['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61039, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 171, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 97, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 158, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 102, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 152, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 107, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 102, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 119, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 136, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 109, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 206, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 186, flow_bytes_toclient: 330, flow_age: 142, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 149, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 111, flow_bytes_toclient: 177, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 226, flow_bytes_toclient: 370, flow_age: 13, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 136, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 138, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 284, flow_bytes_toclient: 408, flow_age: 160, flow_state: established, flow_reason: timeout ; pcap_cnt: 79244, event_type: dns, proto: UDP, dns_type: query, dns_id: 23189, dns_rrname: tiles.services.mozilla.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 79248, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23189, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tiles.services.mozilla.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tiles.services.mozilla.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: tiles.r53-2.services.mozilla.com, dns_answers_1_rrname: tiles.r53-2.services.mozilla.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 2, dns_answers_1_rdata: 35.167.184.4, dns_answers_2_rrname: tiles.r53-2.services.mozilla.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 2, dns_answers_2_rdata: 52.10.50.117, dns_answers_3_rrname: tiles.r53-2.services.mozilla.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 2, dns_answers_3_rdata: 52.38.199.186, dns_grouped_A_0: 35.167.184.4, dns_grouped_A_1: 52.10.50.117, dns_grouped_A_2: 52.38.199.186, dns_grouped_CNAME_0: tiles.r53-2.services.mozilla.com ; pcap_cnt: 291780, event_type: dns, proto: UDP, dns_type: query, dns_id: 33062, dns_rrname: 216.27.16.104.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 291845, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33062, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 216.27.16.104.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR ; pcap_cnt: 349625, event_type: dns, proto: UDP, dns_type: query, dns_id: 22236, dns_rrname: r-scale-88.dcs.redcdn.pl, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 349666, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22236, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: r-scale-88.dcs.redcdn.pl, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: dcs.redcdn.pl, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 298, dns_authorities_0_soa_mname: redir0.redcdn.pl, dns_authorities_0_soa_rname: info.atendesoftware.pl, dns_authorities_0_soa_serial: 2017051701, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 86400, dns_authorities_0_soa_expire: 2592000, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 588600, event_type: dns, proto: UDP, dns_type: query, dns_id: 13379, dns_rrname: www.1111.com.tw, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 588867, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13379, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.1111.com.tw, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.1111.com.tw, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1367, dns_answers_0_rdata: 202.153.190.10, dns_grouped_A_0: 202.153.190.10 ; pcap_cnt: 5597849, event_type: dns, proto: UDP, dns_type: query, dns_id: 694, dns_rrname: 137.71.199.34.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 5597897, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 694, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 137.71.199.34.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 137.71.199.34.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 184, dns_answers_0_rdata: ec2-34-199-71-137.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-34-199-71-137.compute-1.amazonaws.com ; pcap_cnt: 6884852, event_type: dns, proto: UDP, dns_type: query, dns_id: 4974, dns_rrname: static.eu.criteo.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6884864, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4974, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static.eu.criteo.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: static.eu.criteo.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 175, dns_answers_0_rdata: 178.250.0.78, dns_grouped_A_0: 178.250.0.78 ; pcap_cnt: 7058254, event_type: dns, proto: UDP, dns_type: query, dns_id: 4928, dns_rrname: spug33000.pubmatic.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7058258, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4928, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: spug33000.pubmatic.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: pubmatic.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 37, dns_authorities_0_soa_mname: ns1.p29.dynect.net, dns_authorities_0_soa_rname: anand.pubmatic.com, dns_authorities_0_soa_serial: 12705, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7381448, event_type: dns, proto: UDP, dns_type: query, dns_id: 35203, dns_rrname: sb.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7381520, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35203, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sb.