts/amcrest_camera_incoming.dat" using 1:2 with lines
-set output '../result_ts/amcrest_camera_timestamp_outgoing.png'
-set title "Amcrest Camera Outgoing Traffic"
-plot "../result_ts/amcrest_camera_outgoing.dat" using 1:2 with lines
-
-# Netgear Arlo camera
-#set output '../result_ts/netgear_arlo_camera_incoming.eps'
-set output '../result_ts/netgear_arlo_camera_timestamp_incoming.png'
-set title "Netgear Arlo Camera Incoming Traffic"
-plot "../result_ts/netgear_arlo_camera_incoming.dat" using 1:2 with lines
-set output '../result_ts/netgear_arlo_camera_timestamp_outgoing.png'
-set title "Netgear Arlo Camera Outgoing Traffic"
-plot "../result_ts/netgear_arlo_camera_outgoing.dat" using 1:2 with lines
-
-# LiFX light bulb
-#set output '../result_ts/lifx_lightbulb_1_incoming.eps'
-set output '../result_ts/lifx_lightbulb_1_timestamp_incoming.png'
-set title "LiFX Light Bulb #1 Incoming Traffic"
-plot "../result_ts/lifx_lightbulb_1_incoming.dat" using 1:2 with lines
-set output '../result_ts/lifx_lightbulb_1_timestamp_outgoing.png'
-set title "LiFX Light Bulb #1 Outgoing Traffic"
-plot "../result_ts/lifx_lightbulb_1_outgoing.dat" using 1:2 with lines
-
-# LiFX light bulb
-#set output '../result_ts/lifx_lightbulb_2_incoming.eps'
-set output '../result_ts/lifx_lightbulb_2_timestamp_incoming.png'
-set title "LiFX Light Bulb #2 Incoming Traffic"
-plot "../result_ts/lifx_lightbulb_2_incoming.dat" using 1:2 with lines
-set output '../result_ts/lifx_lightbulb_2_timestamp_outgoing.png'
-set title "LiFX Light Bulb #2 Outgoing Traffic"
-plot "../result_ts/lifx_lightbulb_2_outgoing.dat" using 1:2 with lines
-
-# Philips Hue
-#set output '../result_ts/philips_hue_incoming.eps'
-set output '../result_ts/philips_hue_timestamp_incoming.png'
-set title "Philips Hue Incoming Traffic"
-plot "../result_ts/philips_hue_incoming.dat" using 1:2 with lines
-set output '../result_ts/philips_hue_timestamp_outgoing.png'
-set title "Philips Hue Outgoing Traffic"
-plot "../result_ts/philips_hue_outgoing.dat" using 1:2 with lines
-
-# TP-Link Light Bulb
-#set output '../result_ts/tplink_lightbulb_incoming.eps'
-set output '../result_ts/tplink_lightbulb_timestamp_incoming.png'
-set title "TP-Link Light Bulb Incoming Traffic"
-plot "../result_ts/tplink_lightbulb_incoming.dat" using 1:2 with lines
-set output '../result_ts/tplink_lightbulb_timestamp_outgoing.png'
-set title "TP-Link Light Bulb Outgoing Traffic"
-plot "../result_ts/tplink_lightbulb_outgoing.dat" using 1:2 with lines
-
-# Nxeco sprinkler
-#set output '../result_ts/nxeco_sprinkler_incoming.eps'
-set output '../result_ts/nxeco_sprinkler_timestamp_incoming.png'
-set title "Nxeco Sprinkler Incoming Traffic"
-plot "../result_ts/nxeco_sprinkler_incoming.dat" using 1:2 with lines
-set output '../result_ts/nxeco_sprinkler_timestamp_outgoing.png'
-set title "Nxeco Sprinkler Outgoing Traffic"
-plot "../result_ts/nxeco_sprinkler_outgoing.dat" using 1:2 with lines
-
-# Blossom sprinkler
-#set output '../result_ts/blossom_sprinkler_incoming.eps'
-set output '../result_ts/blossom_sprinkler_timestamp_incoming.png'
-set title "Blossom Sprinkler Incoming Traffic"
-plot "../result_ts/blossom_sprinkler_incoming.dat" using 1:2 with lines
-set output '../result_ts/blossom_sprinkler_timestamp_outgoing.png'
-set title "Blossom Sprinkler Outgoing Traffic"
-plot "../result_ts/blossom_sprinkler_outgoing.dat" using 1:2 with lines
-
-# D-Link alarm
-#set output '../result_ts/dlink_alarm_incoming.eps'
-set output '../result_ts/dlink_alarm_timestamp_incoming.png'
-set title "D-Link Alarm Incoming Traffic"
-plot "../result_ts/dlink_alarm_incoming.dat" using 1:2 with lines
-set output '../result_ts/dlink_alarm_timestamp_outgoing.png'
-set title "D-Link Alarm Outgoing Traffic"
-plot "../result_ts/dlink_alarm_outgoing.dat" using 1:2 with lines
-
-# D-Link alarm
-#set output '../result_ts/dlink_alarm_incoming.eps'
-set output '../result_ts/dlink_alarm_timestamp_incoming.png'
-set title "D-Link Alarm Incoming Traffic"
-plot "../result_ts/dlink_alarm_incoming.dat" using 1:2 with lines
-set output '../result_ts/dlink_alarm_timestamp_outgoing.png'
-set title "D-Link Alarm Outgoing Traffic"
-plot "../result_ts/dlink_alarm_outgoing.dat" using 1:2 with lines
-
-# D-Link motion sensor
-#set output '../result_ts/dlink_motion_sensor_incoming.eps'
-set output '../result_ts/dlink_motion_sensor_timestamp_incoming.png'
-set title "D-Link Motion Sensor Incoming Traffic"
-plot "../result_ts/dlink_motion_sensor_incoming.dat" using 1:2 with lines
-set output '../result_ts/dlink_motion_sensor_timestamp_outgoing.png'
-set title "D-Link Motion Sensor Outgoing"
-plot "../result_ts/dlink_motion_sensor_outgoing.dat" using 1:2 with lines
-
-# Nest Thermostat
-#set output '../result_ts/nest_thermostat_incoming.eps'
-set output '../result_ts/nest_thermostat_timestamp_incoming.png'
-set title "Nest Thermostat Incoming Traffic"
-plot "../result_ts/nest_thermostat_incoming.dat" using 1:2 with lines
-set output '../result_ts/nest_thermostat_timestamp_outgoing.png'
-set title "Nest Thermostat Outgoing Traffic"
-plot "../result_ts/nest_thermostat_outgoing.dat" using 1:2 with lines
-
-# Amazon Echo Dot
-#set output '../result_ts/amazon_echo_dot_incoming.eps'
-set output '../result_ts/amazon_echo_dot_timestamp_incoming.png'
-set title "Amazon Echo Dot Incoming Traffic"
-plot "../result_ts/amazon_echo_dot_incoming.dat" using 1:2 with lines
-set output '../result_ts/amazon_echo_dot_timestamp_outgoing.png'
-set title "Amazon Echo Dot Outgoing Traffic"
-plot "../result_ts/amazon_echo_dot_outgoing.dat" using 1:2 with lines
-
-# SmartThings hub
-#set output '../result_ts/smartthings_hub_incoming.eps'
-set output '../result_ts/smartthings_hub_timestamp_incoming.png'
-set title "SmartThings Hub Incoming Traffic"
-plot "../result_ts/smartthings_hub_incoming.dat" using 1:2 with lines
-set output '../result_ts/smartthings_hub_timestamp_outgoing.png'
-set title "SmartThings Hub Outgoing Traffic"
-plot "../result_ts/smartthings_hub_outgoing.dat" using 1:2 with lines
-

diff --git a/plot_scripts/plot_ts_graph_dlink b/plot_scripts/plot_ts_graph_dlink
deleted file mode 100644 (file)
index b79406c..0000000
--- a/plot_scripts/plot_ts_graph_dlink
+++ /dev/null
@@ -1,68 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-unset key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# DLink switch local
-# eth0
-set output './result/dlink_switch_eth_timestamp_local_incoming.png'
-set title "DLink Switch Incoming Local Traffic (eth0)"
-plot "./result/dlink_switch_eth_local_incoming.dat" using 1:2 with lines
-set output './result/dlink_switch_eth_timestamp_local_outgoing.png'
-set title "DLink Switch Outgoing Local Traffic (eth0)"
-plot "./result/dlink_switch_eth_local_outgoing.dat" using 1:2 with lines
-# wlan1
-set output './result/dlink_switch_wlan_timestamp_local_incoming.png'
-set title "DLink Switch Incoming Local Traffic (wlan1)"
-plot "./result/dlink_switch_wlan_local_incoming.dat" using 1:2 with lines
-set output './result/dlink_switch_wlan_timestamp_local_outgoing.png'
-set title "DLink Switch Outgoing Local Traffic (wlan1)"
-plot "./result/dlink_switch_wlan_local_outgoing.dat" using 1:2 with lines
-
-# DLink switch remote
-# eth0
-set output './result/dlink_switch_eth_timestamp_remote_incoming.png'
-set title "DLink Switch Incoming Remote Traffic (eth0)"
-plot "./result/dlink_switch_eth_remote_incoming.dat" using 1:2 with lines
-set output './result/dlink_switch_eth_timestamp_remote_outgoing.png'
-set title "DLink Switch Outgoing Remote Traffic (eth0)"
-plot "./result/dlink_switch_eth_remote_outgoing.dat" using 1:2 with lines
-# wlan1
-set output './result/dlink_switch_wlan_timestamp_remote_incoming.png'
-set title "DLink Switch Incoming Remote Traffic (wlan1)"
-plot "./result/dlink_switch_wlan_remote_incoming.dat" using 1:2 with lines
-set output './result/dlink_switch_wlan_timestamp_remote_outgoing.png'
-set title "DLink Switch Outgoing Remote Traffic (wlan1)"
-plot "./result/dlink_switch_wlan_remote_outgoing.dat" using 1:2 with lines
-
-# DLink phone local
-# wlan1
-set output './result/dlink_phone_wlan_timestamp_local_incoming.png'
-set title "DLink Phone Incoming Local Traffic (wlan1)"
-plot "./result/dlink_phone_wlan_local_incoming.dat" using 1:2 with lines
-set output './result/dlink_phone_wlan_timestamp_local_outgoing.png'
-set title "DLink Phone Outgoing Local Traffic (wlan1)"
-plot "./result/dlink_phone_wlan_local_outgoing.dat" using 1:2 with lines
-

diff --git a/plot_scripts/plot_ts_graph_dlink_combined b/plot_scripts/plot_ts_graph_dlink_combined
deleted file mode 100644 (file)
index 84b2439..0000000
--- a/plot_scripts/plot_ts_graph_dlink_combined
+++ /dev/null
@@ -1,44 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-set key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# DLink switch local
-# wlan1 / eth0
-set output './result/dlink_switch_wlan_timestamp_local_incoming_combined.png'
-set title "DLink Switch Incoming Local Traffic (wlan1/eth0)"
-plot "./result/dlink_switch_wlan_local_incoming.dat" using 1:2 with lines title "wlan1", "./result/dlink_switch_eth_local_incoming.dat" using 1:2 with lines title "eth0", "./result/dlink_phone_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/dlink_phone_wlan_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-set output './result/dlink_switch_wlan_timestamp_local_outgoing_combined.png'
-set title "DLink Switch Outgoing Local Traffic (wlan1/eth0)"
-plot "./result/dlink_switch_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1", "./result/dlink_switch_eth_local_outgoing.dat" using 1:2 with lines title "eth0", "./result/dlink_phone_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/dlink_phone_wlan_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-
-# DLink switch remote
-# wlan1
-set output './result/dlink_switch_wlan_timestamp_remote_incoming_combined.png'
-set title "DLink Switch Incoming Remote Traffic (wlan1/eth0)"
-plot "./result/dlink_switch_wlan_remote_incoming.dat" using 1:2 with lines title "wlan1", "./result/dlink_switch_eth_remote_incoming.dat" using 1:2 with lines title "eth0"
-set output './result/dlink_switch_wlan_timestamp_remote_outgoing_combined.png'
-set title "DLink Switch Outgoing Remote Traffic (wlan1/eth0)"
-plot "./result/dlink_switch_wlan_remote_outgoing.dat" using 1:2 with lines title "wlan1", "./result/dlink_switch_eth_remote_outgoing.dat" using 1:2 with lines title "eth0"

diff --git a/plot_scripts/plot_ts_graph_dlink_labeled b/plot_scripts/plot_ts_graph_dlink_labeled
deleted file mode 100644 (file)
index 7f865cc..0000000
--- a/plot_scripts/plot_ts_graph_dlink_labeled
+++ /dev/null
@@ -1,75 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pdfcairo enhanced font 'Verdana,10'
-set autoscale
-set key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Traffic Volume (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ************ #
-# ON/OFF LABEL #
-# ************ #
-set label "1-ON" at "15:07:05", 4000 tc rgb "blue"
-set label "1-OFF" at "15:08:08", 2000 tc rgb "red"
-set label "2-ON" at "15:09:12", 4000 tc rgb "blue"
-set label "2-OFF" at "15:10:19", 2000 tc rgb "red"
-set label "3-ON" at "15:11:15", 4000 tc rgb "blue"
-set label "3-OFF" at "15:12:16", 2000 tc rgb "red"
-set label "4-ON" at "15:14:25", 4000 tc rgb "blue"
-set label "4-OFF" at "15:15:24", 2000 tc rgb "red"
-set label "5-ON" at "15:16:28", 4000 tc rgb "blue"
-set label "5-OFF" at "15:17:29", 2000 tc rgb "red"
-set label "6-ON" at "15:18:31", 4000 tc rgb "blue"
-set label "6-OFF" at "15:19:33", 2000 tc rgb "red"
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# DLink switch local
-# wlan1
-set output './result/dlink_switch_wlan1_timestamp_local_incoming_outgoing.pdf'
-set title "DLink Switch Incoming/Outgoing Local Traffic (wlan1)"
-plot "./result/dlink_switch_wlan1_local_incoming.dat" using 1:2 with lines lc 8 dt 4 title "Incoming", "./result/dlink_switch_wlan1_local_outgoing.dat" using 1:2 with lines lc 6 title "Outgoing"
-
-# ************ #
-# ON/OFF LABEL #
-# ************ #
-set label "1-ON" at "15:23:58", 4000 tc rgb "blue"
-set label "1-OFF" at "15:24:55", 3000 tc rgb "red"
-set label "2-ON" at "15:25:56", 4000 tc rgb "blue"
-set label "2-OFF" at "15:26:56", 3000 tc rgb "red"
-set label "3-ON" at "15:27:58", 4000 tc rgb "blue"
-set label "3-OFF" at "15:28:58", 3000 tc rgb "red"
-set label "4-ON" at "15:31:11", 4000 tc rgb "blue"
-set label "4-OFF" at "15:32:08", 3000 tc rgb "red"
-set label "5-ON" at "15:33:09", 4000 tc rgb "blue"
-set label "5-OFF" at "15:34:10", 3000 tc rgb "red"
-set label "6-ON" at "15:35:12", 4000 tc rgb "blue"
-set label "6-OFF" at "15:36:15", 3000 tc rgb "red"
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# DLink switch remote
-# wlan1
-set output './result/dlink_switch_wlan1_timestamp_remote_incoming_outgoing.pdf'
-set title "DLink Switch Incoming Remote Traffic (wlan1)"
-plot "./result/dlink_switch_wlan1_remote_incoming.dat" using 1:2 with lines lc 8 dt 4 title "Incoming", "./result/dlink_switch_wlan1_remote_outgoing.dat" using 1:2 with lines lc 6 title "Outgoing"
-
-

