diff --git a/docs/using-mapping-network-events.asciidoc b/docs/using-mapping-network-events.asciidoc
index 90986f6a2f..d98e9197c2 100644
--- a/docs/using-mapping-network-events.asciidoc
+++ b/docs/using-mapping-network-events.asciidoc
@@ -79,7 +79,7 @@ Looking back at the original event, it shows the source device is the DNS client
 ----
   "client": {
     "ip": "192.168.86.222",
-    "port": 64734
+    "port": 54162
   }
 ----