['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 62409, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 183, flow_bytes_toclient: 422, flow_age: 66, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 181, flow_bytes_toclient: 421, flow_age: 76, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 105, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 147, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 171, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 81, flow_bytes_toclient: 146, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 324, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 205, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 175, flow_bytes_toclient: 298, flow_age: 89, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 108, flow_bytes_toclient: 164, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 102, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 192, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 112, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 139, flow_bytes_toclient: 221, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 103, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 272, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 149, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 164, flow_bytes_toclient: 295, flow_age: 168, flow_state: established, flow_reason: shutdown ; pcap_cnt: 3969190, event_type: dns, proto: UDP, dns_type: query, dns_id: 64573, dns_rrname: www.hindustantimes.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3969357, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64573, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.hindustantimes.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.hindustantimes.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 6800, dns_answers_0_rdata: www.hindustantimes.com.edgesuite.net, dns_answers_1_rrname: www.hindustantimes.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 21599, dns_answers_1_rdata: a1938.b.akamai.net, dns_answers_2_rrname: a1938.b.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 9, dns_answers_2_rdata: 38.69.238.8, dns_answers_3_rrname: a1938.b.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 9, dns_answers_3_rdata: 38.69.238.18, dns_grouped_CNAME_0: www.hindustantimes.com.edgesuite.net, dns_grouped_CNAME_1: a1938.b.akamai.net, dns_grouped_A_0: 38.69.238.8, dns_grouped_A_1: 38.69.238.18 ; pcap_cnt: 3999153, event_type: dns, proto: UDP, dns_type: query, dns_id: 7881, dns_rrname: cdn.appdynamics.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 3999183, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7881, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.appdynamics.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.appdynamics.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 52.84.145.232, dns_answers_1_rrname: cdn.appdynamics.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.145.246, dns_answers_2_rrname: cdn.appdynamics.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.145.228, dns_answers_3_rrname: cdn.appdynamics.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.145.100, dns_answers_4_rrname: cdn.appdynamics.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.145.175, dns_answers_5_rrname: cdn.appdynamics.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.145.164, dns_answers_6_rrname: cdn.appdynamics.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.145.23, dns_answers_7_rrname: cdn.appdynamics.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.145.152, dns_grouped_A_0: 52.84.145.232, dns_grouped_A_1: 52.84.145.246, dns_grouped_A_2: 52.84.145.228, dns_grouped_A_3: 52.84.145.100, dns_grouped_A_4: 52.84.145.175, dns_grouped_A_5: 52.84.145.164, dns_grouped_A_6: 52.84.145.23, dns_grouped_A_7: 52.84.145.152 ; pcap_cnt: 4616666, event_type: dns, proto: UDP, dns_type: query, dns_id: 20744, dns_rrname: abs.twimg.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4616732, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20744, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: abs.twimg.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: abs.twimg.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 54, dns_answers_0_rdata: cs196.wac.edgecastcdn.net, dns_answers_1_rrname: cs196.wac.edgecastcdn.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 1136, dns_answers_1_rdata: cs2-wac.apr-8315.edgecastdns.net, dns_answers_2_rrname: cs2-wac.apr-8315.edgecastdns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 30, dns_answers_2_rdata: cs2-wac-us.8315.ecdns.net, dns_answers_3_rrname: cs2-wac-us.8315.ecdns.net, dns_answers_3_rrtype: CNAME, dns_answers_3_ttl: 160, dns_answers_3_rdata: cs45.wac.edgecastcdn.net, dns_answers_4_rrname: cs45.wac.edgecastcdn.net, dns_answers_4_rrtype: AAAA, dns_answers_4_ttl: 2991, dns_answers_4_rdata: 2606:2800:0220:1410:0489:141e:20bb:12f6, dns_grouped_AAAA_0: 2606:2800:0220:1410:0489:141e:20bb:12f6, dns_grouped_CNAME_0: cs196.wac.edgecastcdn.net, dns_grouped_CNAME_1: cs2-wac.apr-8315.edgecastdns.net, dns_grouped_CNAME_2: cs2-wac-us.8315.ecdns.net, dns_grouped_CNAME_3: cs45.wac.edgecastcdn.net ; pcap_cnt: 4635750, event_type: dns, proto: UDP, dns_type: query, dns_id: 36535, dns_rrname: 169.3.197.205.