diff --git a/plot_scripts/plot_ts_graph_smartthings-mp-sensor b/plot_scripts/plot_ts_graph_smartthings-mp-sensor
deleted file mode 100644 (file)
index b06bf41..0000000
--- a/plot_scripts/plot_ts_graph_smartthings-mp-sensor
+++ /dev/null
@@ -1,82 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-unset key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# SmartThings Multipurpose Sensor local
-# eth0
-set output './result/smartthings-mp-sensor_switch_eth0_timestamp_local_incoming.png'
-set title "SmartThings Multipurpose Sensor Incoming Local Traffic (eth0)"
-plot "./result/smartthings-mp-sensor_switch_eth0_local_incoming.dat" using 1:2 with lines
-set output './result/smartthings-mp-sensor_switch_eth0_timestamp_local_outgoing.png'
-set title "SmartThings Multipurpose Sensor Outgoing Local Traffic (eth0)"
-plot "./result/smartthings-mp-sensor_switch_eth0_local_outgoing.dat" using 1:2 with lines
-# eth1
-set output './result/smartthings-mp-sensor_switch_eth1_timestamp_local_incoming.png'
-set title "SmartThings Multipurpose Sensor Incoming Local Traffic (eth1)"
-plot "./result/smartthings-mp-sensor_switch_eth1_local_incoming.dat" using 1:2 with lines
-set output './result/smartthings-mp-sensor_switch_eth1_timestamp_local_outgoing.png'
-set title "SmartThings Multipurpose Sensor Outgoing Local Traffic (eth1)"
-plot "./result/smartthings-mp-sensor_switch_eth1_local_outgoing.dat" using 1:2 with lines
-# wlan1
-#set output './result/smartthings-mp-sensor_switch_wlan1_timestamp_local_incoming.png'
-#set title "SmartThings Multipurpose Sensor Incoming Local Traffic (wlan1)"
-#plot "./result/smartthings-mp-sensor_switch_wlan1_local_incoming.dat" using 1:2 with lines
-set output './result/smartthings-mp-sensor_switch_wlan1_timestamp_local_outgoing.png'
-set title "SmartThings Multipurpose Sensor Outgoing Local Traffic (wlan1)"
-plot "./result/smartthings-mp-sensor_switch_wlan1_local_outgoing.dat" using 1:2 with lines
-
-# SmartThings Multipurpose Sensor remote
-# eth0
-set output './result/smartthings-mp-sensor_switch_eth0_timestamp_remote_incoming.png'
-set title "SmartThings Multipurpose Sensor Incoming Remote Traffic (eth0)"
-plot "./result/smartthings-mp-sensor_switch_eth0_remote_incoming.dat" using 1:2 with lines
-set output './result/smartthings-mp-sensor_switch_eth0_timestamp_remote_outgoing.png'
-set title "SmartThings Multipurpose Sensor Outgoing Remote Traffic (eth0)"
-plot "./result/smartthings-mp-sensor_switch_eth0_remote_outgoing.dat" using 1:2 with lines
-# eth1
-set output './result/smartthings-mp-sensor_switch_eth1_timestamp_remote_incoming.png'
-set title "SmartThings Multipurpose Sensor Incoming Remote Traffic (eth1)"
-plot "./result/smartthings-mp-sensor_switch_eth1_remote_incoming.dat" using 1:2 with lines
-set output './result/smartthings-mp-sensor_switch_eth1_timestamp_remote_outgoing.png'
-set title "SmartThings Multipurpose Sensor Outgoing Remote Traffic (eth1)"
-plot "./result/smartthings-mp-sensor_switch_eth1_remote_outgoing.dat" using 1:2 with lines
-# wlan1
-#set output './result/smartthings-mp-sensor_switch_wlan1_timestamp_remote_incoming.png'
-#set title "SmartThings Multipurpose Sensor Incoming Remote Traffic (wlan1)"
-#plot "./result/smartthings-mp-sensor_switch_wlan1_remote_incoming.dat" using 1:2 with lines
-#set output './result/smartthings-mp-sensor_switch_wlan1_timestamp_remote_outgoing.png'
-#set title "SmartThings Multipurpose Sensor Outgoing Remote Traffic (wlan1)"
-#plot "./result/smartthings-mp-sensor_switch_wlan1_remote_outgoing.dat" using 1:2 with lines
-
-# SmartThings Multipurpose Sensor phone local
-# wlan1
-set output './result/smartthings-mp-sensor_phone_wlan1_timestamp_local_incoming.png'
-set title "SmartThings Multipurpose Sensor Phone Incoming Local Traffic (wlan1)"
-plot "./result/smartthings-mp-sensor_phone_wlan1_local_incoming.dat" using 1:2 with lines
-set output './result/smartthings-mp-sensor_phone_wlan1_timestamp_local_outgoing.png'
-set title "SmartThings Multipurpose Sensor Phone Outgoing Local Traffic (wlan1)"
-plot "./result/smartthings-mp-sensor_phone_wlan1_local_outgoing.dat" using 1:2 with lines
-

diff --git a/plot_scripts/plot_ts_graph_smartthings-mp-sensor_combined b/plot_scripts/plot_ts_graph_smartthings-mp-sensor_combined
deleted file mode 100644 (file)
index ce16a52..0000000
--- a/plot_scripts/plot_ts_graph_smartthings-mp-sensor_combined
+++ /dev/null
@@ -1,44 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-set key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# SmartThings Multipurpose Sensor local
-# wlan1 / eth0 / eth1
-set output './result/smartthings-mp-sensor_switch_wlan1_timestamp_local_incoming_combined.png'
-set title "SmartThings Multipurpose Sensor Incoming Local Traffic (wlan1/eth0/eth1)"
-plot "./result/smartthings-mp-sensor_switch_eth0_local_incoming.dat" using 1:2 with lines title "eth0", "./result/smartthings-mp-sensor_switch_eth1_local_incoming.dat" using 1:2 with lines title "eth1", "./result/smartthings-mp-sensor_phone_wlan1_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/smartthings-mp-sensor_phone_wlan1_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-set output './result/smartthings-mp-sensor_switch_wlan1_timestamp_local_outgoing_combined.png'
-set title "SmartThings Multipurpose Sensor Outgoing Local Traffic (wlan1/eth0/eth1)"
-plot "./result/smartthings-mp-sensor_switch_wlan1_local_outgoing.dat" using 1:2 with lines title "wlan1", "./result/smartthings-mp-sensor_switch_eth0_local_outgoing.dat" using 1:2 with lines title "eth0", "./result/smartthings-mp-sensor_switch_eth1_local_outgoing.dat" using 1:2 with lines title "eth1", "./result/smartthings-mp-sensor_phone_wlan1_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/smartthings-mp-sensor_phone_wlan1_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-
-# SmartThings Multipurpose Sensor remote
-# eth0 / eth1
-set output './result/smartthings-mp-sensor_switch_wlan1_timestamp_remote_incoming_combined.png'
-set title "SmartThings Multipurpose Sensor Incoming Remote Traffic (eth0/eth1)"
-plot "./result/smartthings-mp-sensor_switch_eth0_remote_incoming.dat" using 1:2 with lines title "eth0", "./result/smartthings-mp-sensor_switch_eth1_remote_incoming.dat" using 1:2 with lines title "eth1"
-set output './result/smartthings-mp-sensor_switch_wlan1_timestamp_remote_outgoing_combined.png'
-set title "SmartThings Multipurpose Sensor Outgoing Remote Traffic (eth0/eth1)"
-plot "./result/smartthings-mp-sensor_switch_eth0_remote_outgoing.dat" using 1:2 with lines title "eth0", "./result/smartthings-mp-sensor_switch_eth1_remote_outgoing.dat" using 1:2 with lines title "eth1"

diff --git a/plot_scripts/plot_ts_graph_smartthings-plug b/plot_scripts/plot_ts_graph_smartthings-plug
deleted file mode 100644 (file)
index cea559f..0000000
--- a/plot_scripts/plot_ts_graph_smartthings-plug
+++ /dev/null
@@ -1,82 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-unset key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# SmartThings Plug switch local
-# eth0
-set output './result/smartthings-plug_switch_eth0_timestamp_local_incoming.png'
-set title "SmartThings Plug Switch Incoming Local Traffic (eth0)"
-plot "./result/smartthings-plug_switch_eth0_local_incoming.dat" using 1:2 with lines
-set output './result/smartthings-plug_switch_eth0_timestamp_local_outgoing.png'
-set title "SmartThings Plug Switch Outgoing Local Traffic (eth0)"
-plot "./result/smartthings-plug_switch_eth0_local_outgoing.dat" using 1:2 with lines
-# eth1
-set output './result/smartthings-plug_switch_eth1_timestamp_local_incoming.png'
-set title "SmartThings Plug Switch Incoming Local Traffic (eth1)"
-plot "./result/smartthings-plug_switch_eth1_local_incoming.dat" using 1:2 with lines
-set output './result/smartthings-plug_switch_eth1_timestamp_local_outgoing.png'
-set title "SmartThings Plug Switch Outgoing Local Traffic (eth1)"
-plot "./result/smartthings-plug_switch_eth1_local_outgoing.dat" using 1:2 with lines
-# wlan1
-#set output './result/smartthings-plug_switch_wlan1_timestamp_local_incoming.png'
-#set title "SmartThings Plug Switch Incoming Local Traffic (wlan1)"
-#plot "./result/smartthings-plug_switch_wlan1_local_incoming.dat" using 1:2 with lines
-set output './result/smartthings-plug_switch_wlan1_timestamp_local_outgoing.png'
-set title "SmartThings Plug Switch Outgoing Local Traffic (wlan1)"
-plot "./result/smartthings-plug_switch_wlan1_local_outgoing.dat" using 1:2 with lines
-
-# SmartThings Plug switch remote
-# eth0
-set output './result/smartthings-plug_switch_eth0_timestamp_remote_incoming.png'
-set title "SmartThings Plug Switch Incoming Remote Traffic (eth0)"
-plot "./result/smartthings-plug_switch_eth0_remote_incoming.dat" using 1:2 with lines
-set output './result/smartthings-plug_switch_eth0_timestamp_remote_outgoing.png'
-set title "SmartThings Plug Switch Outgoing Remote Traffic (eth0)"
-plot "./result/smartthings-plug_switch_eth0_remote_outgoing.dat" using 1:2 with lines
-# eth1
-set output './result/smartthings-plug_switch_eth1_timestamp_remote_incoming.png'
-set title "SmartThings Plug Switch Incoming Remote Traffic (eth1)"
-plot "./result/smartthings-plug_switch_eth1_remote_incoming.dat" using 1:2 with lines
-set output './result/smartthings-plug_switch_eth1_timestamp_remote_outgoing.png'
-set title "SmartThings Plug Switch Outgoing Remote Traffic (eth1)"
-plot "./result/smartthings-plug_switch_eth1_remote_outgoing.dat" using 1:2 with lines
-# wlan1
-#set output './result/smartthings-plug_switch_wlan1_timestamp_remote_incoming.png'
-#set title "SmartThings Plug Switch Incoming Remote Traffic (wlan1)"
-#plot "./result/smartthings-plug_switch_wlan1_remote_incoming.dat" using 1:2 with lines
-#set output './result/smartthings-plug_switch_wlan1_timestamp_remote_outgoing.png'
-#set title "SmartThings Plug Switch Outgoing Remote Traffic (wlan1)"
-#plot "./result/smartthings-plug_switch_wlan1_remote_outgoing.dat" using 1:2 with lines
-
-# SmartThings Plug phone local
-# wlan1
-set output './result/smartthings-plug_phone_wlan1_timestamp_local_incoming.png'
-set title "SmartThings Plug Phone Incoming Local Traffic (wlan1)"
-plot "./result/smartthings-plug_phone_wlan1_local_incoming.dat" using 1:2 with lines
-set output './result/smartthings-plug_phone_wlan1_timestamp_local_outgoing.png'
-set title "SmartThings Plug Phone Outgoing Local Traffic (wlan1)"
-plot "./result/smartthings-plug_phone_wlan1_local_outgoing.dat" using 1:2 with lines
-

diff --git a/plot_scripts/plot_ts_graph_smartthings-plug_combined b/plot_scripts/plot_ts_graph_smartthings-plug_combined
deleted file mode 100644 (file)
index f0133cc..0000000
--- a/plot_scripts/plot_ts_graph_smartthings-plug_combined
+++ /dev/null
@@ -1,44 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-set key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# SmartThings Plug switch local
-# wlan1 / eth0 / eth1
-set output './result/smartthings-plug_switch_wlan1_timestamp_local_incoming_combined.png'
-set title "SmartThings Plug Switch Incoming Local Traffic (wlan1/eth0/eth1)"
-plot "./result/smartthings-plug_switch_eth0_local_incoming.dat" using 1:2 with lines title "eth0", "./result/smartthings-plug_switch_eth1_local_incoming.dat" using 1:2 with lines title "eth1", "./result/smartthings-plug_phone_wlan1_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/smartthings-plug_phone_wlan1_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-set output './result/smartthings-plug_switch_wlan1_timestamp_local_outgoing_combined.png'
-set title "SmartThings Plug Switch Outgoing Local Traffic (wlan1/eth0/eth1)"
-plot "./result/smartthings-plug_switch_wlan1_local_outgoing.dat" using 1:2 with lines title "wlan1", "./result/smartthings-plug_switch_eth0_local_outgoing.dat" using 1:2 with lines title "eth0", "./result/smartthings-plug_switch_eth1_local_outgoing.dat" using 1:2 with lines title "eth1", "./result/smartthings-plug_phone_wlan1_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/smartthings-plug_phone_wlan1_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-
-# SmartThings Plug switch remote
-# eth0 / eth1
-set output './result/smartthings-plug_switch_wlan1_timestamp_remote_incoming_combined.png'
-set title "SmartThings Plug Switch Incoming Remote Traffic (eth0/eth1)"
-plot "./result/smartthings-plug_switch_eth0_remote_incoming.dat" using 1:2 with lines title "eth0", "./result/smartthings-plug_switch_eth1_remote_incoming.dat" using 1:2 with lines title "eth1"
-set output './result/smartthings-plug_switch_wlan1_timestamp_remote_outgoing_combined.png'
-set title "SmartThings Plug Switch Outgoing Remote Traffic (eth0/eth1)"
-plot "./result/smartthings-plug_switch_eth0_remote_outgoing.dat" using 1:2 with lines title "eth0", "./result/smartthings-plug_switch_eth1_remote_outgoing.dat" using 1:2 with lines title "eth1"

