['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61769, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 182, flow_bytes_toclient: 271, flow_age: 47, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 197, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 108, flow_bytes_toclient: 164, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 81, flow_bytes_toclient: 97, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 120, flow_bytes_toclient: 202, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 181, flow_bytes_toclient: 250, flow_age: 18, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 117, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 135, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 198, flow_bytes_toclient: 242, flow_age: 188, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 138, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 211, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 120, flow_bytes_toclient: 172, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 208, flow_bytes_toclient: 402, flow_age: 121, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 302, flow_bytes_toclient: 486, flow_age: 227, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 178, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 164, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 174, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 201, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 324, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 132, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 192, flow_age: 1, flow_state: established, flow_reason: timeout ; pcap_cnt: 1177782, event_type: dns, proto: UDP, dns_type: query, dns_id: 30097, dns_rrname: a1213.g.akamai.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 1177786, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30097, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a1213.g.akamai.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamai.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 995, dns_authorities_0_soa_mname: n0g.akamai.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499343191, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 1370796, event_type: dns, proto: UDP, dns_type: query, dns_id: 57547, dns_rrname: star.c10r.facebook.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 1370969, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57547, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star.c10r.facebook.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: star.c10r.facebook.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2a03:2880:f00d:0110:face:b00c:0000:0002, dns_grouped_AAAA_0: 2a03:2880:f00d:0110:face:b00c:0000:0002 ; pcap_cnt: 2824587, event_type: dns, proto: UDP, dns_type: query, dns_id: 52012, dns_rrname: www.chicagobears.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2824605, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52012, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.chicagobears.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.chicagobears.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 110, dns_answers_0_rdata: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrname: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20047, dns_answers_1_rdata: a945.b.akamai.net, dns_answers_2_rrname: a945.b.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 5, dns_answers_2_rdata: 38.69.238.11, dns_answers_3_rrname: a945.b.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 5, dns_answers_3_rdata: 38.69.238.19, dns_grouped_CNAME_0: prod.clubs.nfl.com.edgesuite.net, dns_grouped_CNAME_1: a945.b.akamai.net, dns_grouped_A_0: 38.69.238.11, dns_grouped_A_1: 38.69.238.19 ; pcap_cnt: 2868370, event_type: dns, proto: UDP, dns_type: query, dns_id: 37119, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 2868407, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37119, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2001:4998:0058:4904:0000:0000:0000:6000, dns_answers_1_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 1, dns_answers_1_rdata: 2001:4998:0058:4904:0000:0000:0000:7000, dns_grouped_AAAA_0: 2001:4998:0058:4904:0000:0000:0000:6000, dns_grouped_AAAA_1: 2001:4998:0058:4904:0000:0000:0000:7000 ; pcap_cnt: 2915752, event_type: dns, proto: UDP, dns_type: query, dns_id: 48898, dns_rrname: www.mex.ir, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2915773, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48898, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.mex.ir, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.mex.ir, dns_answers_0_rrtype: A, dns_answers_0_ttl: 10799, dns_answers_0_rdata: 8.8.246.210, dns_grouped_A_0: 8.8.246.210 ; pcap_cnt: 4190453, event_type: dns, proto: UDP, dns_type: query, dns_id: 60627, dns_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4190485, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60627, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 26, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 4229144, event_type: dns, proto: UDP, dns_type: query, dns_id: 48185, dns_rrname: weather.excite.co.jp, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4229180, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48185, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: weather.excite.co.jp, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: weather.excite.co.jp, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3600, dns_answers_0_rdata: portal.excite.co.jp, dns_answers_1_rrname: portal.excite.co.jp, dns_answers_1_rrtype: A, dns_answers_1_ttl: 3600, dns_answers_1_rdata: 180.235.96.104, dns_grouped_CNAME_0: portal.excite.co.jp, dns_grouped_A_0: 180.235.96.104 ; pcap_cnt: 4241024, event_type: dns, proto: UDP, dns_type: query, dns_id: 40903, dns_rrname: ssl.luckyorange.