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 2 ; pcap_cnt: 4635780, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36535, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 169.3.197.205.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 3.197.205.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1775, dns_authorities_0_soa_mname: ns1.hostingsvcs.com, dns_authorities_0_soa_rname: pmpadmin.neustar.biz, dns_authorities_0_soa_serial: 2013072001, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 86400, dns_authorities_0_soa_expire: 86400, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 4888783, event_type: dns, proto: UDP, dns_type: query, dns_id: 64753, dns_rrname: bolt.v.dropbox.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4888989, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64753, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: bolt.v.dropbox.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: bolt.v.dropbox.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 162.125.18.133, dns_grouped_A_0: 162.125.18.133 ; pcap_cnt: 5190626, event_type: dns, proto: UDP, dns_type: query, dns_id: 3475, dns_rrname: worldstarhiphop.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5190627, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3475, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: worldstarhiphop.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: worldstarhiphop.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 179, dns_authorities_0_soa_mname: ns10.dnsmadeeasy.com, dns_authorities_0_soa_rname: dns.dnsmadeeasy.com, dns_authorities_0_soa_serial: 2009011727, dns_authorities_0_soa_refresh: 43200, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 5251349, event_type: dns, proto: UDP, dns_type: query, dns_id: 22091, dns_rrname: cdnjs.cloudflare.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5251419, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22091, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdnjs.cloudflare.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdnjs.cloudflare.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 104.19.193.102, dns_answers_1_rrname: cdnjs.cloudflare.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 104.19.196.102, dns_answers_2_rrname: cdnjs.cloudflare.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 299, dns_answers_2_rdata: 104.19.195.102, dns_answers_3_rrname: cdnjs.cloudflare.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 299, dns_answers_3_rdata: 104.19.194.102, dns_answers_4_rrname: cdnjs.cloudflare.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 299, dns_answers_4_rdata: 104.19.192.102, dns_grouped_A_0: 104.19.193.102, dns_grouped_A_1: 104.19.196.102, dns_grouped_A_2: 104.19.195.102, dns_grouped_A_3: 104.19.194.102, dns_grouped_A_4: 104.19.192.102 ; pcap_cnt: 5348636, event_type: dns, proto: UDP, dns_type: query, dns_id: 28412, dns_rrname: adx.cda.pl, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5348661, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28412, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adx.cda.pl, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: cda.pl, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 539, dns_authorities_0_soa_mname: kristin.ns.cloudflare.com, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2025084318, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 6020354, event_type: dns, proto: UDP, dns_type: query, dns_id: 31147, dns_rrname: s7.addthis.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6020485, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31147, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s7.addthis.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s7.addthis.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 51, dns_answers_0_rdata: s7.addthis.com.cdn.cloudflare.net, dns_answers_1_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 48, dns_answers_1_rdata: 104.16.21.35, dns_answers_2_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 48, dns_answers_2_rdata: 104.16.20.35, dns_answers_3_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 48, dns_answers_3_rdata: 104.16.25.35, dns_answers_4_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 48, dns_answers_4_rdata: 104.16.26.35, dns_answers_5_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 48, dns_answers_5_rdata: 104.16.17.35, dns_answers_6_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 48, dns_answers_6_rdata: 104.16.16.35, dns_answers_7_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 48, dns_answers_7_rdata: 104.16.22.35, dns_answers_8_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 48, dns_answers_8_rdata: 104.16.19.35, dns_answers_9_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 48, dns_answers_9_rdata: 104.16.24.35, dns_answers_10_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_10_rrtype: A, dns_answers_10_ttl: 