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sb.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 94, dns_answers_0_rdata: 172.217.10.142, dns_grouped_A_0: 172.217.10.142 ; pcap_cnt: 8133523, event_type: dns, proto: UDP, dns_type: query, dns_id: 49971, dns_rrname: clients.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8133524, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49971, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: clients.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: clients.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 259, dns_answers_0_rdata: 2607:f8b0:4006:0810:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0810:0000:0000:0000:200e ; pcap_cnt: 8169954, event_type: dns, proto: UDP, dns_type: query, dns_id: 30763, dns_rrname: api-2.sender.mobi, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8169956, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30763, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: api-2.sender.mobi, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: api-2.sender.mobi, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 52.213.94.142, dns_answers_1_rrname: api-2.sender.mobi, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 34.252.191.245, dns_answers_2_rrname: api-2.sender.mobi, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.212.69.233, dns_grouped_A_0: 52.213.94.142, dns_grouped_A_1: 34.252.191.245, dns_grouped_A_2: 52.212.69.233 ; pcap_cnt: 8784932, event_type: dns, proto: UDP, dns_type: query, dns_id: 34387, dns_rrname: e3531.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8784933, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34387, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e3531.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e3531.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 23.208.168.9, dns_grouped_A_0: 23.208.168.9 ; pcap_cnt: 9152301, event_type: dns, proto: UDP, dns_type: query, dns_id: 44822, dns_rrname: sync.search.spotxchange.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9152302, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44822, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sync.search.spotxchange.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sync.search.spotxchange.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 152, dns_answers_0_rdata: sync.search-gtm.spotxchange.com.akadns.net, dns_answers_1_rrname: sync.search-gtm.spotxchange.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 154, dns_answers_1_rdata: iad02.sync.search.spotxchange.com, dns_answers_2_rrname: iad02.sync.search.spotxchange.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 144, dns_answers_2_rdata: 192.35.249.127, dns_answers_3_rrname: iad02.sync.search.spotxchange.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 144, dns_answers_3_rdata: 192.35.249.120, dns_grouped_A_0: 192.35.249.127, dns_grouped_A_1: 192.35.249.120, dns_grouped_CNAME_0: sync.search-gtm.spotxchange.com.akadns.net, dns_grouped_CNAME_1: iad02.sync.search.spotxchange.com ; pcap_cnt: 9253683, event_type: dns, proto: UDP, dns_type: query, dns_id: 14334, dns_rrname: idsync-ext-tf.rlcdn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9253727, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14334, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: idsync-ext-tf.rlcdn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: idsync-ext-tf.rlcdn.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 52.86.151.62, dns_answers_1_rrname: idsync-ext-tf.rlcdn.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 34.206.104.106, dns_answers_2_rrname: idsync-ext-tf.rlcdn.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 34.194.132.189, dns_answers_3_rrname: idsync-ext-tf.rlcdn.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 34.225.220.108, dns_answers_4_rrname: idsync-ext-tf.rlcdn.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 34.194.193.178, dns_answers_5_rrname: idsync-ext-tf.rlcdn.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 34.205.98.163, dns_answers_6_rrname: idsync-ext-tf.rlcdn.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 52.5.63.23, dns_answers_7_rrname: idsync-ext-tf.rlcdn.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 52.22.131.109, dns_grouped_A_0: 52.86.151.62, dns_grouped_A_1: 34.206.104.106, dns_grouped_A_2: 34.194.132.189, dns_grouped_A_3: 34.225.220.108, dns_grouped_A_4: 34.194.193.178, dns_grouped_A_5: 34.205.98.163, dns_grouped_A_6: 52.5.63.23, dns_grouped_A_7: 52.22.131.109 ; pcap_cnt: 9309362, event_type: dns, proto: UDP, dns_type: query, dns_id: 46819, dns_rrname: comcluster.cxense.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 9309423, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46819, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: comcluster.cxense.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: comcluster.cxense.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 23.92.189.246, dns_grouped_A_0: 23.92.189.246 ; pcap_cnt: 10052574, event_type: dns, proto: UDP, dns_type: query, dns_id: 33184, dns_rrname: rtb-xv.openx.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10052616, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33184, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rtb-xv.openx.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: openx.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 829, dns_authorities_0_soa_mname: dns1.p04.nsone.net, dns_authorities_0_soa_rname: hostmaster.nsone.net, dns_authorities_0_soa_serial: 1498865252, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 10276327, event_type: dns, proto: UDP, dns_type: query, dns_id: 20891, dns_rrname: perf-token.rubiconproject.net.akadns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10276383, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20891, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: perf-token.rubiconproject.net.