['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61035, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 151, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 148, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 194, flow_bytes_toclient: 270, flow_age: 86, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 131, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 171, flow_bytes_toclient: 253, flow_age: 51, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 134, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 113, flow_bytes_toclient: 195, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 110, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 208, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 113, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 175, flow_bytes_toclient: 320, flow_age: 24, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 81, flow_bytes_toclient: 132, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 141, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 194, flow_bytes_toclient: 322, flow_age: 195, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 283, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 188, flow_bytes_toclient: 267, flow_age: 134, flow_state: established, flow_reason: timeout ; pcap_cnt: 332383, event_type: dns, proto: UDP, dns_type: query, dns_id: 59898, dns_rrname: 80.37.192.54.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 332395, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59898, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 80.37.192.54.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 80.37.192.54.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 42492, dns_answers_0_rdata: server-54-192-37-80.jfk1.r.cloudfront.net, dns_grouped_PTR_0: server-54-192-37-80.jfk1.r.cloudfront.net ; pcap_cnt: 3963561, event_type: dns, proto: UDP, dns_type: query, dns_id: 12893, dns_rrname: 43.17.87.54.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 3963877, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12893, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 43.17.87.54.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 43.17.87.54.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 299, dns_answers_0_rdata: ec2-54-87-17-43.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-54-87-17-43.compute-1.amazonaws.com ; pcap_cnt: 5847831, event_type: dns, proto: UDP, dns_type: query, dns_id: 42562, dns_rrname: e5926.ksd.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5847834, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42562, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e5926.ksd.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e5926.ksd.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 23.208.88.87, dns_grouped_A_0: 23.208.88.87 ; pcap_cnt: 6206824, event_type: dns, proto: UDP, dns_type: query, dns_id: 62637, dns_rrname: 244.209.101.151.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 2 ; pcap_cnt: 6207083, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62637, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 244.209.101.151.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 151.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 889, dns_authorities_0_soa_mname: pri.authdns.ripe.net, dns_authorities_0_soa_rname: dns.ripe.net, dns_authorities_0_soa_serial: 1499151062, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 864000, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 6536373, event_type: dns, proto: UDP, dns_type: query, dns_id: 42408, dns_rrname: 20.99.77.212.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 6536476, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42408, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 20.99.77.212.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 20.99.77.212.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 1799, dns_answers_0_rdata: ads.businessclick.com, dns_grouped_PTR_0: ads.businessclick.com ; pcap_cnt: 6824622, event_type: dns, proto: UDP, dns_type: query, dns_id: 41658, dns_rrname: us-u.openx.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6824797, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41658, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: us-u.openx.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: us-u.openx.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 599, dns_answers_0_rdata: 173.241.242.143, dns_grouped_A_0: 173.241.242.143 ; pcap_cnt: 6846456, event_type: dns, proto: UDP, dns_type: query, dns_id: 8278, dns_rrname: oxp.mxptint.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 6846581, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 8278, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: oxp.mxptint.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: mxptint.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 30, dns_authorities_0_soa_mname: ns1.p09.dynect.net, dns_authorities_0_soa_rname: it.maxpoint.com, dns_authorities_0_soa_serial: 4158, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7029438, event_type: dns, proto: UDP, dns_type: query, dns_id: 31914, dns_rrname: tracking.m6r.eu, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7029533, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31914, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tracking.m6r.eu, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tracking.m6r.eu, dns_answers_0_rrtype: A, dns_answers_0_ttl: 2948, dns_answers_0_rdata: 72.251.244.140, dns_answers_1_rrname: tracking.m6r.eu, dns_answers_1_rrtype: A, dns_answers_1_ttl: 2948, dns_answers_1_rdata: 72.251.244.142, dns_answers_2_rrname: tracking.m6r.eu, dns_answers_2_rrtype: A, dns_answers_2_ttl: 2948, dns_answers_2_rdata: 72.251.244.141, dns_grouped_A_0: 72.251.244.140, dns_grouped_A_1: 72.251.244.142, dns_grouped_A_2: 72.251.244.141 ; pcap_cnt: 7948189, event_type: dns, proto: UDP, dns_type: query, dns_id: 29945, dns_rrname: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7948207, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29945, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 24, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 8050169, event_type: dns, proto: UDP, dns_type: query, dns_id: 19351, dns_rrname: yuuhi.cocolog-nifty.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8050189, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19351, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: yuuhi.cocolog-nifty.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: yuuhi.cocolog-nifty.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 599, dns_answers_0_rdata: 121.94.171.150, dns_grouped_A_0: 121.94.171.150 ; pcap_cnt: 8637435, event_type: dns, proto: UDP, dns_type: query, dns_id: 17450, dns_rrname: detectportal.firefox.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8637436, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17450, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: detectportal.firefox.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: detectportal.firefox.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 80, dns_answers_0_rdata: detectportal.firefox.com.edgesuite.net, dns_answers_1_rrname: detectportal.firefox.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 3923, dns_answers_1_rdata: a1089.d.akamai.net, dns_answers_2_rrname: a1089.d.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 63.144.176.10, dns_answers_3_rrname: a1089.d.