48, dns_answers_10_rdata: 104.16.27.35, dns_answers_11_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_11_rrtype: A, dns_answers_11_ttl: 48, dns_answers_11_rdata: 104.16.18.35, dns_answers_12_rrname: s7.addthis.com.cdn.cloudflare.net, dns_answers_12_rrtype: A, dns_answers_12_ttl: 48, dns_answers_12_rdata: 104.16.23.35, dns_grouped_A_0: 104.16.21.35, dns_grouped_A_1: 104.16.20.35, dns_grouped_A_2: 104.16.25.35, dns_grouped_A_3: 104.16.26.35, dns_grouped_A_4: 104.16.17.35, dns_grouped_A_5: 104.16.16.35, dns_grouped_A_6: 104.16.22.35, dns_grouped_A_7: 104.16.19.35, dns_grouped_A_8: 104.16.24.35, dns_grouped_A_9: 104.16.27.35, dns_grouped_A_10: 104.16.18.35, dns_grouped_A_11: 104.16.23.35, dns_grouped_CNAME_0: s7.addthis.com.cdn.cloudflare.net ; pcap_cnt: 6249082, event_type: dns, proto: UDP, dns_type: query, dns_id: 43009, dns_rrname: service.weather.microsoft.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6249123, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43009, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: service.weather.microsoft.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: service.weather.microsoft.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 840, dns_answers_0_rdata: wildcard.weather.microsoft.com.edgekey.net, dns_answers_1_rrname: wildcard.weather.microsoft.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 100, dns_answers_1_rdata: e7070.g.akamaiedge.net, dns_answers_2_rrname: e7070.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.194.141.101, dns_grouped_A_0: 23.194.141.101, dns_grouped_CNAME_0: wildcard.weather.microsoft.com.edgekey.net, dns_grouped_CNAME_1: e7070.g.akamaiedge.net ; pcap_cnt: 6355262, event_type: dns, proto: UDP, dns_type: query, dns_id: 43099, dns_rrname: platform-eb.twitter.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6355263, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43099, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: platform-eb.twitter.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: twitter.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1, dns_authorities_0_soa_mname: ns1.p26.dynect.net, dns_authorities_0_soa_rname: zone-admin.dyndns.com, dns_authorities_0_soa_serial: 2007136037, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6373801, event_type: dns, proto: UDP, dns_type: query, dns_id: 23204, dns_rrname: d.turn.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6373858, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23204, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d.turn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d.turn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 457, dns_answers_0_rdata: d.turn.com.akadns.net, dns_answers_1_rrname: d.turn.com.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 66, dns_answers_1_rdata: 50.116.194.23, dns_grouped_A_0: 50.116.194.23, dns_grouped_CNAME_0: d.turn.com.akadns.net ; pcap_cnt: 6443836, event_type: dns, proto: UDP, dns_type: query, dns_id: 37384, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6443870, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37384, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2001:4998:0058:4904:0000:0000:0000:7000, dns_answers_1_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 1, dns_answers_1_rdata: 2001:4998:0058:4904:0000:0000:0000:6000, dns_grouped_AAAA_0: 2001:4998:0058:4904:0000:0000:0000:7000, dns_grouped_AAAA_1: 2001:4998:0058:4904:0000:0000:0000:6000 ; pcap_cnt: 6532857, event_type: dns, proto: UDP, dns_type: query, dns_id: 35562, dns_rrname: ssl.gstatic.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6532860, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35562, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssl.gstatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ssl.gstatic.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 163, dns_answers_0_rdata: 172.217.10.227, dns_grouped_A_0: 172.217.10.227 ; pcap_cnt: 6744559, event_type: dns, proto: UDP, dns_type: query, dns_id: 35382, dns_rrname: ust-servlet.dataxu.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6744607, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35382, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ust-servlet.dataxu.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ust-servlet.dataxu.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2873, dns_answers_0_rdata: UST-Servlet-ELB-971968363.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: UST-Servlet-ELB-971968363.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 34.192.74.33, dns_answers_2_rrname: UST-Servlet-ELB-971968363.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.200.132.11, dns_grouped_CNAME_0: UST-Servlet-ELB-971968363.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 34.192.74.33, dns_grouped_A_1: 52.200.132.11 ; pcap_cnt: 7536967, event_type: dns, proto: UDP, dns_type: query, dns_id: 674, dns_rrname: e6913.dscx.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7537011, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 674, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e6913.dscx.