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 4241048, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40903, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssl.luckyorange.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ssl.luckyorange.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 70, dns_answers_0_rdata: 104.25.76.117, dns_answers_1_rrname: ssl.luckyorange.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 70, dns_answers_1_rdata: 104.25.75.117, dns_grouped_A_0: 104.25.76.117, dns_grouped_A_1: 104.25.75.117 ; pcap_cnt: 4342223, event_type: dns, proto: UDP, dns_type: query, dns_id: 634, dns_rrname: tu.zmzjstu.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4342334, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 634, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tu.zmzjstu.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tu.zmzjstu.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 599, dns_answers_0_rdata: 173.254.198.11, dns_answers_1_rrname: tu.zmzjstu.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 599, dns_answers_1_rdata: 47.52.2.178, dns_grouped_A_0: 173.254.198.11, dns_grouped_A_1: 47.52.2.178 ; pcap_cnt: 5422117, event_type: dns, proto: UDP, dns_type: query, dns_id: 52783, dns_rrname: static.adsafeprotected.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5422164, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52783, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static.adsafeprotected.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: static.adsafeprotected.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3371, dns_answers_0_rdata: anycast.static.adsafeprotected.com, dns_answers_1_rrname: anycast.static.adsafeprotected.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 91, dns_answers_1_rdata: 69.172.216.58, dns_grouped_A_0: 69.172.216.58, dns_grouped_CNAME_0: anycast.static.adsafeprotected.com ; pcap_cnt: 5526482, event_type: dns, proto: UDP, dns_type: query, dns_id: 16214, dns_rrname: www-google-analytics.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5526532, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16214, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www-google-analytics.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www-google-analytics.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:0803:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0803:0000:0000:0000:200e ; pcap_cnt: 5557060, event_type: dns, proto: UDP, dns_type: query, dns_id: 19364, dns_rrname: ad4.adfarm1.adition.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5557074, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19364, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad4.adfarm1.adition.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ad4.adfarm1.adition.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 44, dns_answers_0_rdata: 217.79.188.46, dns_grouped_A_0: 217.79.188.46 ; pcap_cnt: 5640241, event_type: dns, proto: UDP, dns_type: query, dns_id: 40666, dns_rrname: googleads4.g.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5640299, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40666, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleads4.g.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: googleads4.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: pagead.l.doubleclick.net, dns_answers_1_rrname: pagead.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 217, dns_answers_1_rdata: 172.217.9.226, dns_grouped_A_0: 172.217.9.226, dns_grouped_CNAME_0: pagead.l.doubleclick.net ; pcap_cnt: 5661138, event_type: dns, proto: UDP, dns_type: query, dns_id: 43663, dns_rrname: track.pricespider.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5661195, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43663, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: track.pricespider.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: track.pricespider.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 198, dns_answers_0_rdata: pstrack1.trafficmanager.net, dns_answers_1_rrname: pstrack1.trafficmanager.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 18, dns_answers_1_rdata: track1.pricespider.com, dns_grouped_CNAME_0: pstrack1.trafficmanager.net, dns_grouped_CNAME_1: track1.pricespider.com, dns_authorities_0_rrname: pricespider.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 179, dns_authorities_0_soa_mname: ns10.dnsmadeeasy.com, dns_authorities_0_soa_rname: dns.dnsmadeeasy.com, dns_authorities_0_soa_serial: 2009010855, dns_authorities_0_soa_refresh: 43200, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 5725094, event_type: dns, proto: UDP, dns_type: query, dns_id: 4529, dns_rrname: asimov-win.settings.data.microsoft.com.akadns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5725097, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4529, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: asimov-win.settings.data.microsoft.com.akadns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: asimov-win.settings.data.microsoft.com.akadns.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: geo.settings.data.microsoft.com.akadns.net, dns_answers_1_rrname: geo.settings.data.microsoft.