diff --git a/plot_scripts/plot_ts_graph_smartthings-plug_labeled b/plot_scripts/plot_ts_graph_smartthings-plug_labeled
deleted file mode 100644 (file)
index 2dda305..0000000
--- a/plot_scripts/plot_ts_graph_smartthings-plug_labeled
+++ /dev/null
@@ -1,77 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pdfcairo enhanced font 'Verdana,10'
-set autoscale
-set key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Traffic Volume (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ************ #
-# ON/OFF LABEL #
-# ************ #
-set label "1-ON" at "15:21:44", 2000 tc rgb "blue"
-set label "1-OFF" at "15:23:04", 4000 tc rgb "red"
-set label "2-ON" at "15:23:57", 2000 tc rgb "blue"
-set label "2-OFF" at "15:24:58", 4000 tc rgb "red"
-set label "3-ON" at "15:25:59", 2000 tc rgb "blue"
-set label "3-OFF" at "15:27:01", 4000 tc rgb "red"
-set label "4-ON" at "15:29:17", 2000 tc rgb "blue"
-set label "4-OFF" at "15:30:13", 2500 tc rgb "red"
-set label "5-ON" at "15:31:14", 2000 tc rgb "blue"
-set label "5-OFF" at "15:32:15", 4000 tc rgb "red"
-set label "6-ON" at "15:33:17", 8000 tc rgb "blue"
-set label "6-OFF" at "15:34:16", 4000 tc rgb "red"
-
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# SmartThings Plug switch local
-# eth1
-set output './result/smartthings-plug_switch_eth1_timestamp_local_incoming_outgoing.pdf'
-set title "SmartThings Plug Switch Incoming/Outgoing Local Traffic (eth1)"
-plot "./result/smartthings-plug_switch_eth1_local_incoming.dat" using 1:2 with lines lc 8 dt 4 title "Incoming", "./result/smartthings-plug_switch_eth1_local_outgoing.dat" using 1:2 with lines lc 6 title "Outgoing"
-
-# ************ #
-# ON/OFF LABEL #
-# ************ #
-set label "1-ON" at "15:38:22", 1500 tc rgb "blue"
-set label "1-OFF" at "15:39:24", 1000 tc rgb "red"
-set label "2-ON" at "15:40:24", 1500 tc rgb "blue"
-set label "2-OFF" at "15:41:27", 1000 tc rgb "red"
-set label "3-ON" at "15:42:27", 1500 tc rgb "blue"
-set label "3-OFF" at "15:43:29", 1000 tc rgb "red"
-set label "4-ON" at "15:45:32", 1500 tc rgb "blue"
-set label "4-OFF" at "15:46:33", 1000 tc rgb "red"
-set label "5-ON" at "15:47:36", 1500 tc rgb "blue"
-set label "5-OFF" at "15:48:36", 1000 tc rgb "red"
-set label "6-ON" at "15:49:39", 1500 tc rgb "blue"
-set label "6-OFF" at "15:50:42", 1000 tc rgb "red"
-
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# SmartThings Plug switch remote
-# eth1
-set output './result/smartthings-plug_switch_eth1_timestamp_remote_incoming_outgoing.pdf'
-set title "SmartThings Plug Switch Incoming/Outgoing Remote Traffic (eth1)"
-plot "./result/smartthings-plug_switch_eth1_remote_incoming.dat" using 1:2 with lines lc 8 dt 4 title "Incoming", "./result/smartthings-plug_switch_eth1_remote_outgoing.dat" using 1:2 with lines lc 6 title "Outgoing"
-
-

diff --git a/plot_scripts/plot_ts_graph_tplink b/plot_scripts/plot_ts_graph_tplink
deleted file mode 100644 (file)
index 4f1fb35..0000000
--- a/plot_scripts/plot_ts_graph_tplink
+++ /dev/null
@@ -1,68 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-unset key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# TPLink switch local
-# eth0
-set output './result/tplink_switch_eth_timestamp_local_incoming.png'
-set title "TP-Link Switch Incoming Local Traffic (eth0)"
-plot "./result/tplink_switch_eth_local_incoming.dat" using 1:2 with lines
-set output './result/tplink_switch_eth_timestamp_local_outgoing.png'
-set title "TP-Link Switch Outgoing Local Traffic (eth0)"
-plot "./result/tplink_switch_eth_local_outgoing.dat" using 1:2 with lines
-# wlan1
-set output './result/tplink_switch_wlan_timestamp_local_incoming.png'
-set title "TP-Link Switch Incoming Local Traffic (wlan1)"
-plot "./result/tplink_switch_wlan_local_incoming.dat" using 1:2 with lines
-set output './result/tplink_switch_wlan_timestamp_local_outgoing.png'
-set title "TP-Link Switch Outgoing Local Traffic (wlan1)"
-plot "./result/tplink_switch_wlan_local_outgoing.dat" using 1:2 with lines
-
-# TPLink switch remote
-# eth0
-set output './result/tplink_switch_eth_timestamp_remote_incoming.png'
-set title "TP-Link Switch Incoming Remote Traffic (eth0)"
-plot "./result/tplink_switch_eth_remote_incoming.dat" using 1:2 with lines
-set output './result/tplink_switch_eth_timestamp_remote_outgoing.png'
-set title "TP-Link Switch Outgoing Remote Traffic (eth0)"
-plot "./result/tplink_switch_eth_remote_outgoing.dat" using 1:2 with lines
-# wlan1
-set output './result/tplink_switch_wlan_timestamp_remote_incoming.png'
-set title "TP-Link Switch Incoming Remote Traffic (wlan1)"
-plot "./result/tplink_switch_wlan_remote_incoming.dat" using 1:2 with lines
-set output './result/tplink_switch_wlan_timestamp_remote_outgoing.png'
-set title "TP-Link Switch Outgoing Remote Traffic (wlan1)"
-plot "./result/tplink_switch_wlan_remote_outgoing.dat" using 1:2 with lines
-
-# TPLink phone local
-# wlan1
-set output './result/tplink_phone_wlan_timestamp_local_incoming.png'
-set title "TP-Link Phone Incoming Local Traffic (wlan1)"
-plot "./result/tplink_phone_wlan_local_incoming.dat" using 1:2 with lines
-set output './result/tplink_phone_wlan_timestamp_local_outgoing.png'
-set title "TP-Link Phone Outgoing Local Traffic (wlan1)"
-plot "./result/tplink_phone_wlan_local_outgoing.dat" using 1:2 with lines
-

diff --git a/plot_scripts/plot_ts_graph_tplink_combined b/plot_scripts/plot_ts_graph_tplink_combined
deleted file mode 100644 (file)
index ece1962..0000000
--- a/plot_scripts/plot_ts_graph_tplink_combined
+++ /dev/null
@@ -1,45 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-set key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# TPLink switch local
-# wlan1 / eth0
-set output './result/tplink_switch_wlan_timestamp_local_incoming_combined.png'
-set title "TP-Link Switch Incoming Local Traffic (wlan1/eth0)"
-plot "./result/tplink_switch_wlan_local_incoming.dat" using 1:2 with lines title "wlan1", "./result/tplink_switch_eth_local_incoming.dat" using 1:2 with lines title "eth0", "./result/tplink_phone_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/tplink_phone_wlan_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-set output './result/tplink_switch_wlan_timestamp_local_outgoing_combined.png'
-set title "TP-Link Switch Outgoing Local Traffic (wlan1/eth0)"
-plot "./result/tplink_switch_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1", "./result/tplink_switch_eth_local_outgoing.dat" using 1:2 with lines title "eth0", "./result/tplink_phone_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/tplink_phone_wlan_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-
-# TPLink switch remote
-# wlan1 / eth0
-set output './result/tplink_switch_wlan_timestamp_remote_incoming_combined.png'
-set title "TP-Link Switch Incoming Remote Traffic (wlan1/eth0)"
-plot "./result/tplink_switch_wlan_remote_incoming.dat" using 1:2 with lines title "wlan1", "./result/tplink_switch_eth_remote_incoming.dat" using 1:2 with lines title "eth0"
-set output './result/tplink_switch_wlan_timestamp_remote_outgoing_combined.png'
-set title "TP-Link Switch Outgoing Remote Traffic (wlan1/eth0)"
-plot "./result/tplink_switch_wlan_remote_outgoing.dat" using 1:2 with lines title "wlan1", "./result/tplink_switch_eth_remote_outgoing.dat" using 1:2 with lines title "eth0"
-

diff --git a/plot_scripts/plot_ts_graph_tplink_labeled b/plot_scripts/plot_ts_graph_tplink_labeled
deleted file mode 100644 (file)
index 28c809d..0000000
--- a/plot_scripts/plot_ts_graph_tplink_labeled
+++ /dev/null
@@ -1,74 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pdfcairo enhanced font 'Verdana,10'
-set autoscale
-set key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Traffic Volume (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ************ #
-# ON/OFF LABEL #
-# ************ #
-set label "1-ON" at "13:38:04", 9000 tc rgb "blue"
-set label "1-OFF" at "13:39:03", 7000 tc rgb "red"
-set label "2-ON" at "13:40:05", 9000 tc rgb "blue"
-set label "2-OFF" at "13:41:08", 7000 tc rgb "red"
-set label "3-ON" at "13:42:07", 9000 tc rgb "blue"
-set label "3-OFF" at "13:43:09", 7000 tc rgb "red"
-set label "4-ON" at "13:45:25", 9000 tc rgb "blue"
-set label "4-OFF" at "13:46:27", 7000 tc rgb "red"
-set label "5-ON" at "13:47:28", 9000 tc rgb "blue"
-set label "5-OFF" at "13:48:29", 7000 tc rgb "red"
-set label "6-ON" at "13:49:31", 9000 tc rgb "blue"
-set label "6-OFF" at "13:50:30", 7000 tc rgb "red"
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# TPLink switch local
-# wlan1
-set output './result/tplink_switch_wlan1_timestamp_local_incoming_outgoing.pdf'
-set title "TP-Link Switch Incoming/Outgoing Local Traffic (wlan1)"
-plot "./result/tplink_switch_wlan1_local_incoming.dat" using 1:2 with lines lc 8 dt 4 title "Incoming", "./result/tplink_switch_wlan1_local_outgoing.dat" using 1:2 with lines lc 6 title "Outgoing"
-
-# ************ #
-# ON/OFF LABEL #
-# ************ #
-set label "1-ON" at "13:54:35", 8000 tc rgb "blue"
-set label "1-OFF" at "13:55:31", 7000 tc rgb "red"
-set label "2-ON" at "13:56:32", 8000 tc rgb "blue"
-set label "2-OFF" at "13:57:33", 7000 tc rgb "red"
-set label "3-ON" at "13:58:37", 8000 tc rgb "blue"
-set label "3-OFF" at "13:59:37", 7000 tc rgb "red"
-set label "4-ON" at "14:01:42", 8000 tc rgb "blue"
-set label "4-OFF" at "14:02:42", 7000 tc rgb "red"
-set label "5-ON" at "14:03:44", 8000 tc rgb "blue"
-set label "5-OFF" at "14:04:47", 7000 tc rgb "red"
-set label "6-ON" at "14:05:47", 6000 tc rgb "blue"
-set label "6-OFF" at "14:06:49", 7000 tc rgb "red"
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# TPLink switch remote
-# wlan1
-set output './result/tplink_switch_wlan1_timestamp_remote_incoming_outgoing.pdf'
-set title "TP-Link Switch Incoming/Outgoing Remote Traffic (wlan1)"
-plot "./result/tplink_switch_wlan1_remote_incoming.dat" using 1:2 with lines lc 8 dt 4 title "Incoming", "./result/tplink_switch_wlan1_remote_outgoing.dat" using 1:2 with lines lc 6 title "Outgoing"
-

diff --git a/plot_scripts/plot_ts_graph_wemo b/plot_scripts/plot_ts_graph_wemo
deleted file mode 100644 (file)
index 7b8d592..0000000
--- a/plot_scripts/plot_ts_graph_wemo
+++ /dev/null
@@ -1,68 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-unset key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo switch local
-# eth0
-set output './result/wemo_switch_eth0_timestamp_local_incoming.png'
-set title "WeMo Switch Incoming Local Traffic (eth0)"
-plot "./result/wemo_switch_eth0_local_incoming.dat" using 1:2 with lines
-set output './result/wemo_switch_eth0_timestamp_local_outgoing.png'
-set title "WeMo Switch Outgoing Local Traffic (eth0)"
-plot "./result/wemo_switch_eth0_local_outgoing.dat" using 1:2 with lines
-# wlan1
-set output './result/wemo_switch_wlan1_timestamp_local_incoming.png'
-set title "WeMo Switch Incoming Local Traffic (wlan1)"
-plot "./result/wemo_switch_wlan1_local_incoming.dat" using 1:2 with lines
-set output './result/wemo_switch_wlan1_timestamp_local_outgoing.png'
-set title "WeMo Switch Outgoing Local Traffic (wlan1)"
-plot "./result/wemo_switch_wlan1_local_outgoing.dat" using 1:2 with lines
-
-# WeMo switch remote
-# eth0
-set output './result/wemo_switch_eth0_timestamp_remote_incoming.png'
-set title "WeMo Switch Incoming Remote Traffic (eth0)"
-plot "./result/wemo_switch_eth0_remote_incoming.dat" using 1:2 with lines
-set output './result/wemo_switch_eth0_timestamp_remote_outgoing.png'
-set title "WeMo Switch Outgoing Remote Traffic (eth0)"
-plot "./result/wemo_switch_eth0_remote_outgoing.dat" using 1:2 with lines
-# wlan1
-set output './result/wemo_switch_wlan1_timestamp_remote_incoming.png'
-set title "WeMo Switch Incoming Remote Traffic (wlan1)"
-plot "./result/wemo_switch_wlan1_remote_incoming.dat" using 1:2 with lines
-set output './result/wemo_switch_wlan1_timestamp_remote_outgoing.png'
-set title "WeMo Switch Outgoing Remote Traffic (wlan1)"
-plot "./result/wemo_switch_wlan1_remote_outgoing.dat" using 1:2 with lines
-
-# WeMo phone local
-# wlan1
-set output './result/wemo_phone_wlan1_timestamp_local_incoming.png'
-set title "WeMo Phone Incoming Local Traffic (wlan1)"
-plot "./result/wemo_phone_wlan1_local_incoming.dat" using 1:2 with lines
-set output './result/wemo_phone_wlan1_timestamp_local_outgoing.png'
-set title "WeMo Phone Outgoing Local Traffic (wlan1)"
-plot "./result/wemo_phone_wlan1_local_outgoing.dat" using 1:2 with lines
-