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e6913.dscx.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 23.203.96.167, dns_grouped_A_0: 23.203.96.167 ; pcap_cnt: 7822563, event_type: dns, proto: UDP, dns_type: query, dns_id: 11617, dns_rrname: production-analytics-collector-592917094.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7822564, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11617, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: production-analytics-collector-592917094.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 16, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7996630, event_type: dns, proto: UDP, dns_type: query, dns_id: 40290, dns_rrname: www.google.co.ma, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7996634, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40290, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.google.co.ma, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.google.co.ma, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.10.131, dns_grouped_A_0: 172.217.10.131 ; pcap_cnt: 8396144, event_type: dns, proto: UDP, dns_type: query, dns_id: 5232, dns_rrname: choices-or.truste.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8396157, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5232, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: choices-or.truste.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: choices-or.truste.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 42, dns_answers_0_rdata: adchoices-icon-vpc-2070262211.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: adchoices-icon-vpc-2070262211.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 48, dns_answers_1_rdata: 52.206.75.197, dns_answers_2_rrname: adchoices-icon-vpc-2070262211.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 48, dns_answers_2_rdata: 34.203.65.198, dns_answers_3_rrname: adchoices-icon-vpc-2070262211.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 48, dns_answers_3_rdata: 34.228.252.63, dns_answers_4_rrname: adchoices-icon-vpc-2070262211.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 48, dns_answers_4_rdata: 52.2.169.227, dns_answers_5_rrname: adchoices-icon-vpc-2070262211.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 48, dns_answers_5_rdata: 52.22.182.81, dns_answers_6_rrname: adchoices-icon-vpc-2070262211.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 48, dns_answers_6_rdata: 54.208.233.154, dns_answers_7_rrname: adchoices-icon-vpc-2070262211.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 48, dns_answers_7_rdata: 54.88.230.78, dns_grouped_A_0: 52.206.75.197, dns_grouped_A_1: 34.203.65.198, dns_grouped_A_2: 34.228.252.63, dns_grouped_A_3: 52.2.169.227, dns_grouped_A_4: 52.22.182.81, dns_grouped_A_5: 54.208.233.154, dns_grouped_A_6: 54.88.230.78, dns_grouped_CNAME_0: adchoices-icon-vpc-2070262211.us-east-1.elb.amazonaws.com ; pcap_cnt: 9753406, event_type: dns, proto: UDP, dns_type: query, dns_id: 13604, dns_rrname: logc187.xiti.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9753661, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13604, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: logc187.xiti.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: xiti.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 203, dns_authorities_0_soa_mname: meucci.atinternet.com, dns_authorities_0_soa_rname: domaine.xiti.com, dns_authorities_0_soa_serial: 2890498243, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 120 ; pcap_cnt: 9918672, event_type: dns, proto: UDP, dns_type: query, dns_id: 47880, dns_rrname: ums.adtech.de, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9918673, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47880, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ums.adtech.de, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adtech.de, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 62169, dns_authorities_0_soa_mname: pdns160.ultradns.net, dns_authorities_0_soa_rname: datacenter.adtech.de, dns_authorities_0_soa_serial: 2017020355, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 9941179, event_type: dns, proto: UDP, dns_type: query, dns_id: 59100, dns_rrname: yandex.ru, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 9941181, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59100, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: yandex.ru, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: yandex.ru, dns_answers_0_rrtype: A, dns_answers_0_ttl: 148, dns_answers_0_rdata: 5.255.255.60, dns_answers_1_rrname: yandex.ru, dns_answers_1_rrtype: A, dns_answers_1_ttl: 148, dns_answers_1_rdata: 5.255.255.80, dns_answers_2_rrname: yandex.ru, dns_answers_2_rrtype: A, dns_answers_2_ttl: 148, dns_answers_2_rdata: 77.88.55.80, dns_answers_3_rrname: yandex.ru, dns_answers_3_rrtype: A, dns_answers_3_ttl: 148, dns_answers_3_rdata: 77.88.55.70, dns_grouped_A_0: 5.255.255.60, dns_grouped_A_1: 5.255.255.80, dns_grouped_A_2: 77.88.55.80, dns_grouped_A_3: 77.88.55.70
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.