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 148, dns_answers_1_rdata: bn2.settings.data.microsoft.com.akadns.net, dns_answers_2_rrname: bn2.settings.data.microsoft.com.akadns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 234, dns_answers_2_rdata: 65.55.44.108, dns_grouped_CNAME_0: geo.settings.data.microsoft.com.akadns.net, dns_grouped_CNAME_1: bn2.settings.data.microsoft.com.akadns.net, dns_grouped_A_0: 65.55.44.108 ; pcap_cnt: 5953338, event_type: dns, proto: UDP, dns_type: query, dns_id: 45954, dns_rrname: merchant-897380121.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5953427, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45954, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: merchant-897380121.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 51, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5980105, event_type: dns, proto: UDP, dns_type: query, dns_id: 42769, dns_rrname: ocsp2.globalsign.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5980114, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42769, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp2.globalsign.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp2.globalsign.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 74, dns_answers_0_rdata: cdn.globalsigncdn.com, dns_answers_1_rrname: cdn.globalsigncdn.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 113, dns_answers_1_rdata: 104.16.26.216, dns_answers_2_rrname: cdn.globalsigncdn.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 113, dns_answers_2_rdata: 104.16.24.216, dns_answers_3_rrname: cdn.globalsigncdn.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 113, dns_answers_3_rdata: 104.16.27.216, dns_answers_4_rrname: cdn.globalsigncdn.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 113, dns_answers_4_rdata: 104.16.25.216, dns_answers_5_rrname: cdn.globalsigncdn.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 113, dns_answers_5_rdata: 104.16.28.216, dns_grouped_CNAME_0: cdn.globalsigncdn.com, dns_grouped_A_0: 104.16.26.216, dns_grouped_A_1: 104.16.24.216, dns_grouped_A_2: 104.16.27.216, dns_grouped_A_3: 104.16.25.216, dns_grouped_A_4: 104.16.28.216 ; pcap_cnt: 6035550, event_type: dns, proto: UDP, dns_type: query, dns_id: 12027, dns_rrname: clients1.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6035555, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12027, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: clients1.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: clients1.google.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 154, dns_answers_0_rdata: clients.l.google.com, dns_answers_1_rrname: clients.l.google.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 156, dns_answers_1_rdata: 216.58.219.238, dns_grouped_CNAME_0: clients.l.google.com, dns_grouped_A_0: 216.58.219.238 ; pcap_cnt: 6079829, event_type: dns, proto: UDP, dns_type: query, dns_id: 9079, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6079921, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9079, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: scontent.xx.fbcdn.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 31.13.69.203, dns_grouped_A_0: 31.13.69.203 ; pcap_cnt: 6103641, event_type: dns, proto: UDP, dns_type: query, dns_id: 6615, dns_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 6103642, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6615, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 50.16.220.202, dns_answers_1_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 50.19.121.243, dns_answers_2_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 54.225.149.201, dns_answers_3_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 50.19.223.117, dns_answers_4_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 23.21.41.78, dns_answers_5_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 50.17.211.84, dns_answers_6_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 0, dns_answers_6_rdata: 23.23.250.246, dns_answers_7_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 0, dns_answers_7_rdata: 23.21.172.210, dns_grouped_A_0: 50.16.220.202, dns_grouped_A_1: 50.19.121.243, dns_grouped_A_2: 54.225.149.201, dns_grouped_A_3: 50.19.223.117, dns_grouped_A_4: 23.21.41.78, dns_grouped_A_5: 50.17.211.84, dns_grouped_A_6: 23.23.250.246, dns_grouped_A_7: 23.21.172.210 ; pcap_cnt: 6505898, event_type: dns, proto: UDP, dns_type: query, dns_id: 54759, dns_rrname: cdns.eu1.gigya.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6505925, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 54759, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdns.eu1.gigya.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdns.eu1.gigya.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 166, dns_answers_0_rdata: cdns.gigya.com.edgekey.net, dns_answers_1_rrname: cdns.gigya.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20758, dns_answers_1_rdata: e8333.g.akamaiedge.net, dns_answers_2_rrname: e8333.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 15, dns_answers_2_rdata: 104.97.123.92, dns_grouped_CNAME_0: cdns.gigya.com.edgekey.net, dns_grouped_CNAME_1: e8333.g.akamaiedge.net, dns_grouped_A_0: 104.97.123.92 ; pcap_cnt: 8611922, event_type: dns, proto: UDP, dns_type: query, dns_id: 46660, dns_rrname: msnbc.tumblr.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8611965, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46660, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: msnbc.tumblr.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: tumblr.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 555, dns_authorities_0_soa_mname: hidden-master.yahoo.com, dns_authorities_0_soa_rname: hostmaster.yahoo-inc.com, dns_authorities_0_soa_serial: 2017062200, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 8710994, event_type: dns, proto: UDP, dns_type: query, dns_id: 56678, dns_rrname: www.99acres.