diff --git a/plot_scripts/plot_ts_graph_wemo-insight b/plot_scripts/plot_ts_graph_wemo-insight
deleted file mode 100644 (file)
index e4c245b..0000000
--- a/plot_scripts/plot_ts_graph_wemo-insight
+++ /dev/null
@@ -1,68 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-unset key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo Insight switch local
-# eth0
-set output './result/wemo-insight_switch_eth_timestamp_local_incoming.png'
-set title "WeMo Insight Switch Incoming Local Traffic (eth0)"
-plot "./result/wemo-insight_switch_eth_local_incoming.dat" using 1:2 with lines
-set output './result/wemo-insight_switch_eth_timestamp_local_outgoing.png'
-set title "WeMo Insight Switch Outgoing Local Traffic (eth0)"
-plot "./result/wemo-insight_switch_eth_local_outgoing.dat" using 1:2 with lines
-# wlan1
-set output './result/wemo-insight_switch_wlan_timestamp_local_incoming.png'
-set title "WeMo Insight Switch Incoming Local Traffic (wlan1)"
-plot "./result/wemo-insight_switch_wlan_local_incoming.dat" using 1:2 with lines
-set output './result/wemo-insight_switch_wlan_timestamp_local_outgoing.png'
-set title "WeMo Insight Switch Outgoing Local Traffic (wlan1)"
-plot "./result/wemo-insight_switch_wlan_local_outgoing.dat" using 1:2 with lines
-
-# WeMo Insight switch remote
-# eth0
-set output './result/wemo-insight_switch_eth_timestamp_remote_incoming.png'
-set title "WeMo Insight Switch Incoming Remote Traffic (eth0)"
-plot "./result/wemo-insight_switch_eth_remote_incoming.dat" using 1:2 with lines
-set output './result/wemo-insight_switch_eth_timestamp_remote_outgoing.png'
-set title "WeMo Insight Switch Outgoing Remote Traffic (eth0)"
-plot "./result/wemo-insight_switch_eth_remote_outgoing.dat" using 1:2 with lines
-# wlan1
-set output './result/wemo-insight_switch_wlan_timestamp_remote_incoming.png'
-set title "WeMo Insight Switch Incoming Remote Traffic (wlan1)"
-plot "./result/wemo-insight_switch_wlan_remote_incoming.dat" using 1:2 with lines
-set output './result/wemo-insight_switch_wlan_timestamp_remote_outgoing.png'
-set title "WeMo Insight Switch Outgoing Remote Traffic (wlan1)"
-plot "./result/wemo-insight_switch_wlan_remote_outgoing.dat" using 1:2 with lines
-
-# WeMo Insight phone local
-# wlan1
-set output './result/wemo-insight_phone_wlan_timestamp_local_incoming.png'
-set title "WeMo Insight Phone Incoming Local Traffic (wlan1)"
-plot "./result/wemo-insight_phone_wlan_local_incoming.dat" using 1:2 with lines
-set output './result/wemo-insight_phone_wlan_timestamp_local_outgoing.png'
-set title "WeMo Insight Phone Outgoing Local Traffic (wlan1)"
-plot "./result/wemo-insight_phone_wlan_local_outgoing.dat" using 1:2 with lines
-

diff --git a/plot_scripts/plot_ts_graph_wemo-insight_combined b/plot_scripts/plot_ts_graph_wemo-insight_combined
deleted file mode 100644 (file)
index 9036c38..0000000
--- a/plot_scripts/plot_ts_graph_wemo-insight_combined
+++ /dev/null
@@ -1,44 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-set key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo Insight switch local
-# wlan1 / eth0
-set output './result/wemo-insight_switch_wlan_timestamp_local_incoming_combined.png'
-set title "WeMo Insight Switch Incoming Local Traffic (wlan1/eth0)"
-plot "./result/wemo-insight_switch_wlan_local_incoming.dat" using 1:2 with lines title "wlan1", "./result/wemo-insight_switch_eth_local_incoming.dat" using 1:2 with lines title "eth0", "./result/wemo-insight_phone_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/wemo-insight_phone_wlan_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-set output './result/wemo-insight_switch_wlan_timestamp_local_outgoing_combined.png'
-set title "WeMo Insight Switch Outgoing Local Traffic (wlan1/eth0)"
-plot "./result/wemo-insight_switch_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1", "./result/wemo-insight_switch_eth_local_outgoing.dat" using 1:2 with lines title "eth0", "./result/wemo-insight_phone_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/wemo-insight_phone_wlan_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-
-# WeMo Insight switch remote
-# wlan1
-set output './result/wemo-insight_switch_wlan_timestamp_remote_incoming_combined.png'
-set title "WeMo Insight Switch Incoming Remote Traffic (wlan1/eth0)"
-plot "./result/wemo-insight_switch_wlan_remote_incoming.dat" using 1:2 with lines title "wlan1", "./result/wemo-insight_switch_eth_remote_incoming.dat" using 1:2 with lines title "eth0"
-set output './result/wemo-insight_switch_wlan_timestamp_remote_outgoing_combined.png'
-set title "WeMo Insight Switch Outgoing Remote Traffic (wlan1/eth0)"
-plot "./result/wemo-insight_switch_wlan_remote_outgoing.dat" using 1:2 with lines title "wlan1", "./result/wemo-insight_switch_eth_remote_outgoing.dat" using 1:2 with lines title "eth0"

diff --git a/plot_scripts/plot_ts_graph_wemo-insight_labeled b/plot_scripts/plot_ts_graph_wemo-insight_labeled
deleted file mode 100644 (file)
index 992dda0..0000000
--- a/plot_scripts/plot_ts_graph_wemo-insight_labeled
+++ /dev/null
@@ -1,74 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pdfcairo enhanced font 'Verdana,10'
-set autoscale
-set key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Traffic Volume (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ************ #
-# ON/OFF LABEL #
-# ************ #
-set label "1-ON" at "16:00:31", 60000 tc rgb "blue"
-set label "1-OFF" at "16:01:26", 50000 tc rgb "red"
-set label "2-ON" at "16:02:29", 60000 tc rgb "blue"
-set label "2-OFF" at "16:03:34", 50000 tc rgb "red"
-set label "3-ON" at "16:04:32", 60000 tc rgb "blue"
-set label "3-OFF" at "16:05:32", 50000 tc rgb "red"
-set label "4-ON" at "16:07:41", 60000 tc rgb "blue"
-set label "4-OFF" at "16:08:40", 50000 tc rgb "red"
-set label "5-ON" at "16:09:42", 60000 tc rgb "blue"
-set label "5-OFF" at "16:10:43", 50000 tc rgb "red"
-set label "6-ON" at "16:11:46", 60000 tc rgb "blue"
-set label "6-OFF" at "16:12:46", 50000 tc rgb "red"
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo Insight switch local
-# wlan1
-set output './result/wemo-insight_switch_wlan1_timestamp_local_incoming_outgoing.pdf'
-set title "WeMo Insight Switch Incoming/Outgoing Local Traffic (wlan1)"
-plot "./result/wemo-insight_switch_wlan1_local_incoming.dat" using 1:2 with lines lc 8 dt 4 title "Incoming", "./result/wemo-insight_switch_wlan1_local_outgoing.dat" using 1:2 with lines lc 6 title "Outgoing"
-
-# ************ #
-# ON/OFF LABEL #
-# ************ #
-set label "1-ON" at "16:18:55", 80000 tc rgb "blue"
-set label "1-OFF" at "16:19:56", 120000 tc rgb "red"
-set label "2-ON" at "16:20:59", 80000 tc rgb "blue"
-set label "2-OFF" at "16:22:00", 120000 tc rgb "red"
-set label "3-ON" at "16:23:03", 80000 tc rgb "blue"
-set label "3-OFF" at "16:24:07", 120000 tc rgb "red"
-set label "4-ON" at "16:26:13", 80000 tc rgb "blue"
-set label "4-OFF" at "16:27:09", 120000 tc rgb "red"
-set label "5-ON" at "16:28:15", 80000 tc rgb "blue"
-set label "5-OFF" at "16:29:12", 120000 tc rgb "red"
-set label "6-ON" at "16:30:13", 80000 tc rgb "blue"
-set label "6-OFF" at "16:31:18", 60000 tc rgb "red"
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo Insight switch remote
-# wlan1
-set output './result/wemo-insight_switch_wlan1_timestamp_remote_incoming_outgoing.pdf'
-set title "WeMo Insight Switch Incoming/Outgoing Remote Traffic (wlan1)"
-plot "./result/wemo-insight_switch_wlan1_remote_incoming.dat" using 1:2 with lines lc 8 dt 4 title "Incoming", "./result/wemo-insight_switch_wlan1_remote_outgoing.dat" using 1:2 with lines lc 6 title "Outgoing"
-

diff --git a/plot_scripts/plot_ts_graph_wemo_combined b/plot_scripts/plot_ts_graph_wemo_combined
deleted file mode 100644 (file)
index d8707b0..0000000
--- a/plot_scripts/plot_ts_graph_wemo_combined
+++ /dev/null
@@ -1,44 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pngcairo enhanced font 'Verdana,10'
-set autoscale
-set key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Packet Size (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo switch local
-# wlan1 / eth0
-set output './result/wemo_switch_wlan_timestamp_local_incoming_combined.png'
-set title "WeMo Switch Incoming Local Traffic (wlan1/eth0)"
-plot "./result/wemo_switch_wlan_local_incoming.dat" using 1:2 with lines title "wlan1", "./result/wemo_switch_eth_local_incoming.dat" using 1:2 with lines title "eth0", "./result/wemo_phone_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/wemo_phone_wlan_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-set output './result/wemo_switch_wlan_timestamp_local_outgoing_combined.png'
-set title "WeMo Switch Outgoing Local Traffic (wlan1/eth0)"
-plot "./result/wemo_switch_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1", "./result/wemo_switch_eth_local_outgoing.dat" using 1:2 with lines title "eth0", "./result/wemo_phone_wlan_local_outgoing.dat" using 1:2 with lines title "wlan1-phone-outgoing", "./result/wemo_phone_wlan_local_incoming.dat" using 1:2 with lines title "wlan1-phone-incoming"
-
-# WeMo switch remote
-# wlan1
-set output './result/wemo_switch_wlan_timestamp_remote_incoming_combined.png'
-set title "WeMo Switch Incoming Remote Traffic (wlan1/eth0)"
-plot "./result/wemo_switch_wlan_remote_incoming.dat" using 1:2 with lines title "wlan1", "./result/wemo_switch_eth_remote_incoming.dat" using 1:2 with lines title "eth0"
-set output './result/wemo_switch_wlan_timestamp_remote_outgoing_combined.png'
-set title "WeMo Switch Outgoing Remote Traffic (wlan1/eth0)"
-plot "./result/wemo_switch_wlan_remote_outgoing.dat" using 1:2 with lines title "wlan1", "./result/wemo_switch_eth_remote_outgoing.dat" using 1:2 with lines title "eth0"

diff --git a/plot_scripts/plot_ts_graph_wemo_labeled b/plot_scripts/plot_ts_graph_wemo_labeled
deleted file mode 100644 (file)
index a0f522a..0000000
--- a/plot_scripts/plot_ts_graph_wemo_labeled
+++ /dev/null
@@ -1,63 +0,0 @@
-# Script to plot time series graphs for network traffic analysis
-#
-# by Rahmadi Trimananda (rahmadi.trimananda@uci.edu)
-# Programming Language Research Group @ University of California, Irvine
-# Winter 2018
-
-# ************ #
-# BASIC SETUP  #
-# ************ #
-set terminal pdfcairo enhanced font 'Verdana,10'
-set autoscale
-set key
-unset log
-unset label
-set xtics 50
-set xtics rotate by 60 right
-set ytics auto
-set xlabel "Packet Timestamp (hh:mm:ss)"
-set ylabel "Traffic Volume (bytes)"
-set xdata time
-set timefmt "%H:%M:%S"
-set xrange [:]
-set yrange [0:]
-
-# ************ #
-# ON/OFF LABEL #
-# ************ #
-set label "1-ON" at "11:10:05", 50000 tc rgb "blue"
-set label "1-OFF" at "11:11:08", 50000 tc rgb "red"
-set label "2-ON" at "11:12:10", 50000 tc rgb "blue"
-set label "2-OFF" at "11:13:12", 50000 tc rgb "red"
-set label "3-ON" at "11:14:14", 50000 tc rgb "blue"
-set label "3-OFF" at "11:15:17", 50000 tc rgb "red"
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo switch local
-# wlan1
-set output './result/wemo_switch_wlan1_timestamp_local_incoming_outgoing.pdf'
-set title "WeMo Switch Incoming/Outgoing Local Traffic (wlan1)"
-plot "./result/wemo_switch_wlan1_local_incoming.dat" using 1:2 with lines lc 8 dt 4 title "Incoming", "./result/wemo_switch_wlan1_local_outgoing.dat" using 1:2 with lines lc 6 title "Outgoing"
-
-# ************ #
-# ON/OFF LABEL #
-# ************ #
-set label "1-ON" at "11:20:49", 50000 tc rgb "blue"
-set label "1-OFF" at "11:21:49", 50000 tc rgb "red"
-set label "2-ON" at "11:22:50", 50000 tc rgb "blue"
-set label "2-OFF" at "11:23:52", 50000 tc rgb "red"
-set label "3-ON" at "11:24:54", 5000 tc rgb "orange"
-set label "3-OFF" at "11:26:55", 50000 tc rgb "blue"
-
-# ***************** #
-# PER DEVICE SETUP  #
-# ***************** #
-# WeMo switch remote
-# wlan1
-set output './result/wemo_switch_wlan1_timestamp_remote_incoming_outgoing.pdf'
-set title "WeMo Switch Incoming/Outgoing Remote Traffic (wlan1)"
-plot "./result/wemo_switch_wlan1_remote_incoming.dat" using 1:2 with lines lc 8 dt 4 title "Incoming", "./result/wemo_switch_wlan1_remote_outgoing.dat" using 1:2 with lines lc 6 title "Outgoing"
-
-

