['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 62269, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 100, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 131, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 228, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 178, flow_bytes_toclient: 262, flow_age: 150, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 221, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 158, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 140, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 167, flow_bytes_toclient: 271, flow_age: 125, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 173, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 129, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 196, flow_bytes_toclient: 324, flow_age: 26, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 100, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 176, flow_bytes_toclient: 259, flow_age: 174, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 110, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 105, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 126, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 158, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 105, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 349693, event_type: dns, proto: UDP, dns_type: query, dns_id: 10714, dns_rrname: www.google.ca, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 349951, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10714, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.google.ca, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.google.ca, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 216.58.219.195, dns_grouped_A_0: 216.58.219.195 ; pcap_cnt: 5332353, event_type: dns, proto: UDP, dns_type: query, dns_id: 30816, dns_rrname: locationv2.api.sociaplus.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5332936, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30816, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: locationv2.api.sociaplus.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: locationv2.api.sociaplus.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 104.20.87.108, dns_answers_1_rrname: locationv2.api.sociaplus.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 104.20.86.108, dns_grouped_A_0: 104.20.87.108, dns_grouped_A_1: 104.20.86.108 ; pcap_cnt: 5810950, event_type: dns, proto: UDP, dns_type: query, dns_id: 53906, dns_rrname: f2.shared.global.fastly.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5810979, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53906, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: f2.shared.global.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: f2.shared.global.fastly.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 151.101.22.2, dns_grouped_A_0: 151.101.22.2 ; pcap_cnt: 6464330, event_type: dns, proto: UDP, dns_type: query, dns_id: 26888, dns_rrname: d1rjnn6a6z3kz8.cloudfront.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6464361, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26888, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d1rjnn6a6z3kz8.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d1rjnn6a6z3kz8.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 52.84.26.64, dns_answers_1_rrname: d1rjnn6a6z3kz8.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.26.88, dns_answers_2_rrname: d1rjnn6a6z3kz8.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.26.244, dns_answers_3_rrname: d1rjnn6a6z3kz8.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.26.4, dns_answers_4_rrname: d1rjnn6a6z3kz8.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.26.5, dns_answers_5_rrname: d1rjnn6a6z3kz8.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.26.227, dns_answers_6_rrname: d1rjnn6a6z3kz8.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.26.242, dns_answers_7_rrname: d1rjnn6a6z3kz8.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.26.13, dns_grouped_A_0: 52.84.26.64, dns_grouped_A_1: 52.84.26.88, dns_grouped_A_2: 52.84.26.244, dns_grouped_A_3: 52.84.26.4, dns_grouped_A_4: 52.84.26.5, dns_grouped_A_5: 52.84.26.227, dns_grouped_A_6: 52.84.26.242, dns_grouped_A_7: 52.84.26.13 ; pcap_cnt: 7886476, event_type: dns, proto: UDP, dns_type: query, dns_id: 48614, dns_rrname: 500px.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7886477, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48614, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 500px.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: 500px.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 54, dns_authorities_0_soa_mname: ns0.dnsmadeeasy.com, dns_authorities_0_soa_rname: dns.dnsmadeeasy.com, dns_authorities_0_soa_serial: 2008010658, dns_authorities_0_soa_refresh: 43200, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 8228614, event_type: dns, proto: UDP, dns_type: query, dns_id: 51475, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 8228698, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51475, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 59, dns_answers_0_rdata: 2a03:2880:f10e:0083:face:b00c:0000:25de, dns_grouped_AAAA_0: 2a03:2880:f10e:0083:face:b00c:0000:25de ; pcap_cnt: 9857868, event_type: dns, proto: UDP, dns_type: query, dns_id: 4176, dns_rrname: n-cdn.areyouahuman.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9857980, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4176, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: n-cdn.areyouahuman.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: n-cdn.areyouahuman.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 52.84.26.242, dns_answers_1_rrname: n-cdn.areyouahuman.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.26.67, dns_answers_2_rrname: n-cdn.areyouahuman.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.26.53, dns_answers_3_rrname: n-cdn.areyouahuman.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.26.193, dns_answers_4_rrname: n-cdn.areyouahuman.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.26.246, dns_answers_5_rrname: n-cdn.areyouahuman.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.26.98, dns_answers_6_rrname: n-cdn.areyouahuman.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.26.92, dns_answers_7_rrname: n-cdn.areyouahuman.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.26.134, dns_grouped_A_0: 52.84.26.242, dns_grouped_A_1: 52.84.26.67, dns_grouped_A_2: 52.84.26.53, dns_grouped_A_3: 52.84.26.193, dns_grouped_A_4: 52.84.26.246, dns_grouped_A_5: 52.84.26.98, dns_grouped_A_6: 52.84.26.92, dns_grouped_A_7: 52.84.26.134 ; pcap_cnt: 10305124, event_type: dns, proto: UDP, dns_type: query, dns_id: 36454, dns_rrname: aa.agkn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10305164, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36454, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: aa.agkn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: agkn.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: pdns196.ultradns.com, dns_authorities_0_soa_rname: ops.aggregateknowledge.com, dns_authorities_0_soa_serial: 2017062203, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 10600220, event_type: dns, proto: UDP, dns_type: query, dns_id: 5468, dns_rrname: spdcrv.global.ssl.fastly.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10600222, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5468, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: spdcrv.global.ssl.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: spdcrv.global.ssl.fastly.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 13079, dns_answers_0_rdata: global-ssl.fastly.net, dns_answers_1_rrname: global-ssl.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 151.101.208.249, dns_grouped_A_0: 151.101.208.249, dns_grouped_CNAME_0: global-ssl.fastly.net ; pcap_cnt: 10992072, event_type: dns, proto: UDP, dns_type: query, dns_id: 47089, dns_rrname: sc.iasds01.