Frame 5311 is the FIN/ACK sent from what we believe is something inline between our clients and the Kolide server that is enforced the 240 TCP idle timeout.