join() when active malware
capture network traffic for 60 seconds