NGREP:
interface: eth0 (10.0.1.0/255.255.255.0)
filter: ( port 80 ) and ((ip || ip6) || (vlan && (ip || ip6)))
####
T 10.0.1.4:42046 -> 168.63.129.16:80 [AP] #4
  GET /machine/?comp=goalstate HTTP/1.1..Host: 168.63.129.16..Accept-Encoding: identity..x-ms-agent-name: WALinuxAgent..x-ms-version: 2012-11-30....
#
T 168.63.129.16:80 -> 10.0.1.4:42046 [AP] #5
  HTTP/1.1 200 OK..Content-Type: text/xml; charset=utf-8..Server: Microsoft-IIS/10.0..Date: Fri, 06 Jul 2018 14:51:24 GMT..Content-Length: 1859....<?xml version="1.0" encoding="utf-8"?>..<GoalState xmlns:xsi="http://www.w3
  .org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="goalstate10.xsd">..  <Version>2012-11-30</Version>..  <Incarnation>1</Incarnation>..  <Machine>..    <ExpectedState>Started</ExpectedState>..    <StopRolesDead
  lineHint>300000</StopRolesDeadlineHint>..    <LBProbePorts>..      <Port>16001</Port>..    </LBProbePorts>..    <ExpectHealthReport>FALSE</ExpectHealthReport>..  </Machine>..  <Container>..    <ContainerId>7609759c-fef1-
  4ac9-a64b-dcea5bd6b29e</ContainerId>..    <RoleInstanceList>..      <RoleInstance>..        <InstanceId>430094f1-b7d1-431a-a62d-420e214137d6._AZLX</InstanceId>..        <State>Started</State>..        <Configuration>..
          <HostingEnvironmentConfig>http://168.63.129.16:80/machine/7609759c-fef1-4ac9-a64b-dcea5bd6b29e/430094f1%2Db7d1%2D431a%2Da62d%2D420e214137d6.%5FAZLX?comp=config&amp;type=hostingEnvironmentConfig&amp;incarnation=1<
  /HostingEnvironmentConfig>..          <SharedConfig>http://168.63.129.16:80/machine/7609759c-fef1-4ac9-a64b-dcea5bd6b29e/430094f1%2Db7d1%2D431a%2Da62d%2D420e214137d6.%5FAZLX?comp=config&amp;type=sharedConfig&amp;incarnat
  ion=1</SharedConfig>..          <ExtensionsConfig>http://168.63.129.16:80/machine/7609759c-fef1-4ac9-a64b-dcea5bd6b29e/430094f1%2Db7d1%2D431a%2Da62d%2D420e214137d6.%5FAZLX?comp=config&amp;type=extensionsConfig&amp;incarn
  ation=1</ExtensionsConfig>..          <FullConfig>http://168.63.129.16:80/machine/7609759c-fef1-4ac9-a64b-dcea5bd6b29e/430094f1%2Db7d1%2D431a%2Da62d%2D420e214137d6.%5FAZLX?comp=config&amp;type=fullConfig&amp;incarnation=
  1</FullConfig>..          <ConfigName>430094f1-b7d1-431a-a62d-420e214137d6.0.430094f1-b7d1-431a-a62d-420e214137d6.0._AZLX.1.xml</ConfigName>..        </Configuration>..      </RoleInstance>..    </RoleInstanceList>..  </
  Container>..</GoalState>
########
T 10.0.1.4:42052 -> 168.63.129.16:80 [AP] #13
  GET /machine/?comp=goalstate HTTP/1.1..Host: 168.63.129.16..Accept-Encoding: identity..x-ms-agent-name: WALinuxAgent..x-ms-version: 2012-11-30....
#
T 168.63.129.16:80 -> 10.0.1.4:42052 [AP] #14
  HTTP/1.1 200 OK..Content-Type: text/xml; charset=utf-8..Server: Microsoft-IIS/10.0..Date: Fri, 06 Jul 2018 14:51:27 GMT..Content-Length: 1859....<?xml version="1.0" encoding="utf-8"?>..<GoalState xmlns:xsi="http://www.w3
  .org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="goalstate10.xsd">..  <Version>2012-11-30</Version>..  <Incarnation>1</Incarnation>..  <Machine>..    <ExpectedState>Started</ExpectedState>..    <StopRolesDead
  lineHint>300000</StopRolesDeadlineHint>..    <LBProbePorts>..      <Port>16001</Port>..    </LBProbePorts>..    <ExpectHealthReport>FALSE</ExpectHealthReport>..  </Machine>..  <Container>..    <ContainerId>7609759c-fef1-
  4ac9-a64b-dcea5bd6b29e</ContainerId>..    <RoleInstanceList>..      <RoleInstance>..        <InstanceId>430094f1-b7d1-431a-a62d-420e214137d6._AZLX</InstanceId>..        <State>Started</State>..        <Configuration>..
          <HostingEnvironmentConfig>http://168.63.129.16:80/machine/7609759c-fef1-4ac9-a64b-dcea5bd6b29e/430094f1%2Db7d1%2D431a%2Da62d%2D420e214137d6.%5FAZLX?comp=config&amp;type=hostingEnvironmentConfig&amp;incarnation=1<
  /HostingEnvironmentConfig>..          <SharedConfig>http://168.63.129.16:80/machine/7609759c-fef1-4ac9-a64b-dcea5bd6b29e/430094f1%2Db7d1%2D431a%2Da62d%2D420e214137d6.%5FAZLX?comp=config&amp;type=sharedConfig&amp;incarnat
  ion=1</SharedConfig>..          <ExtensionsConfig>http://168.63.129.16:80/machine/7609759c-fef1-4ac9-a64b-dcea5bd6b29e/430094f1%2Db7d1%2D431a%2Da62d%2D420e214137d6.%5FAZLX?comp=config&amp;type=extensionsConfig&amp;incarn
  ation=1</ExtensionsConfig>..          <<FullConfig>http://168.63.129.16:80/machine/7609759c-fef1-4ac9-a64b-dcea5bd6b29e/430094f1%2Db7d1%2D431a%2Da62d%2D420e214137d6.%5FAZLX?comp=config&amp;type=fullConfig&amp;incarnation=
  1</FullConfig>..          <ConfigName>430094f1-b7d1-431a-a62d-420e214137d6.0.430094f1-b7d1-431a-a62d-420e214137d6.0._AZLX.1.xml</ConfigName>..        </Configuration>..      </RoleInstance>..    </RoleInstanceList>..  </
  Container>..</GoalState>
########
T 10.0.1.4:42058 -> 168.63.129.16:80 [AP] #22
  GET /machine/?comp=goalstate HTTP/1.1..Host: 168.63.129.16..Accept-Encoding: identity..x-ms-agent-name: WALinuxAgent..x-ms-version: 2012-11-30....
#