diff --git a/python_ml/clustering.py b/python_ml/clustering.py
deleted file mode 100644 (file)
index bf8c1eb..0000000
--- a/python_ml/clustering.py
+++ /dev/null
@@ -1,113 +0,0 @@
-from __future__ import print_function
-
-from sklearn.datasets import make_blobs
-from sklearn.cluster import KMeans
-from sklearn.metrics import silhouette_samples, silhouette_score
-
-import matplotlib.pyplot as plt
-import matplotlib.cm as cm
-import numpy as np
-
-print(__doc__)
-
-# Generating the sample data from make_blobs
-# This particular setting has one distinct cluster and 3 clusters placed close
-# together.
-'''X, y = make_blobs(n_samples=500,
-                  n_features=2,
-                  centers=4,
-                  cluster_std=1,
-                  center_box=(-10.0, 10.0),
-                  shuffle=True,
-                  random_state=1)  # For reproducibility'''
-
-X = np.array([[132, 192], [117, 960], [117, 962], [1343, 0], [117, 1116], [117, 1117], [117, 1118], [117, 1119], [1015, 0], [117, 966]])
-
-range_n_clusters = [2, 3, 4, 5, 6]
-
-for n_clusters in range_n_clusters:
-    # Create a subplot with 1 row and 2 columns
-#    fig, (ax1, ax2) = plt.subplots(1, 2)
-#    fig.set_size_inches(18, 7)
-
-    # The 1st subplot is the silhouette plot
-    # The silhouette coefficient can range from -1, 1 but in this example all
-    # lie within [-0.1, 1]
-#    ax1.set_xlim([-0.1, 1])
-    # The (n_clusters+1)*10 is for inserting blank space between silhouette
-    # plots of individual clusters, to demarcate them clearly.
-#    ax1.set_ylim([0, len(X) + (n_clusters + 1) * 10])
-
-    # Initialize the clusterer with n_clusters value and a random generator
-    # seed of 10 for reproducibility.
-#    clusterer = KMeans(n_clusters=n_clusters, random_state=20)
-#    cluster_labels = clusterer.fit_predict(X)
-
-    # The silhouette_score gives the average value for all the samples.
-    # This gives a perspective into the density and separation of the formed
-    # clusters
-    silhouette_avg = silhouette_score(X, cluster_labels)
-    print("For n_clusters =", n_clusters,
-          "The average silhouette_score is :", silhouette_avg)
-
-    # Compute the silhouette scores for each sample
-    sample_silhouette_values = silhouette_samples(X, cluster_labels)
-
-'''    y_lower = 10
-    for i in range(n_clusters):
-        # Aggregate the silhouette scores for samples belonging to
-        # cluster i, and sort them
-        ith_cluster_silhouette_values = \
-            sample_silhouette_values[cluster_labels == i]
-
-        ith_cluster_silhouette_values.sort()
-
-        size_cluster_i = ith_cluster_silhouette_values.shape[0]
-        y_upper = y_lower + size_cluster_i
-
-        color = cm.nipy_spectral(float(i) / n_clusters)
-        ax1.fill_betweenx(np.arange(y_lower, y_upper),
-                          0, ith_cluster_silhouette_values,
-                          facecolor=color, edgecolor=color, alpha=0.7)
-
-        # Label the silhouette plots with their cluster numbers at the middle
-        ax1.text(-0.05, y_lower + 0.5 * size_cluster_i, str(i))
-
-        # Compute the new y_lower for next plot
-        y_lower = y_upper + 10  # 10 for the 0 samples
-
-    ax1.set_title("The silhouette plot for the various clusters.")
-    ax1.set_xlabel("The silhouette coefficient values")
-    ax1.set_ylabel("Cluster label")
-
-    # The vertical line for average silhouette score of all the values
-    ax1.axvline(x=silhouette_avg, color="red", linestyle="--")
-
-    ax1.set_yticks([])  # Clear the yaxis labels / ticks
-    ax1.set_xticks([-0.1, 0, 0.2, 0.4, 0.6, 0.8, 1])
-
-    # 2nd Plot showing the actual clusters formed
-    colors = cm.nipy_spectral(cluster_labels.astype(float) / n_clusters)
-    ax2.scatter(X[:, 0], X[:, 1], marker='.', s=30, lw=0, alpha=0.7,
-                c=colors, edgecolor='k')
-
-    # Labeling the clusters
-    centers = clusterer.cluster_centers_
-    # Draw white circles at cluster centers
-    ax2.scatter(centers[:, 0], centers[:, 1], marker='o',
-                c="white", alpha=1, s=200, edgecolor='k')
-
-    for i, c in enumerate(centers):
-        ax2.scatter(c[0], c[1], marker='$%d$' % i, alpha=1,
-                    s=50, edgecolor='k')
-
-    ax2.set_title("The visualization of the clustered data.")
-    ax2.set_xlabel("Feature space for the 1st feature")
-    ax2.set_ylabel("Feature space for the 2nd feature")
-
-    plt.suptitle(("Silhouette analysis for KMeans clustering on sample data "
-                  "with n_clusters = %d" % n_clusters),
-                 fontsize=14, fontweight='bold')
-
-    plt.show()
-

diff --git a/python_ml/dlink_clustering.py b/python_ml/dlink_clustering.py
deleted file mode 100644 (file)
index 82d445e..0000000
--- a/python_ml/dlink_clustering.py
+++ /dev/null
@@ -1,45 +0,0 @@
-from sklearn.cluster import KMeans
-import matplotlib.cm as cm
-import numpy as np
-import matplotlib.pyplot as plt
-
-# Create a subplot with 1 row and 2 columns
-fig, (ax2) = plt.subplots(1, 1)
-fig.set_size_inches(7, 7)
-
-X = np.array([[132, 192], [117, 960], [117, 962], [1343, 0], [117, 1109], [117, 1110], [117, 1111], [117, 1116], [117, 1117], [117, 1118], [117, 1119], [1015, 0], [117, 966]])
-#kmeans = KMeans(n_clusters=5, random_state=0).fit(X)
-#print(kmeans.labels_)
-#print(kmeans.labels_.tolist().count(3))
-clusters = 5
-
-# Plot the data points based on the clusters
-clusterer = KMeans(n_clusters=clusters, random_state=10)
-cluster_labels = clusterer.fit_predict(X)
-# 2nd Plot showing the actual clusters formed
-colors = cm.nipy_spectral(cluster_labels.astype(float) / clusters)
-ax2.scatter(X[:, 0], X[:, 1], marker='o', s=100, lw=0, alpha=0.3,
-            c=colors, edgecolor='k')
-
-# Labeling the clusters
-centers = clusterer.cluster_centers_
-# Label with cluster centers and frequencies
-for i, c in enumerate(centers):
-       mark = '[' + str(int(c[0])) + ', ' + str(int(c[1])) + ']' + ', ' + str(clusterer.labels_.tolist().count(i))
-       ax2.scatter(c[0], c[1], marker='$%s$' % mark, alpha=1, s=3000, edgecolor='k')
-
-# Draw white circles at cluster centers
-#ax2.scatter(centers[:, 0], centers[:, 1], marker='o',
-#            c="white", alpha=1, s=200, edgecolor='k')
-
-#for i, c in enumerate(centers):
-#    ax2.scatter(c[0], c[1], marker='$%d$' % i, alpha=1,
-#                s=50, edgecolor='k')
-#for i, c in enumerate(centers):
-#      print(c[0], c[1])
-
-ax2.set_title("The visualization of the clustered data.")
-ax2.set_xlabel("Feature space for the 1st feature")
-ax2.set_ylabel("Feature space for the 2nd feature")
-plt.show()
-

diff --git a/python_ml/plotting-dbscan-complete.py b/python_ml/plotting-dbscan-complete.py
deleted file mode 100644 (file)
index a2baa90..0000000
--- a/python_ml/plotting-dbscan-complete.py
+++ /dev/null
@@ -1,149 +0,0 @@
-from sklearn.cluster import DBSCAN
-from sklearn import metrics
-import matplotlib.cm as cm
-import numpy as np
-import matplotlib.pyplot as plt
-
-# Create a subplot with 1 row and 2 columns
-fig, (ax2) = plt.subplots(1, 1)
-fig.set_size_inches(7, 7)
-
-
-# Read from file
-# TODO: Just change the following path and filename 
-#      when needed to read from a different file
-path = "/scratch/July-2018/Pairs2/"
-device1 = "alexa2-on"
-device2 = "alexa2-off"
-filename1 = device1 + ".txt"
-filename2 = device2 + ".txt"
-
-# Number of triggers
-trig = 50
-
-# PLOTTING FOR DEVICE ON EVENT
-# Read and create an array of pairs
-with open(path + filename1, "r") as pairs:
-       pairsArr = []
-       for line in pairs:
-               # We will see a pair and we need to split it into xpoint and ypoint
-               xpoint, ypoint = line.split(", ")
-               pair = [int(xpoint), int(ypoint)]
-               pairsArr.append(pair)
-
-# Formed array of pairs                
-#print(pairsArr)
-X = np.array(pairsArr);
-
-# Compute DBSCAN
-# eps = distances
-# min_samples = minimum number of members of a cluster
-db = DBSCAN(eps=10, min_samples=trig - 5).fit(X)
-core_samples_mask = np.zeros_like(db.labels_, dtype=bool)
-core_samples_mask[db.core_sample_indices_] = True
-labels = db.labels_
-
-# Number of clusters in labels, ignoring noise if present.
-n_clusters_ = len(set(labels)) - (1 if -1 in labels else 0)
-#print('Estimated number of clusters: %d' % n_clusters_)
-
-# Black removed and is used for noise instead.
-unique_labels = set(labels)
-#print("Labels: " + str(labels))
-
-colors = [plt.cm.Spectral(each)
-             for each in np.linspace(0, 1, len(unique_labels))]
-for k, col in zip(unique_labels, colors):
-       if k == -1:
-           # Red used for noise.
-           col = [1, 0, 0, 1]
-
-       class_member_mask = (labels == k)
-
-       print("Unique label: " + str(k) + " with freq: " + str(labels.tolist().count(k)))
-       xy = X[class_member_mask & core_samples_mask]
-       plt.plot(xy[:, 0], xy[:, 1], 'o',
-                markeredgecolor='k', markersize=10)
-
-       xy = X[class_member_mask & ~core_samples_mask]
-       plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(col),
-                markeredgecolor='k', markersize=6)
-
-count = 0
-for pair in pairsArr:
-       if labels[count] == -1:
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]), fontsize=10)
-       else:
-       # Only print the frequency when this is a real cluster
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]) + 
-                       "\nFreq:" + str(labels.tolist().count(labels[count])), fontsize=10)
-       count = count + 1
-
-#====================================================================================================
-
-# PLOTTING FOR DEVICE ON EVENT
-# Read and create an array of pairs
-with open(path + filename2, "r") as pairs:
-       pairsArr = []
-       for line in pairs:
-               # We will see a pair and we need to split it into xpoint and ypoint
-               xpoint, ypoint = line.split(", ")
-               pair = [int(xpoint), int(ypoint)]
-               pairsArr.append(pair)
-
-# Formed array of pairs                
-#print(pairsArr)
-X = np.array(pairsArr);
-
-# Compute DBSCAN
-# eps = distances
-# min_samples = minimum number of members of a cluster
-db = DBSCAN(eps=10, min_samples=trig - 5).fit(X)
-core_samples_mask = np.zeros_like(db.labels_, dtype=bool)
-core_samples_mask[db.core_sample_indices_] = True
-labels = db.labels_
-
-# Number of clusters in labels, ignoring noise if present.
-n_clusters_ = len(set(labels)) - (1 if -1 in labels else 0)
-#print('Estimated number of clusters: %d' % n_clusters_)
-
-import matplotlib.pyplot as plt
-
-# Black removed and is used for noise instead.
-unique_labels = set(labels)
-#print("Labels: " + str(labels))
-
-colors = [plt.cm.Spectral(each)
-             for each in np.linspace(0, 1, len(unique_labels))]
-for k, col in zip(unique_labels, colors):
-       if k == -1:
-           # Green used for noise.
-           col = [0, 1, 0, 1]
-
-       class_member_mask = (labels == k)
-
-       print("Unique label: " + str(k) + " with freq: " + str(labels.tolist().count(k)))
-       xy = X[class_member_mask & core_samples_mask]
-       plt.plot(xy[:, 0], xy[:, 1], 'o',
-                markeredgecolor='k', markersize=10)
-
-       xy = X[class_member_mask & ~core_samples_mask]
-       plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(col),
-                markeredgecolor='k', markersize=6)
-
-count = 0
-for pair in pairsArr:
-       if labels[count] == -1:
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]), fontsize=10)
-       else:
-       # Only print the frequency when this is a real cluster
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]) + 
-                       "\nFreq:" + str(labels.tolist().count(labels[count])), fontsize=10)
-       count = count + 1
-
-
-       
-plt.title(device1 + ' & ' + device2)
-plt.show()
-
-

diff --git a/python_ml/plotting-dbscan-diff-metric.py b/python_ml/plotting-dbscan-diff-metric.py
deleted file mode 100644 (file)
index 947705d..0000000
--- a/python_ml/plotting-dbscan-diff-metric.py
+++ /dev/null
@@ -1,132 +0,0 @@
-from sklearn.cluster import DBSCAN
-from sklearn import metrics
-import matplotlib.cm as cm
-import numpy as np
-import matplotlib.pyplot as plt
-
-# metric function for clustering
-def metric(x, y):
-       # Compare 2 datapoints in array element 2 and 3 that contains C or S
-       if x[2] != y[2] or x[3] != y[3]:
-               # We are not going to cluster these together since they have different directions
-               return sys.maxsize;
-       else:
-               # Compute Euclidian distance here
-               return math.sqrt((x[0] - y[0])**2 + (x[1] - y[1])**2)
-
-# Create a subplot with 1 row and 2 columns
-fig, (ax2) = plt.subplots(1, 1)
-fig.set_size_inches(20, 20)
-
-# Read from file
-# TODO: Just change the following path and filename 
-#      when needed to read from a different file
-path = "/scratch/July-2018/Pairs3/"
-# TODO: Change the order of the files below to generate
-#              the diff plot reversedly
-device1 = "kwikset-off-phone-side"
-device2 = "kwikset-on-phone-side"
-filename1 = device1 + ".txt"
-filename2 = device2 + ".txt"
-plt.ylim(0, 2000)
-plt.xlim(0, 2000)
-
-# Number of triggers
-trig = 50
-
-# PLOTTING FOR DEVICE ON EVENT
-# Read and create an array of pairs
-with open(path + filename1, "r") as pairs:
-       pairsArr1 = list()
-       pairsSrcLabels1 = list()
-       for line in pairs:
-               # We will see a pair and we need to split it into xpoint and ypoint
-               xpoint, ypoint, srcHost1, srcHost2, src1, src2 = line.split(", ")
-               # Assign 1000 for client and 0 for server to create distance
-               src1Val = 1000 if src1 == 'C' else 0
-               src2Val = 1000 if src2 == 'C' else 0
-               pair = [int(xpoint), int(ypoint), int(src1Val), int(src2Val)]
-               pairSrc = [int(xpoint), int(ypoint), srcHost1, srcHost2, src1, src2]
-               # Array of actual points
-               pairsArr1.append(pair)
-               # Array of source labels
-               pairsSrcLabels1.append(pairSrc)
-
-# PLOTTING FOR DEVICE ON EVENT
-# Read and create an array of pairs
-with open(path + filename2, "r") as pairs:
-       pairsArr2 = list()
-       pairsSrcLabels2 = list()
-       for line in pairs:
-               # We will see a pair and we need to split it into xpoint and ypoint
-               xpoint, ypoint, srcHost1, srcHost2, src1, src2 = line.split(", ")
-               # Assign 1000 for client and 0 for server to create distance
-               src1Val = 1000 if src1 == 'C' else 0
-               src2Val = 1000 if src2 == 'C' else 0
-               pair = [int(xpoint), int(ypoint), int(src1Val), int(src2Val)]
-               pairSrc = [int(xpoint), int(ypoint), srcHost1, srcHost2, src1, src2]
-               # Array of actual points
-               pairsArr2.append(pair)
-               # Array of source labels
-               pairsSrcLabels2.append(pairSrc)         
-
-diff12 = [i for i in pairsArr1 if i not in pairsArr2]
-diff12SrcLabels = [i for i in pairsSrcLabels1 if i not in pairsSrcLabels2]
-
-X = np.array(diff12);
-
-# Compute DBSCAN
-# eps = distances
-# min_samples = minimum number of members of a cluster
-db = DBSCAN(eps=10, min_samples=trig - 45).fit(X)
-core_samples_mask = np.zeros_like(db.labels_, dtype=bool)
-core_samples_mask[db.core_sample_indices_] = True
-labels = db.labels_
-
-# Number of clusters in labels, ignoring noise if present.
-n_clusters_ = len(set(labels)) - (1 if -1 in labels else 0)
-
-# Black removed and is used for noise instead.
-unique_labels = set(labels)
-
-colors = [plt.cm.Spectral(each)
-             for each in np.linspace(0, 1, len(unique_labels))]
-for k, col in zip(unique_labels, colors):
-       cluster_col = [1, 0, 0, 1]
-       if k == -1:
-           # Black used for noise.
-           col = [0, 0, 0, 1]
-
-       class_member_mask = (labels == k)
-
-       # print("Unique label: " + str(k) + " with freq: " + str(labels.tolist().count(k)))
-       xy = X[class_member_mask & core_samples_mask]
-       plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(cluster_col),
-                markeredgecolor='k', markersize=10)
-
-       xy = X[class_member_mask & ~core_samples_mask]
-       plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(col),
-                markeredgecolor='k', markersize=6)
-
-# Print lengths
-count = 0
-for pair in diff12:
-       if labels[count] == -1:
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]), fontsize=10)
-       else:
-       # Only print the frequency when this is a real cluster
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]) + 
-                       " - Freq:" + str(labels.tolist().count(labels[count])), fontsize=10)
-       count = count + 1
-
-# Print source-destination labels
-count = 0
-for pair in diff12SrcLabels:
-       # Only print the frequency when this is a real cluster
-       plt.text(pair[0], pair[1], str(pair[4]) + "->" + str(pair[5]))
-       count = count + 1
-
-plt.title(device1 + ' - diff - ' + device2)
-plt.show()
-
-