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10992085, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47089, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sc.iasds01.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sc.iasds01.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2350, dns_answers_0_rdata: anycast.sc.iasds01.com, dns_answers_1_rrname: anycast.sc.iasds01.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 582, dns_answers_1_rdata: 199.166.0.200, dns_grouped_A_0: 199.166.0.200, dns_grouped_CNAME_0: anycast.sc.iasds01.com ; pcap_cnt: 11007639, event_type: dns, proto: UDP, dns_type: query, dns_id: 27903, dns_rrname: s0.2mdn.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 11007741, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 27903, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s0.2mdn.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: s0.2mdn.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: s0-2mdn-net.l.google.com, dns_answers_1_rrname: s0-2mdn-net.l.google.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 299, dns_answers_1_rdata: 2607:f8b0:4006:0813:0000:0000:0000:2006, dns_grouped_CNAME_0: s0-2mdn-net.l.google.com, dns_grouped_AAAA_0: 2607:f8b0:4006:0813:0000:0000:0000:2006 ; pcap_cnt: 11094983, event_type: dns, proto: UDP, dns_type: query, dns_id: 4021, dns_rrname: use.typekit.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11095060, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4021, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: use.typekit.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: use.typekit.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 273, dns_answers_0_rdata: use.typekit.net.edgekey.net, dns_answers_1_rrname: use.typekit.net.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 18537, dns_answers_1_rdata: e8385.g.akamaiedge.net, dns_answers_2_rrname: e8385.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.194.141.198, dns_grouped_CNAME_0: use.typekit.net.edgekey.net, dns_grouped_CNAME_1: e8385.g.akamaiedge.net, dns_grouped_A_0: 23.194.141.198 ; pcap_cnt: 11321453, event_type: dns, proto: UDP, dns_type: query, dns_id: 13161, dns_rrname: gtrk.s3.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11321608, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13161, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: gtrk.s3.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: gtrk.s3.amazonaws.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2219, dns_answers_0_rdata: s3-1-w.amazonaws.com, dns_answers_1_rrname: s3-1-w.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 54.231.114.3, dns_grouped_CNAME_0: s3-1-w.amazonaws.com, dns_grouped_A_0: 54.231.114.3 ; pcap_cnt: 11618898, event_type: dns, proto: UDP, dns_type: query, dns_id: 17946, dns_rrname: jadserve.postrelease.com.akadns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11619057, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17946, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: jadserve.postrelease.com.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 179, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499274593, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 11627003, event_type: dns, proto: UDP, dns_type: query, dns_id: 59083, dns_rrname: www.foundmyfont.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 11627085, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59083, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.foundmyfont.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.foundmyfont.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2062, dns_answers_0_rdata: gpaas4.dc2.gandi.net, dns_answers_1_rrname: gpaas4.dc2.gandi.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 59, dns_answers_1_rdata: 2001:4b98:0dc2:0950:0000:0000:0000:0104, dns_grouped_AAAA_0: 2001:4b98:0dc2:0950:0000:0000:0000:0104, dns_grouped_CNAME_0: gpaas4.dc2.gandi.net ; pcap_cnt: 11765210, event_type: dns, proto: UDP, dns_type: query, dns_id: 41246, dns_rrname: ad.cafe24.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11765452, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41246, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad.cafe24.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ad.cafe24.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1800, dns_answers_0_rdata: 211.34.104.247, dns_grouped_A_0: 211.34.104.247 ; pcap_cnt: 12283842, event_type: dns, proto: UDP, dns_type: query, dns_id: 17364, dns_rrname: a1697.w7.akamai.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12283897, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17364, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a1697.w7.akamai.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a1697.w7.akamai.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 38.69.238.17, dns_answers_1_rrname: a1697.w7.akamai.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 38.69.238.19, dns_grouped_A_0: 38.69.238.17, dns_grouped_A_1: 38.69.238.19 ; pcap_cnt: 12301240, event_type: dns, proto: UDP, dns_type: query, dns_id: 46647, dns_rrname: search.daum.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 12301310, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46647, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: search.daum.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: search.daum.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 209, dns_authorities_0_soa_mname: ns1.daum.net, dns_authorities_0_soa_rname: hostmaster.daum.net, dns_authorities_0_soa_serial: 2017063000, dns_authorities_0_soa_refresh: 2700, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 12396126, event_type: dns, proto: UDP, dns_type: query, dns_id: 53395, dns_rrname: e11100.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12396127, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53395, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e11100.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e11100.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 6, dns_answers_0_rdata: 172.224.13.96, dns_grouped_A_0: 172.224.13.96 ; pcap_cnt: 12531147, event_type: dns, proto: UDP, dns_type: query, dns_id: 46451, dns_rrname: geo-rtas.btrll.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12531234, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46451, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: geo-rtas.btrll.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: geo-rtas.btrll.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 162.208.22.34, dns_grouped_A_0: 162.208.22.34 ; pcap_cnt: 12865463, event_type: dns, proto: UDP, dns_type: query, dns_id: 39227, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 12865464, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 39227, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2a03:2880:f10e:0083:face:b00c:0000:25de, dns_grouped_AAAA_0: 2a03:2880:f10e:0083:face:b00c:0000:25de ; pcap_cnt: 13190368, event_type: dns, proto: UDP, dns_type: query, dns_id: 56733, dns_rrname: e4894.e12.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 13190369, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56733, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e4894.e12.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: e12.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 470, dns_authorities_0_soa_mname: n0e12.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499281250, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 13739361, event_type: dns, proto: UDP, dns_type: query, dns_id: 17738, dns_rrname: ocsp.usertrust.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 13739363, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17738, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.usertrust.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.usertrust.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 178.255.83.1, dns_grouped_A_0: 178.255.83.1
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.