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 178, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499192101, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 10595993, event_type: dns, proto: UDP, dns_type: query, dns_id: 18037, dns_rrname: e9483.a.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10596019, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18037, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e9483.a.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e9483.a.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 23.203.93.198, dns_grouped_A_0: 23.203.93.198 ; pcap_cnt: 10604822, event_type: dns, proto: UDP, dns_type: query, dns_id: 49514, dns_rrname: a7736afdd36989d209372ded2f8ed57fd.profile.jfk-m.cloudfront.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 10604824, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49514, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a7736afdd36989d209372ded2f8ed57fd.profile.jfk-m.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a7736afdd36989d209372ded2f8ed57fd.profile.jfk-m.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 54.239.219.73, dns_answers_1_rrname: a7736afdd36989d209372ded2f8ed57fd.profile.jfk-m.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 54.239.220.122, dns_answers_2_rrname: a7736afdd36989d209372ded2f8ed57fd.profile.jfk-m.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 54.239.220.35, dns_answers_3_rrname: a7736afdd36989d209372ded2f8ed57fd.profile.jfk-m.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 54.239.221.48, dns_answers_4_rrname: a7736afdd36989d209372ded2f8ed57fd.profile.jfk-m.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 54.239.219.99, dns_answers_5_rrname: a7736afdd36989d209372ded2f8ed57fd.profile.jfk-m.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 54.239.219.183, dns_answers_6_rrname: a7736afdd36989d209372ded2f8ed57fd.profile.jfk-m.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 54.239.219.99, dns_answers_7_rrname: a7736afdd36989d209372ded2f8ed57fd.profile.jfk-m.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 54.239.220.77, dns_grouped_A_0: 54.239.219.73, dns_grouped_A_1: 54.239.220.122, dns_grouped_A_2: 54.239.220.35, dns_grouped_A_3: 54.239.221.48, dns_grouped_A_4: 54.239.219.99, dns_grouped_A_5: 54.239.219.183, dns_grouped_A_6: 54.239.219.99, dns_grouped_A_7: 54.239.220.77 ; pcap_cnt: 10620919, event_type: dns, proto: UDP, dns_type: query, dns_id: 61417, dns_rrname: s0.2mdn.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10620962, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61417, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s0.2mdn.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s0.2mdn.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 14, dns_answers_0_rdata: s0-2mdn-net.l.google.com, dns_answers_1_rrname: s0-2mdn-net.l.google.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 11, dns_answers_1_rdata: 172.217.11.6, dns_grouped_CNAME_0: s0-2mdn-net.l.google.com, dns_grouped_A_0: 172.217.11.6 ; pcap_cnt: 11121371, event_type: dns, proto: UDP, dns_type: query, dns_id: 49926, dns_rrname: secure-dcr.imrworldwide.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11121496, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49926, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: secure-dcr.imrworldwide.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: secure-dcr.imrworldwide.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 27, dns_answers_0_rdata: secure-us.imrworldwide.com, dns_answers_1_rrname: secure-us.imrworldwide.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 21, dns_answers_1_rdata: 138.108.7.20, dns_grouped_CNAME_0: secure-us.imrworldwide.com, dns_grouped_A_0: 138.108.7.20 ; pcap_cnt: 11215810, event_type: dns, proto: UDP, dns_type: query, dns_id: 57655, dns_rrname: s3-us-west-2.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11215817, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57655, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s3-us-west-2.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s3-us-west-2.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.231.184.200, dns_grouped_A_0: 54.231.184.200 ; pcap_cnt: 11279342, event_type: dns, proto: UDP, dns_type: query, dns_id: 55395, dns_rrname: e8218.dscb1.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 11279387, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55395, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e8218.dscb1.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: e8218.dscb1.akamaiedge.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2600:1408:e000:0182:0000:0000:0000:201a, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 1, dns_answers_1_rdata: 2600:1408:e000:019a:0000:0000:0000:201a, dns_grouped_AAAA_0: 2600:1408:e000:0182:0000:0000:0000:201a, dns_grouped_AAAA_1: 2600:1408:e000:019a:0000:0000:0000:201a ; pcap_cnt: 11292759, event_type: dns, proto: UDP, dns_type: query, dns_id: 61429, dns_rrname: clients1.google.com, dns_rrtype: AAAA, dns_tx_id: 4 ; pcap_cnt: 11292827, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61429, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: clients1.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: clients1.google.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: clients.l.google.com, dns_answers_1_rrname: clients.l.google.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 74, dns_answers_1_rdata: 2607:f8b0:4006:0818:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0818:0000:0000:0000:200e, dns_grouped_CNAME_0: clients.l.google.com
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.