diff --git a/python_ml/plotting-dbscan-diff.py b/python_ml/plotting-dbscan-diff.py
deleted file mode 100644 (file)
index 15d7728..0000000
--- a/python_ml/plotting-dbscan-diff.py
+++ /dev/null
@@ -1,97 +0,0 @@
-from sklearn.cluster import DBSCAN
-from sklearn import metrics
-import matplotlib.cm as cm
-import numpy as np
-import matplotlib.pyplot as plt
-
-# Create a subplot with 1 row and 2 columns
-fig, (ax2) = plt.subplots(1, 1)
-fig.set_size_inches(7, 7)
-
-# Read from file
-# TODO: Just change the following path and filename 
-#      when needed to read from a different file
-path = "/scratch/July-2018/Pairs2/"
-# TODO: Change the order of the files below to generate
-#              the diff plot reversedly
-device1 = "dlink-siren-device-off"
-device2 = "dlink-siren-device-on"
-filename1 = device1 + ".txt"
-filename2 = device2 + ".txt"
-plt.ylim(0, 2000)
-plt.xlim(0, 2000)
-
-# Number of triggers
-trig = 50
-
-# PLOTTING FOR DEVICE ON EVENT
-# Read and create an array of pairs
-with open(path + filename1, "r") as pairs:
-       pairsArr1 = list()
-       for line in pairs:
-               # We will see a pair and we need to split it into xpoint and ypoint
-               xpoint, ypoint = line.split(", ")
-               pair = [int(xpoint), int(ypoint)]
-               pairsArr1.append(pair)
-
-# PLOTTING FOR DEVICE ON EVENT
-# Read and create an array of pairs
-with open(path + filename2, "r") as pairs:
-       pairsArr2 = list()
-       for line in pairs:
-               # We will see a pair and we need to split it into xpoint and ypoint
-               xpoint, ypoint = line.split(", ")
-               pair = [int(xpoint), int(ypoint)]
-               pairsArr2.append(pair)
-
-diff12 = [i for i in pairsArr1 if i not in pairsArr2]
-
-X = np.array(diff12);
-
-# Compute DBSCAN
-# eps = distances
-# min_samples = minimum number of members of a cluster
-db = DBSCAN(eps=10, min_samples=trig - 45).fit(X)
-core_samples_mask = np.zeros_like(db.labels_, dtype=bool)
-core_samples_mask[db.core_sample_indices_] = True
-labels = db.labels_
-
-# Number of clusters in labels, ignoring noise if present.
-n_clusters_ = len(set(labels)) - (1 if -1 in labels else 0)
-
-# Black removed and is used for noise instead.
-unique_labels = set(labels)
-
-colors = [plt.cm.Spectral(each)
-             for each in np.linspace(0, 1, len(unique_labels))]
-for k, col in zip(unique_labels, colors):
-       cluster_col = [1, 0, 0, 1]
-       if k == -1:
-           # Black used for noise.
-           col = [0, 0, 0, 1]
-
-       class_member_mask = (labels == k)
-
-       # print("Unique label: " + str(k) + " with freq: " + str(labels.tolist().count(k)))
-       xy = X[class_member_mask & core_samples_mask]
-       plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(cluster_col),
-                markeredgecolor='k', markersize=10)
-
-       xy = X[class_member_mask & ~core_samples_mask]
-       plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(col),
-                markeredgecolor='k', markersize=6)
-
-count = 0
-for pair in diff12:
-       if labels[count] == -1:
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]), fontsize=10)
-       else:
-       # Only print the frequency when this is a real cluster
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]) + 
-                       " - Freq:" + str(labels.tolist().count(labels[count])), fontsize=10)
-       count = count + 1
-
-plt.title(device1 + ' - diff - ' + device2)
-plt.show()
-
-

diff --git a/python_ml/plotting-dbscan-metric.py b/python_ml/plotting-dbscan-metric.py
deleted file mode 100644 (file)
index 63a8514..0000000
--- a/python_ml/plotting-dbscan-metric.py
+++ /dev/null
@@ -1,116 +0,0 @@
-from sklearn.cluster import DBSCAN
-from sklearn import metrics
-import sys
-import math
-import matplotlib.cm as cm
-import numpy as np
-import matplotlib.pyplot as plt
-
-# metric function for clustering
-def metric(x, y):
-       # Compare 2 datapoints in array element 2 and 3 that contains C or S
-       if x[2] != y[2] or x[3] != y[3]:
-               # We are not going to cluster these together since they have different directions
-               return sys.maxsize;
-       else:
-               # Compute Euclidian distance here
-               return math.sqrt((x[0] - y[0])**2 + (x[1] - y[1])**2)
-
-# Create a subplot with 1 row and 2 columns
-fig, (ax2) = plt.subplots(1, 1)
-fig.set_size_inches(20, 20)
-
-
-# Read from file
-# TODO: Just change the following path and filename 
-#      when needed to read from a different file
-path = "/scratch/July-2018/Pairs3/"
-device = "kwikset-off-phone-side"
-filename = device + ".txt"
-plt.ylim(0, 2000)
-plt.xlim(0, 2000)
-
-# Number of triggers
-trig = 50
-
-# Read and create an array of pairs
-with open(path + filename, "r") as pairs:
-       pairsArr = []
-       pairsSrcLabels = []
-       for line in pairs:
-               # We will see a pair and we need to split it into xpoint and ypoint
-               xpoint, ypoint, srcHost1, srcHost2, src1, src2 = line.split(", ")
-               # Assign 1000 for client and 0 for server to create distance
-               src1Val = 1000 if src1 == 'C' else 0
-               src2Val = 1000 if src2 == 'C' else 0
-               pair = [int(xpoint), int(ypoint), int(src1Val), int(src2Val)]
-               pairSrc = [int(xpoint), int(ypoint), srcHost1, srcHost2, src1, src2]
-               # Array of actual points
-               pairsArr.append(pair)
-               # Array of source labels
-               pairsSrcLabels.append(pairSrc)
-
-# Formed array of pairs                
-#print(pairsArr)
-X = np.array(pairsArr);
-
-# Compute DBSCAN
-# eps = distances
-# min_samples = minimum number of members of a cluster
-#db = DBSCAN(eps=20, min_samples=trig - 5).fit(X)
-# TODO: This is just for seeing more clusters
-db = DBSCAN(eps=20, min_samples=trig - 45, metric=metric).fit(X)
-core_samples_mask = np.zeros_like(db.labels_, dtype=bool)
-core_samples_mask[db.core_sample_indices_] = True
-labels = db.labels_
-
-# Number of clusters in labels, ignoring noise if present.
-n_clusters_ = len(set(labels)) - (1 if -1 in labels else 0)
-
-#print('Estimated number of clusters: %d' % n_clusters_)
-
-import matplotlib.pyplot as plt
-
-# Black removed and is used for noise instead.
-unique_labels = set(labels)
-#print("Labels: " + str(labels))
-
-colors = [plt.cm.Spectral(each)
-          for each in np.linspace(0, 1, len(unique_labels))]
-for k, col in zip(unique_labels, colors):
-    cluster_col = [1, 0, 0, 1]
-    if k == -1:
-        # Black used for noise.
-        col = [0, 0, 0, 1]
-
-    class_member_mask = (labels == k)
-
-    xy = X[class_member_mask & core_samples_mask]
-    plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(cluster_col),
-             markeredgecolor='k', markersize=10)
-
-    xy = X[class_member_mask & ~core_samples_mask]
-    plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(col),
-             markeredgecolor='k', markersize=6)
-
-# Print lengths
-count = 0
-for pair in pairsArr:
-       if labels[count] == -1:
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]), fontsize=10)
-       else:
-       # Only print the frequency when this is a real cluster
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]) + 
-                       " f: " + str(labels.tolist().count(labels[count])), fontsize=10)
-       count = count + 1
-
-# Print source-destination labels
-count = 0
-for pair in pairsSrcLabels:
-       # Only print the frequency when this is a real cluster
-       plt.text(pair[0], pair[1], str(pair[4]) + "->" + str(pair[5]))
-       count = count + 1
-       
-plt.title(device + ' - Clusters: %d' % n_clusters_)
-plt.show()
-

diff --git a/python_ml/plotting-dbscan-src-dst.py b/python_ml/plotting-dbscan-src-dst.py
deleted file mode 100644 (file)
index ff6ceaf..0000000
--- a/python_ml/plotting-dbscan-src-dst.py
+++ /dev/null
@@ -1,94 +0,0 @@
-from sklearn.cluster import DBSCAN
-from sklearn import metrics
-import matplotlib.cm as cm
-import numpy as np
-import matplotlib.pyplot as plt
-
-# Create a subplot with 1 row and 2 columns
-fig, (ax2) = plt.subplots(1, 1)
-fig.set_size_inches(7, 7)
-
-
-# Read from file
-# TODO: Just change the following path and filename 
-#      when needed to read from a different file
-path = "/scratch/July-2018/Pairs2/"
-device = "dlink-siren-off2"
-filename = device + ".txt"
-plt.ylim(0, 2000)
-plt.xlim(0, 2000)
-
-# Number of triggers
-trig = 50
-
-# Read and create an array of pairs
-with open(path + filename, "r") as pairs:
-       pairsArr = []
-       for line in pairs:
-               # We will see a pair and we need to split it into xpoint and ypoint
-               xpoint, ypoint, src, dst = line.split(", ")
-               pair = [int(xpoint), int(ypoint), int(src), int(dst)]
-               pairsArr.append(pair)
-
-# Formed array of pairs                
-#print(pairsArr)
-X = np.array(pairsArr);
-
-# Compute DBSCAN
-# eps = distances
-# min_samples = minimum number of members of a cluster
-#db = DBSCAN(eps=20, min_samples=trig - 5).fit(X)
-# TODO: This is just for seeing more clusters
-db = DBSCAN(eps=20, min_samples=trig - 49).fit(X)
-core_samples_mask = np.zeros_like(db.labels_, dtype=bool)
-core_samples_mask[db.core_sample_indices_] = True
-labels = db.labels_
-
-# Number of clusters in labels, ignoring noise if present.
-n_clusters_ = len(set(labels)) - (1 if -1 in labels else 0)
-
-#print('Estimated number of clusters: %d' % n_clusters_)
-
-import matplotlib.pyplot as plt
-
-# Black removed and is used for noise instead.
-unique_labels = set(labels)
-print("Labels: " + str(labels))
-
-colors = [plt.cm.Spectral(each)
-          for each in np.linspace(0, 1, len(unique_labels))]
-for k, col in zip(unique_labels, colors):
-    cluster_col = [1, 0, 0, 1]
-    if k == -1:
-        # Black used for noise.
-        col = [0, 0, 0, 1]
-
-    class_member_mask = (labels == k)
-
-    xy = X[class_member_mask & core_samples_mask]
-    plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(cluster_col),
-             markeredgecolor='k', markersize=10)
-
-    xy = X[class_member_mask & ~core_samples_mask]
-    plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(col),
-             markeredgecolor='k', markersize=6)
-
-count = 0
-for pair in pairsArr:
-       #if labels[count] != -1:
-       # If this is not a noise (i.e.,real data)
-       #       plt.text(pair[0], pair[1], "Freq: " + str(labels.tolist().count(labels[count])), fontsize=10)
-
-       if labels[count] == -1:
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]), fontsize=10)
-       else:
-       # Only print the frequency when this is a real cluster
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]) + 
-                       " f: " + str(labels.tolist().count(labels[count])), fontsize=10)
-       count = count + 1
-
-       
-plt.title(device + ' - Clusters: %d' % n_clusters_)
-plt.show()
-
-

diff --git a/python_ml/plotting-dbscan.py b/python_ml/plotting-dbscan.py
deleted file mode 100644 (file)
index 2202a8e..0000000
--- a/python_ml/plotting-dbscan.py
+++ /dev/null
@@ -1,94 +0,0 @@
-from sklearn.cluster import DBSCAN
-from sklearn import metrics
-import matplotlib.cm as cm
-import numpy as np
-import matplotlib.pyplot as plt
-
-# Create a subplot with 1 row and 2 columns
-fig, (ax2) = plt.subplots(1, 1)
-fig.set_size_inches(7, 7)
-
-
-# Read from file
-# TODO: Just change the following path and filename 
-#      when needed to read from a different file
-path = "/scratch/July-2018/Pairs2/"
-device = "dlink-siren-device-off"
-filename = device + ".txt"
-plt.ylim(0, 2000)
-plt.xlim(0, 2000)
-
-# Number of triggers
-trig = 50
-
-# Read and create an array of pairs
-with open(path + filename, "r") as pairs:
-       pairsArr = []
-       for line in pairs:
-               # We will see a pair and we need to split it into xpoint and ypoint
-               xpoint, ypoint = line.split(", ")
-               pair = [int(xpoint), int(ypoint)]
-               pairsArr.append(pair)
-
-# Formed array of pairs                
-#print(pairsArr)
-X = np.array(pairsArr);
-
-# Compute DBSCAN
-# eps = distances
-# min_samples = minimum number of members of a cluster
-#db = DBSCAN(eps=20, min_samples=trig - 5).fit(X)
-# TODO: This is just for seeing more clusters
-db = DBSCAN(eps=20, min_samples=trig - 45).fit(X)
-core_samples_mask = np.zeros_like(db.labels_, dtype=bool)
-core_samples_mask[db.core_sample_indices_] = True
-labels = db.labels_
-
-# Number of clusters in labels, ignoring noise if present.
-n_clusters_ = len(set(labels)) - (1 if -1 in labels else 0)
-
-#print('Estimated number of clusters: %d' % n_clusters_)
-
-import matplotlib.pyplot as plt
-
-# Black removed and is used for noise instead.
-unique_labels = set(labels)
-#print("Labels: " + str(labels))
-
-colors = [plt.cm.Spectral(each)
-          for each in np.linspace(0, 1, len(unique_labels))]
-for k, col in zip(unique_labels, colors):
-    cluster_col = [1, 0, 0, 1]
-    if k == -1:
-        # Black used for noise.
-        col = [0, 0, 0, 1]
-
-    class_member_mask = (labels == k)
-
-    xy = X[class_member_mask & core_samples_mask]
-    plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(cluster_col),
-             markeredgecolor='k', markersize=10)
-
-    xy = X[class_member_mask & ~core_samples_mask]
-    plt.plot(xy[:, 0], xy[:, 1], 'o', markerfacecolor=tuple(col),
-             markeredgecolor='k', markersize=6)
-
-count = 0
-for pair in pairsArr:
-       #if labels[count] != -1:
-       # If this is not a noise (i.e.,real data)
-       #       plt.text(pair[0], pair[1], "Freq: " + str(labels.tolist().count(labels[count])), fontsize=10)
-
-       if labels[count] == -1:
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]), fontsize=10)
-       else:
-       # Only print the frequency when this is a real cluster
-               plt.text(pair[0], pair[1], str(pair[0]) + ", " + str(pair[1]) + 
-                       " : " + str(labels.tolist().count(labels[count])), fontsize=10)
-       count = count + 1
-
-       
-plt.title(device + ' - Clusters: %d' % n_clusters_)
-plt.show()
-
-