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 63.144.176.33, dns_grouped_CNAME_0: detectportal.firefox.com.edgesuite.net, dns_grouped_CNAME_1: a1089.d.akamai.net, dns_grouped_A_0: 63.144.176.10, dns_grouped_A_1: 63.144.176.33 ; pcap_cnt: 9284893, event_type: dns, proto: UDP, dns_type: query, dns_id: 12611, dns_rrname: aax-eu.amazon-adsystem.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9285071, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12611, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: aax-eu.amazon-adsystem.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: aax-eu.amazon-adsystem.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 52.94.216.48, dns_grouped_A_0: 52.94.216.48 ; pcap_cnt: 9650194, event_type: dns, proto: UDP, dns_type: query, dns_id: 57239, dns_rrname: adadvisor.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9650267, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57239, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adadvisor.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: adadvisor.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 119, dns_answers_0_rdata: 156.154.200.32, dns_answers_1_rrname: adadvisor.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 119, dns_answers_1_rdata: 156.154.202.32, dns_answers_2_rrname: adadvisor.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 119, dns_answers_2_rdata: 63.251.248.131, dns_answers_3_rrname: adadvisor.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 119, dns_answers_3_rdata: 63.251.88.51, dns_grouped_A_0: 156.154.200.32, dns_grouped_A_1: 156.154.202.32, dns_grouped_A_2: 63.251.248.131, dns_grouped_A_3: 63.251.88.51 ; pcap_cnt: 9661804, event_type: dns, proto: UDP, dns_type: query, dns_id: 30033, dns_rrname: www.bizographics.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 9661818, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30033, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.bizographics.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: bizographics.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 571, dns_authorities_0_soa_mname: ns-519.awsdns-00.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 10177929, event_type: dns, proto: UDP, dns_type: query, dns_id: 20699, dns_rrname: d.turn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10178021, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20699, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d.turn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d.turn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 170, dns_answers_0_rdata: d.turn.com.akadns.net, dns_answers_1_rrname: d.turn.com.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 50.116.194.23, dns_grouped_CNAME_0: d.turn.com.akadns.net, dns_grouped_A_0: 50.116.194.23 ; pcap_cnt: 10664659, event_type: dns, proto: UDP, dns_type: query, dns_id: 845, dns_rrname: ust.chatango.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10664671, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 845, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ust.chatango.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: chatango.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 2513, dns_authorities_0_soa_mname: dnss12.chatango.com, dns_authorities_0_soa_rname: hostmaster.chatango.com, dns_authorities_0_soa_serial: 1497817112, dns_authorities_0_soa_refresh: 16384, dns_authorities_0_soa_retry: 2048, dns_authorities_0_soa_expire: 1048576, dns_authorities_0_soa_minimum: 2560 ; pcap_cnt: 10949200, event_type: dns, proto: UDP, dns_type: query, dns_id: 2055, dns_rrname: dis.us.criteo.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10949256, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2055, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dis.us.criteo.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: criteo.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 492, dns_authorities_0_soa_mname: ns1.criteo.com, dns_authorities_0_soa_rname: dns.criteo.com, dns_authorities_0_soa_serial: 2014061906, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 11064267, event_type: dns, proto: UDP, dns_type: query, dns_id: 64028, dns_rrname: player-prod-2-lbs-us.coullmedia.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 11064294, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64028, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: player-prod-2-lbs-us.coullmedia.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: coullmedia.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 38, dns_authorities_0_soa_mname: ns-2031.awsdns-61.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 11276178, event_type: dns, proto: UDP, dns_type: query, dns_id: 14200, dns_rrname: usermatch.krxd.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11276247, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14200, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: usermatch.krxd.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: usermatch.krxd.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: usermatch-ash-1350078884.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: usermatch-ash-1350078884.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 23.21.45.59, dns_answers_2_rrname: usermatch-ash-1350078884.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 107.22.241.77, dns_answers_3_rrname: usermatch-ash-1350078884.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 54.235.89.91, dns_answers_4_rrname: usermatch-ash-1350078884.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 23.23.175.171, dns_answers_5_rrname: usermatch-ash-1350078884.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 204.236.239.173, dns_answers_6_rrname: usermatch-ash-1350078884.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 50.17.232.169, dns_answers_7_rrname: usermatch-ash-1350078884.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 50.17.250.36, dns_answers_8_rrname: usermatch-ash-1350078884.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 23.23.219.8, dns_grouped_CNAME_0: usermatch-ash-1350078884.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 23.21.45.59, dns_grouped_A_1: 107.22.241.77, dns_grouped_A_2: 54.235.89.91, dns_grouped_A_3: 23.23.175.171, dns_grouped_A_4: 204.236.239.173, dns_grouped_A_5: 50.17.232.169, dns_grouped_A_6: 50.17.250.36, dns_grouped_A_7: 23.23.219.8 ; pcap_cnt: 11435320, event_type: dns, proto: UDP, dns_type: query, dns_id: 9632, dns_rrname: maxcdn.bootstrapcdn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11435376, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9632, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: maxcdn.bootstrapcdn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: maxcdn.bootstrapcdn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 143, dns_answers_0_rdata: bootstrapcdn.jdorfman.netdna-cdn.com, dns_answers_1_rrname: bootstrapcdn.jdorfman.netdna-cdn.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 29, dns_answers_1_rdata: 198.232.125.123, dns_grouped_CNAME_0: bootstrapcdn.jdorfman.netdna-cdn.com, dns_grouped_A_0: 198.232.125.123 ; pcap_cnt: 11468912, event_type: dns, proto: UDP, dns_type: query, dns_id: 27719, dns_rrname: e8960.e2.akamaiedge.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 11468993, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 27719, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e8960.e2.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e8960.e2.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 104.88.55.49, dns_grouped_A_0: 104.88.55.49
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.