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8711004, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56678, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.99acres.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.99acres.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3600, dns_answers_0_rdata: star.jsb9.edgekey.net, dns_answers_1_rrname: star.jsb9.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20818, dns_answers_1_rdata: e10247.dsca.akamaiedge.net, dns_answers_2_rrname: e10247.dsca.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 20, dns_answers_2_rdata: 104.88.93.77, dns_grouped_A_0: 104.88.93.77, dns_grouped_CNAME_0: star.jsb9.edgekey.net, dns_grouped_CNAME_1: e10247.dsca.akamaiedge.net ; pcap_cnt: 8908844, event_type: dns, proto: UDP, dns_type: query, dns_id: 7499, dns_rrname: secure.media6degrees.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8909213, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7499, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: secure.media6degrees.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: secure.media6degrees.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 592, dns_answers_0_rdata: secure.dynectmedia6degrees.com, dns_grouped_CNAME_0: secure.dynectmedia6degrees.com, dns_authorities_0_rrname: dynectmedia6degrees.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 40, dns_authorities_0_soa_mname: ns1.p27.dynect.net, dns_authorities_0_soa_rname: sysops.m6d.com, dns_authorities_0_soa_serial: 2017070650, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 8959457, event_type: dns, proto: UDP, dns_type: query, dns_id: 43819, dns_rrname: d1n0xl2kej0ebw.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8959498, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43819, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d1n0xl2kej0ebw.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: d1n0xl2kej0ebw.cloudfront.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 59, dns_answers_0_rdata: 2600:9000:2041:3e00:0015:efbc:e300:93a1, dns_answers_1_rrname: d1n0xl2kej0ebw.cloudfront.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 59, dns_answers_1_rdata: 2600:9000:2041:c800:0015:efbc:e300:93a1, dns_answers_2_rrname: d1n0xl2kej0ebw.cloudfront.net, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 59, dns_answers_2_rdata: 2600:9000:2041:2400:0015:efbc:e300:93a1, dns_answers_3_rrname: d1n0xl2kej0ebw.cloudfront.net, dns_answers_3_rrtype: AAAA, dns_answers_3_ttl: 59, dns_answers_3_rdata: 2600:9000:2041:2600:0015:efbc:e300:93a1, dns_answers_4_rrname: d1n0xl2kej0ebw.cloudfront.net, dns_answers_4_rrtype: AAAA, dns_answers_4_ttl: 59, dns_answers_4_rdata: 2600:9000:2041:b000:0015:efbc:e300:93a1, dns_answers_5_rrname: d1n0xl2kej0ebw.cloudfront.net, dns_answers_5_rrtype: AAAA, dns_answers_5_ttl: 59, dns_answers_5_rdata: 2600:9000:2041:a800:0015:efbc:e300:93a1, dns_answers_6_rrname: d1n0xl2kej0ebw.cloudfront.net, dns_answers_6_rrtype: AAAA, dns_answers_6_ttl: 59, dns_answers_6_rdata: 2600:9000:2041:b600:0015:efbc:e300:93a1, dns_answers_7_rrname: d1n0xl2kej0ebw.cloudfront.net, dns_answers_7_rrtype: AAAA, dns_answers_7_ttl: 59, dns_answers_7_rdata: 2600:9000:2041:4000:0015:efbc:e300:93a1, dns_grouped_AAAA_0: 2600:9000:2041:3e00:0015:efbc:e300:93a1, dns_grouped_AAAA_1: 2600:9000:2041:c800:0015:efbc:e300:93a1, dns_grouped_AAAA_2: 2600:9000:2041:2400:0015:efbc:e300:93a1, dns_grouped_AAAA_3: 2600:9000:2041:2600:0015:efbc:e300:93a1, dns_grouped_AAAA_4: 2600:9000:2041:b000:0015:efbc:e300:93a1, dns_grouped_AAAA_5: 2600:9000:2041:a800:0015:efbc:e300:93a1, dns_grouped_AAAA_6: 2600:9000:2041:b600:0015:efbc:e300:93a1, dns_grouped_AAAA_7: 2600:9000:2041:4000:0015:efbc:e300:93a1 ; pcap_cnt: 9197585, event_type: dns, proto: UDP, dns_type: query, dns_id: 48566, dns_rrname: m.ib-ibi.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9197586, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48566, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: m.ib-ibi.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: ib-ibi.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 41, dns_authorities_0_soa_mname: ns4.ib-ibi.com, dns_authorities_0_soa_rname: root.ns1.ib-ibi.com, dns_authorities_0_soa_serial: 328, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 9246884, event_type: dns, proto: UDP, dns_type: query, dns_id: 14896, dns_rrname: casale-cm.p.veruta.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9247378, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14896, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: casale-cm.p.veruta.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: casale-cm.p.veruta.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3599, dns_answers_0_rdata: rtb.p.veruta.com, dns_answers_1_rrname: rtb.p.veruta.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 44, dns_answers_1_rdata: rtb-geo.p2.veruta.com, dns_answers_2_rrname: rtb-geo.p2.veruta.com, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 3182, dns_answers_2_rdata: rtb-east1.p.veruta.com, dns_answers_3_rrname: rtb-east1.p.veruta.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 70.42.146.149, dns_answers_4_rrname: rtb-east1.p.veruta.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 70.42.146.148, dns_grouped_CNAME_0: rtb.p.veruta.com, dns_grouped_CNAME_1: rtb-geo.p2.veruta.com, dns_grouped_CNAME_2: rtb-east1.p.veruta.com, dns_grouped_A_0: 70.42.146.149, dns_grouped_A_1: 70.42.146.148
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.