diff --git a/python_ml/plotting.py b/python_ml/plotting.py
deleted file mode 100644 (file)
index 0089d02..0000000
--- a/python_ml/plotting.py
+++ /dev/null
@@ -1,51 +0,0 @@
-from sklearn.cluster import KMeans
-import matplotlib.cm as cm
-import numpy as np
-import matplotlib.pyplot as plt
-
-# Create a subplot with 1 row and 2 columns
-fig, (ax2) = plt.subplots(1, 1)
-fig.set_size_inches(7, 7)
-
-
-# Read from file
-# TODO: Just change the following path and filename 
-#      when needed to read from a different file
-path = "/scratch/July-2018/Pairs/"
-filename = "dlink-off.txt"
-
-# Read and create an array of pairs
-with open(path + filename, "r") as pairs:
-       pairsArr = []
-       for line in pairs:
-               # We will see a pair and we need to split it into xpoint and ypoint
-               xpoint, ypoint = line.split(", ")
-               pair = [int(xpoint), int(ypoint)]
-               pairsArr.append(pair)
-
-# Formed array of pairs                
-#print(pairsArr)
-X = np.array(pairsArr);
-
-clusters = 6
-
-# Plot the data points based on the clusters
-clusterer = KMeans(n_clusters=clusters, random_state=10)
-cluster_labels = clusterer.fit_predict(X)
-# 2nd Plot showing the actual clusters formed
-colors = cm.nipy_spectral(cluster_labels.astype(float) / clusters)
-ax2.scatter(X[:, 0], X[:, 1], marker='o', s=50, lw=0, alpha=0.3,
-            c=colors, edgecolor='k')
-
-# Labeling the clusters
-centers = clusterer.cluster_centers_
-# Label with cluster centers and frequencies
-for i, c in enumerate(centers):
-       mark = '[' + str(int(c[0])) + ', ' + str(int(c[1])) + ']' + ', ' + str(clusterer.labels_.tolist().count(i))
-       ax2.scatter(c[0], c[1], marker='$%s$' % mark, alpha=1, s=3000, edgecolor='k')
-       print('[' + str(int(c[0])) + ', ' + str(int(c[1])) + ']' + ', ' + str(clusterer.labels_.tolist().count(i)))
-
-ax2.set_title("The visualization of the clustered data.")
-ax2.set_xlabel("Feature space for the 1st feature")
-ax2.set_ylabel("Feature space for the 2nd feature")
-plt.show()

diff --git a/python_ml/silhouette.py b/python_ml/silhouette.py
deleted file mode 100644 (file)
index 3ddca71..0000000
--- a/python_ml/silhouette.py
+++ /dev/null
@@ -1,113 +0,0 @@
-from __future__ import print_function
-
-from sklearn.datasets import make_blobs
-from sklearn.cluster import KMeans
-from sklearn.metrics import silhouette_samples, silhouette_score
-
-import matplotlib.pyplot as plt
-import matplotlib.cm as cm
-import numpy as np
-
-print(__doc__)
-
-# Generating the sample data from make_blobs
-# This particular setting has one distinct cluster and 3 clusters placed close
-# together.
-'''X, y = make_blobs(n_samples=500,
-                  n_features=2,
-                  centers=4,
-                  cluster_std=1,
-                  center_box=(-10.0, 10.0),
-                  shuffle=True,
-                  random_state=1)  # For reproducibility'''
-
-X = np.array([[132, 192], [117, 960], [117, 962], [1343, 0], [117, 1116], [117, 1117], [117, 1118], [117, 1119], [1015, 0], [117, 966]])
-
-range_n_clusters = [2, 3, 4, 5, 6]
-
-for n_clusters in range_n_clusters:
-    # Create a subplot with 1 row and 2 columns
-    fig, (ax1, ax2) = plt.subplots(1, 2)
-    fig.set_size_inches(18, 7)
-
-    # The 1st subplot is the silhouette plot
-    # The silhouette coefficient can range from -1, 1 but in this example all
-    # lie within [-0.1, 1]
-    ax1.set_xlim([-0.1, 1])
-    # The (n_clusters+1)*10 is for inserting blank space between silhouette
-    # plots of individual clusters, to demarcate them clearly.
-    ax1.set_ylim([0, len(X) + (n_clusters + 1) * 10])
-
-    # Initialize the clusterer with n_clusters value and a random generator
-    # seed of 10 for reproducibility.
-    clusterer = KMeans(n_clusters=n_clusters, random_state=10)
-    cluster_labels = clusterer.fit_predict(X)
-
-    # The silhouette_score gives the average value for all the samples.
-    # This gives a perspective into the density and separation of the formed
-    # clusters
-    silhouette_avg = silhouette_score(X, cluster_labels)
-    print("For n_clusters =", n_clusters,
-          "The average silhouette_score is :", silhouette_avg)
-
-    # Compute the silhouette scores for each sample
-    sample_silhouette_values = silhouette_samples(X, cluster_labels)
-
-    y_lower = 10
-    for i in range(n_clusters):
-        # Aggregate the silhouette scores for samples belonging to
-        # cluster i, and sort them
-        ith_cluster_silhouette_values = \
-            sample_silhouette_values[cluster_labels == i]
-
-        ith_cluster_silhouette_values.sort()
-
-        size_cluster_i = ith_cluster_silhouette_values.shape[0]
-        y_upper = y_lower + size_cluster_i
-
-        color = cm.nipy_spectral(float(i) / n_clusters)
-        ax1.fill_betweenx(np.arange(y_lower, y_upper),
-                          0, ith_cluster_silhouette_values,
-                          facecolor=color, edgecolor=color, alpha=0.7)
-
-        # Label the silhouette plots with their cluster numbers at the middle
-        ax1.text(-0.05, y_lower + 0.5 * size_cluster_i, str(i))
-
-        # Compute the new y_lower for next plot
-        y_lower = y_upper + 10  # 10 for the 0 samples
-
-    ax1.set_title("The silhouette plot for the various clusters.")
-    ax1.set_xlabel("The silhouette coefficient values")
-    ax1.set_ylabel("Cluster label")
-
-    # The vertical line for average silhouette score of all the values
-    ax1.axvline(x=silhouette_avg, color="red", linestyle="--")
-
-    ax1.set_yticks([])  # Clear the yaxis labels / ticks
-    ax1.set_xticks([-0.1, 0, 0.2, 0.4, 0.6, 0.8, 1])
-
-    # 2nd Plot showing the actual clusters formed
-    colors = cm.nipy_spectral(cluster_labels.astype(float) / n_clusters)
-    ax2.scatter(X[:, 0], X[:, 1], marker='.', s=30, lw=0, alpha=0.7,
-                c=colors, edgecolor='k')
-
-    # Labeling the clusters
-    centers = clusterer.cluster_centers_
-    # Draw white circles at cluster centers
-    ax2.scatter(centers[:, 0], centers[:, 1], marker='o',
-                c="white", alpha=1, s=200, edgecolor='k')
-
-    for i, c in enumerate(centers):
-        ax2.scatter(c[0], c[1], marker='$%d$' % i, alpha=1,
-                    s=50, edgecolor='k')
-
-    ax2.set_title("The visualization of the clustered data.")
-    ax2.set_xlabel("Feature space for the 1st feature")
-    ax2.set_ylabel("Feature space for the 2nd feature")
-
-    plt.suptitle(("Silhouette analysis for KMeans clustering on sample data "
-                  "with n_clusters = %d" % n_clusters),
-                 fontsize=14, fontweight='bold')
-
-    plt.show()
-

diff --git a/python_ml/validate-detection.py b/python_ml/validate-detection.py
deleted file mode 100644 (file)
index b702721..0000000
--- a/python_ml/validate-detection.py
+++ /dev/null
@@ -1,162 +0,0 @@
-from datetime import datetime
-
-
-path = "/scratch/July-2018/experimental_result/smarthome/"
-#path = "/scratch/July-2018/experimental_result/standalone/"
-# D-Link plug
-#device = "dlink-plug/self-test"
-#fileExperiment = "dlink-plug-nov-7-2018.timestamps"
-#fileDetection = "device-side-detection"
-#fileDetection = "phone-side-detection"
-#device = "dlink-plug/timestamps"
-#fileExperiment = "dlink-plug-smarthome-nov-8-2018.timestamps"
-#fileDetection = "dlink-plug-smarthome-nov-8-2018.phone.wlan1.detections"
-#fileDetection = "dlink-plug-smarthome-nov-8-2018.phone.eth0.detections"
-#fileDetection = "dlink-plug-smarthome-nov-8-2018.device.eth0.detections"
-
-# TP-Link plug
-#device = "tplink-plug/self-test"
-#fileExperiment = "tplink-plug-nov-8-2018.timestamps"
-#fileDetection = "device-side-detection"
-#fileDetection = "phone-side-detection"
-#device = "tplink-plug/timestamps"
-#fileExperiment = "tplink-plug-smarthome-nov-9-2018.timestamps"
-#fileDetection = "tplink-plug-smarthome-nov-9-2018.eth0.device.detections"
-#fileDetection = "tplink-plug-smarthome-nov-9-2018.wlan1.phone.detections"
-
-# D-Link siren
-#device = "dlink-siren/self-test"
-#fileExperiment = "dlink-siren-nov-9-2018.timestamps"
-#fileDetection = "phone-side-detection"
-#device = "dlink-siren/timestamps"
-#fileExperiment = "dlink-siren-smarthome-nov-10-2018.timestamps"
-#fileDetection = "dlink-siren-smarthome-nov-10-2018.eth0.phone.detections"
-
-# Kwikset door lock
-#device = "kwikset-doorlock/self-test"
-#fileExperiment = "kwikset-doorlock-nov-10-2018.timestamps"
-#fileDetection = "phone-side-detection"
-#device = "kwikset-doorlock/timestamps"
-#fileExperiment = "kwikset-doorlock-smarthome-nov-10-2018.timestamps"
-#fileDetection = "kwikset-doorlock-smarthome-nov-10-2018.eth0.phone.detections"
-
-# SmartThings plug
-#device = "st-plug/self-test"
-#fileExperiment = "st-plug-nov-13-2018.timestamps"
-#fileDetection = "phone-side-detection"
-#device = "st-plug/timestamps"
-#fileExperiment = "st-plug-smarthome-nov-13-2018.timestamps"
-#fileDetection = "st-plug-smarthome-nov-13-2018.eth0.phone.detections"
-
-# Arlo camera
-#device = "arlo-camera/self-test"
-#fileExperiment = "arlo-camera-nov-13-2018.timestamps"
-#fileDetection = "phone-side-detection"
-#device = "arlo-camera/timestamps"
-#fileExperiment = "arlo-camera-smarthome-nov-15-2018.timestamps"
-#fileDetection = "arlo-camera-smarthome-nov-15-2018.phone.eth0.detections"
-#fileDetection = "arlo-camera-smarthome-nov-15-2018.phone.eth0.detections.range-based.complete"
-
-# Nest Thermostat
-#device = "nest-thermostat/self-test"
-#fileExperiment = "nest-thermostat-nov-15-2018.timestamps"
-#fileDetection = "phone-side-detection"
-device = "nest-thermostat/timestamps"
-fileExperiment = "nest-thermostat-smarthome-nov-16-2018.timestamps"
-#fileDetection = "nest-thermostat-smarthome-nov-16-2018.phone.eth0.detections"
-fileDetection = "nest-thermostat-smarthome-nov-16-2018.phone.eth0.range-based.detections"
-
-# TP-Link Bulb
-#device = "tplink-bulb/self-test"
-#fileExperiment = "tplink-bulb-nov-16-2018.timestamps"
-#fileDetection = "phone-side-detection"
-#device = "tplink-bulb/timestamps"
-#fileExperiment = "tplink-bulb-smarthome-nov-19-2018.timestamps"
-#fileDetection = "tplink-bulb-smarthome-nov-19-2018.phone.wlan1.detections"
-
-# Hue bulb
-#device = "hue-bulb/self-test"
-#fileExperiment = "hue-bulb-aug-7-2018.timestamps"
-#fileDetection = "phone-side-detection"
-
-# WeMo plug
-#device = "wemo-plug/self-test"
-#fileExperiment = "wemo-plug-nov-20-2018.timestamps"
-#fileDetection = "phone-side-detection"
-#device = "wemo-plug/timestamps"
-#fileExperiment = "wemo-plug-smarthome-nov-21-2018.timestamps"
-#fileDetection = "wemo-plug-smarthome-nov-21-2018.phone.wlan1.detections"
-
-# WeMo Insight plug
-#device = "wemo-insight-plug/self-test"
-#fileExperiment = "wemo-insight-plug-nov-21-2018.timestamps"
-#fileDetection = "phone-side-detection"
-#device = "wemo-insight-plug/timestamps"
-#fileExperiment = "wemo-insight-plug-smarthome-nov-22-2018.timestamps"
-#fileDetection = "wemo-insight-plug-smarthome-nov-22-2018.phone.wlan1.detections"
-
-# Blossom sprinkler
-#device = "blossom-sprinkler/self-test"
-#fileExperiment = "blossom-sprinkler-standalone-jan-9-2019.timestamps"
-#fileExperiment = "blossom-sprinkler-standalone-jan-11-2019.timestamps"
-#fileExperiment = "blossom-sprinkler-standalone-jan-14-2019.timestamps"
-#fileDetection = "phone-side-detection"
-#fileDetection = "device-side-detection"
-#device = "blossom-sprinkler/timestamps"
-#fileExperiment = "blossom-sprinkler-smarthome-jan-10-2019.timestamps"
-#fileExperiment = "blossom-sprinkler-smarthome-jan-11-2019.timestamps"
-#fileExperiment = "blossom-sprinkler-smarthome-jan-14-2019.timestamps"
-#fileDetection = "blossom-sprinkler-smarthome-jan-10-2019.device.wlan1.detections"
-#fileDetection = "blossom-sprinkler-smarthome-jan-11-2019.phone.wlan1.detections"
-#fileDetection = "blossom-sprinkler-smarthome-jan-14-2019.device.eth0.detections"
-#fileDetection = "blossom-sprinkler-smarthome-jan-14-2019.phone.eth0.detections"
-
-TIME_WINDOW = 15 # detection/signature window of 15 seconds
-#NEG_TIME_WINDOW = -15 # detection/signature window of 15 seconds
-
-# Open training timestamps file and store into a list
-with open(path + device + "/" + fileExperiment, "r") as experiment:
-       tsExperimentList = []
-       for line in experiment:
-               # Format "%m/%d/%Y %I:%M:%S %p"
-               tsE = datetime.strptime(line, "%m/%d/%Y %I:%M:%S %p\n")
-               tsExperimentList.append(tsE)
-
-# Open detection timestamps file and store into a list
-with open(path + device + "/" + fileDetection, "r") as detection:
-       tsDetectionList = []
-       for line in detection:
-               # Format "%b %d, %Y %I:%M:%S %p"
-               tsD = datetime.strptime(line, "%b %d, %Y %I:%M:%S %p\n")
-               tsDetectionList.append(tsD)
-               
-if (len(tsExperimentList) > len(tsDetectionList)):
-       maxTimestamps = len(tsExperimentList)
-else:
-       maxTimestamps = len(tsDetectionList)
-
-i = 0
-j = 0
-while i < maxTimestamps:
-       if(len(tsExperimentList) <= i or len(tsDetectionList) <= j):
-               break;
-       
-       tsE = tsExperimentList[i]
-       tsD = tsDetectionList[j]
-       # Detection is always a bit later than training trigger
-       delta1 = tsD - tsE
-       delta2 = tsE - tsD
-       #print("tsE: " + str(tsE) + " - tsD: " + str(tsD) + " - delta1: " + str(delta1.seconds) + " - delta2: " + str(delta2.seconds))
-       # The following happens when we could detect less triggers than the experiment
-       if (delta1.seconds > TIME_WINDOW and delta2.seconds > TIME_WINDOW):
-               print("Missing trigger at line: " + str(i) + ", t_experiment: " + str(tsE) + " and t_detection: " + str(tsD))
-               #print(str(tsD))
-               i = i + 1
-       # The following should not happen (we have more detected triggers than the experiment)
-       #elif (delta.seconds < NEG_TIME_WINDOW):
-       #       print("Mismatch at t_experiment: " + str(tsE) + " and t_detection: " + str(tsD))
-       #       j = j + 1
-       i = i + 1
-       j = j + 1
-
-print("Done parsing: " + str(i) + " lines")

diff --git a/run_scripts/ia_analysis_run.sh b/run_scripts/ia_analysis_run.sh
deleted file mode 100755 (executable)
index c40e40e..0000000
--- a/run_scripts/ia_analysis_run.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/sh
-
-# ia_analysis = inter-arrival time analysis
-# Check input arguments - we need 2 arguments
-if [ $# -ne 2 ]
-    then
-        echo "Usage: ia_analysis_run.sh <path-and-json-file, e.g./a/b/c/d.json> <path-to-output-file, e.g. result_ia/>"
-        exit 1
-fi
-
-# Check result folder and create one if it does not exist yet
-[ -d $2 ] || mkdir $2
-
-# Run the analysis
-python ../parser/parse_inter_arrival_time.py $1 $2/wemo_switch WeMo_Switch 94:10:3e:36:60:09
-python ../parser/parse_inter_arrival_time.py $1 $2/wemo_insight WeMo_Insight 14:91:82:25:10:77
-python ../parser/parse_inter_arrival_time.py $1 $2/tplink_switch TPLink_Switch 50:c7:bf:33:1f:09
-python ../parser/parse_inter_arrival_time.py $1 $2/dlink_switch DLink_Switch 90:8d:78:e3:81:0c
-python ../parser/parse_inter_arrival_time.py $1 $2/amcrest_camera Amcrest_Camera 3c:ef:8c:6f:79:5a
-python ../parser/parse_inter_arrival_time.py $1 $2/netgear_arlo_camera Netgear_Arlo_Camera 40:5d:82:2f:50:2a
-python ../parser/parse_inter_arrival_time.py $1 $2/lifx_lightbulb_1 Lifx_LightBulb_1 d0:73:d5:12:8e:30
-python ../parser/parse_inter_arrival_time.py $1 $2/lifx_lightbulb_2 Lifx_LightBulb_2 d0:73:d5:02:41:da
-python ../parser/parse_inter_arrival_time.py $1 $2/philips_hue Philips_Hue 00:17:88:69:ee:e4
-python ../parser/parse_inter_arrival_time.py $1 $2/tplink_lightbulb TPLink_LightBulb 50:c7:bf:59:d5:84
-python ../parser/parse_inter_arrival_time.py $1 $2/nxeco_sprinkler Nxeco_Sprinkler ac:cf:23:5a:9c:e2
-python ../parser/parse_inter_arrival_time.py $1 $2/blossom_sprinkler Blossom_Sprinkler e4:95:6e:b0:20:39
-python ../parser/parse_inter_arrival_time.py $1 $2/dlink_alarm DLink_Alarm c4:12:f5:de:38:20
-python ../parser/parse_inter_arrival_time.py $1 $2/dlink_motion_sensor DLink_Motion_Sensor c4:12:f5:e3:dc:17
-python ../parser/parse_inter_arrival_time.py $1 $2/nest_thermostat Nest_Thermostat 18:b4:30:bf:34:7e
-python ../parser/parse_inter_arrival_time.py $1 $2/amazon_echo_dot Amazon_Echo_Dot 68:37:e9:d2:26:0d
-python ../parser/parse_inter_arrival_time.py $1 $2/smartthings_hub SmartThings_Hub d0:52:a8:a3:60:0f
-

diff --git a/run_scripts/ps_analysis_run.sh b/run_scripts/ps_analysis_run.sh
deleted file mode 100755 (executable)
index 6aca3cc..0000000
--- a/run_scripts/ps_analysis_run.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/sh
-
-# ps_analysis = packet size analysis
-# Check input arguments - we need 2 arguments
-if [ $# -ne 2 ]
-    then
-        echo "Usage: ia_analysis_run.sh <path-and-json-file, e.g./a/b/c/d.json> <path-to-output-file, e.g. result_ps/>"
-        exit 1
-fi
-
-# Check result folder and create one if it does not exist yet
-[ -d $2 ] || mkdir $2
-
-# Run the analysis
-python ../parser/parse_packet_size.py $1 $2/wemo_switch WeMo_Switch 94:10:3e:36:60:09
-python ../parser/parse_packet_size.py $1 $2/wemo_insight WeMo_Insight 14:91:82:25:10:77
-python ../parser/parse_packet_size.py $1 $2/tplink_switch TPLink_Switch 50:c7:bf:33:1f:09
-python ../parser/parse_packet_size.py $1 $2/dlink_switch DLink_Switch 90:8d:78:e3:81:0c
-python ../parser/parse_packet_size.py $1 $2/amcrest_camera Amcrest_Camera 3c:ef:8c:6f:79:5a
-python ../parser/parse_packet_size.py $1 $2/netgear_arlo_camera Netgear_Arlo_Camera 40:5d:82:2f:50:2a
-python ../parser/parse_packet_size.py $1 $2/lifx_lightbulb_1 Lifx_LightBulb_1 d0:73:d5:12:8e:30
-python ../parser/parse_packet_size.py $1 $2/lifx_lightbulb_2 Lifx_LightBulb_2 d0:73:d5:02:41:da
-python ../parser/parse_packet_size.py $1 $2/philips_hue Philips_Hue 00:17:88:69:ee:e4
-python ../parser/parse_packet_size.py $1 $2/tplink_lightbulb TPLink_LightBulb 50:c7:bf:59:d5:84
-python ../parser/parse_packet_size.py $1 $2/nxeco_sprinkler Nxeco_Sprinkler ac:cf:23:5a:9c:e2
-python ../parser/parse_packet_size.py $1 $2/blossom_sprinkler Blossom_Sprinkler e4:95:6e:b0:20:39
-python ../parser/parse_packet_size.py $1 $2/dlink_alarm DLink_Alarm c4:12:f5:de:38:20
-python ../parser/parse_packet_size.py $1 $2/dlink_motion_sensor DLink_Motion_Sensor c4:12:f5:e3:dc:17
-python ../parser/parse_packet_size.py $1 $2/nest_thermostat Nest_Thermostat 18:b4:30:bf:34:7e
-python ../parser/parse_packet_size.py $1 $2/amazon_echo_dot Amazon_Echo_Dot 68:37:e9:d2:26:0d
-python ../parser/parse_packet_size.py $1 $2/smartthings_hub SmartThings_Hub d0:52:a8:a3:60:0f
-

diff --git a/run_scripts/tb_analysis_run.sh b/run_scripts/tb_analysis_run.sh
deleted file mode 100755 (executable)
index 2251985..0000000
--- a/run_scripts/tb_analysis_run.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/sh
-
-# tb_analysis = total bytes analysis
-# Check input arguments - we need 2 arguments
-if [ $# -ne 2 ]
-    then
-        echo "Usage: ia_analysis_run.sh <path-and-json-file, e.g./a/b/c/d.json> <path-to-output-file, e.g. result_tb/>"
-        exit 1
-fi
-
-# Check result folder and create one if it does not exist yet
-[ -d $2 ] || mkdir $2
-
-# Run the analysis
-python ../parser/parse_packet_total_bytes.py $1 $2/wemo_switch WeMo_Switch 94:10:3e:36:60:09
-python ../parser/parse_packet_total_bytes.py $1 $2/wemo_insight WeMo_Insight 14:91:82:25:10:77
-python ../parser/parse_packet_total_bytes.py $1 $2/tplink_switch TPLink_Switch 50:c7:bf:33:1f:09
-python ../parser/parse_packet_total_bytes.py $1 $2/dlink_switch DLink_Switch 90:8d:78:e3:81:0c
-python ../parser/parse_packet_total_bytes.py $1 $2/amcrest_camera Amcrest_Camera 3c:ef:8c:6f:79:5a
-python ../parser/parse_packet_total_bytes.py $1 $2/netgear_arlo_camera Netgear_Arlo_Camera 40:5d:82:2f:50:2a
-python ../parser/parse_packet_total_bytes.py $1 $2/lifx_lightbulb_1 Lifx_LightBulb_1 d0:73:d5:12:8e:30
-python ../parser/parse_packet_total_bytes.py $1 $2/lifx_lightbulb_2 Lifx_LightBulb_2 d0:73:d5:02:41:da
-python ../parser/parse_packet_total_bytes.py $1 $2/philips_hue Philips_Hue 00:17:88:69:ee:e4
-python ../parser/parse_packet_total_bytes.py $1 $2/tplink_lightbulb TPLink_LightBulb 50:c7:bf:59:d5:84
-python ../parser/parse_packet_total_bytes.py $1 $2/nxeco_sprinkler Nxeco_Sprinkler ac:cf:23:5a:9c:e2
-python ../parser/parse_packet_total_bytes.py $1 $2/blossom_sprinkler Blossom_Sprinkler e4:95:6e:b0:20:39
-python ../parser/parse_packet_total_bytes.py $1 $2/dlink_alarm DLink_Alarm c4:12:f5:de:38:20
-python ../parser/parse_packet_total_bytes.py $1 $2/dlink_motion_sensor DLink_Motion_Sensor c4:12:f5:e3:dc:17
-python ../parser/parse_packet_total_bytes.py $1 $2/nest_thermostat Nest_Thermostat 18:b4:30:bf:34:7e
-python ../parser/parse_packet_total_bytes.py $1 $2/amazon_echo_dot Amazon_Echo_Dot 68:37:e9:d2:26:0d
-python ../parser/parse_packet_total_bytes.py $1 $2/smartthings_hub SmartThings_Hub d0:52:a8:a3:60:0f
-

diff --git a/run_scripts/ts_analysis_run.sh b/run_scripts/ts_analysis_run.sh
deleted file mode 100755 (executable)
index c448e16..0000000
--- a/run_scripts/ts_analysis_run.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/sh
-
-# ts_analysis = timestamp analysis
-# Check input arguments - we need 2 arguments
-if [ $# -ne 2 ]
-    then
-        echo "Usage: ts_analysis_run.sh <path-and-json-file, e.g./a/b/c/d.json> <path-to-output-file, e.g. result_ts/>"
-        exit 1
-fi
-
-# Check result folder and create one if it does not exist yet
-[ -d $2 ] || mkdir $2
-
-# Run the analysis
-python ../parser/parse_packet_frequency.py $1 $2/wemo_switch WeMo_Switch 94:10:3e:36:60:09
-python ../parser/parse_packet_frequency.py $1 $2/wemo_insight WeMo_Insight 14:91:82:25:10:77
-python ../parser/parse_packet_frequency.py $1 $2/tplink_switch TPLink_Switch 50:c7:bf:33:1f:09
-python ../parser/parse_packet_frequency.py $1 $2/dlink_switch DLink_Switch 90:8d:78:e3:81:0c
-python ../parser/parse_packet_frequency.py $1 $2/amcrest_camera Amcrest_Camera 3c:ef:8c:6f:79:5a
-python ../parser/parse_packet_frequency.py $1 $2/netgear_arlo_camera Netgear_Arlo_Camera 40:5d:82:2f:50:2a
-python ../parser/parse_packet_frequency.py $1 $2/lifx_lightbulb_1 Lifx_LightBulb_1 d0:73:d5:12:8e:30
-python ../parser/parse_packet_frequency.py $1 $2/lifx_lightbulb_2 Lifx_LightBulb_2 d0:73:d5:02:41:da
-python ../parser/parse_packet_frequency.py $1 $2/philips_hue Philips_Hue 00:17:88:69:ee:e4
-python ../parser/parse_packet_frequency.py $1 $2/tplink_lightbulb TPLink_LightBulb 50:c7:bf:59:d5:84
-python ../parser/parse_packet_frequency.py $1 $2/nxeco_sprinkler Nxeco_Sprinkler ac:cf:23:5a:9c:e2
-python ../parser/parse_packet_frequency.py $1 $2/blossom_sprinkler Blossom_Sprinkler e4:95:6e:b0:20:39
-python ../parser/parse_packet_frequency.py $1 $2/dlink_alarm DLink_Alarm c4:12:f5:de:38:20
-python ../parser/parse_packet_frequency.py $1 $2/dlink_motion_sensor DLink_Motion_Sensor c4:12:f5:e3:dc:17
-python ../parser/parse_packet_frequency.py $1 $2/nest_thermostat Nest_Thermostat 18:b4:30:bf:34:7e
-python ../parser/parse_packet_frequency.py $1 $2/amazon_echo_dot Amazon_Echo_Dot 68:37:e9:d2:26:0d
-python ../parser/parse_packet_frequency.py $1 $2/smartthings_hub SmartThings_Hub d0:52:a8:a3:60:0f
-