['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61765, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 174, flow_bytes_toclient: 397, flow_age: 172, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 275, flow_bytes_toclient: 405, flow_age: 234, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 184, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 5, flow_pkts_toclient: 5, flow_bytes_toserver: 469, flow_bytes_toclient: 772, flow_age: 345, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 106, flow_bytes_toclient: 199, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 104, flow_bytes_toclient: 214, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 179, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 262, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 88, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 171, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 154, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 156, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 113, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 201, flow_bytes_toclient: 321, flow_age: 81, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 177, flow_bytes_toclient: 267, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 113, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 150, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 186, flow_bytes_toclient: 255, flow_age: 110, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 142, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 184, flow_bytes_toclient: 256, flow_age: 129, flow_state: established, flow_reason: timeout ; pcap_cnt: 366298, event_type: dns, proto: UDP, dns_type: query, dns_id: 30009, dns_rrname: data.agkn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 366349, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30009, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: data.agkn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: data.agkn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 87, dns_answers_0_rdata: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 50.17.177.105, dns_answers_2_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 52.206.66.6, dns_answers_3_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 52.1.14.213, dns_answers_4_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 34.225.147.89, dns_answers_5_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 52.204.76.90, dns_answers_6_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 52.201.35.194, dns_answers_7_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 52.21.27.87, dns_answers_8_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 52.0.93.246, dns_grouped_CNAME_0: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 50.17.177.105, dns_grouped_A_1: 52.206.66.6, dns_grouped_A_2: 52.1.14.213, dns_grouped_A_3: 34.225.147.89, dns_grouped_A_4: 52.204.76.90, dns_grouped_A_5: 52.201.35.194, dns_grouped_A_6: 52.21.27.87, dns_grouped_A_7: 52.0.93.246 ; pcap_cnt: 481693, event_type: dns, proto: UDP, dns_type: query, dns_id: 61731, dns_rrname: a1697.w7.akamai.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 481734, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61731, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a1697.w7.akamai.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a1697.w7.akamai.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 19, dns_answers_0_rdata: 23.15.4.19, dns_answers_1_rrname: a1697.w7.akamai.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 19, dns_answers_1_rdata: 23.15.4.16, dns_grouped_A_0: 23.15.4.19, dns_grouped_A_1: 23.15.4.16 ; pcap_cnt: 2792063, event_type: dns, proto: UDP, dns_type: query, dns_id: 6236, dns_rrname: a1089.d.akamai.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 2792067, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6236, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a1089.d.akamai.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d.akamai.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 611, dns_authorities_0_soa_mname: n0d.akamai.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499170254, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 3532802, event_type: dns, proto: UDP, dns_type: query, dns_id: 46808, dns_rrname: s-0001.s-msedge.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 3532812, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46808, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s-0001.s-msedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s-0001.s-msedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 76, dns_answers_0_rdata: 13.107.3.128, dns_grouped_A_0: 13.107.3.128 ; pcap_cnt: 3935328, event_type: dns, proto: UDP, dns_type: query, dns_id: 19277, dns_rrname: prod-hzeu-lba.upravel.com, dns_rrtype: AAAA, dns_tx_id: 4 ; pcap_cnt: 3935329, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19277, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: prod-hzeu-lba.upravel.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: upravel.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 56, dns_authorities_0_soa_mname: ns3-l2.nic.ru, dns_authorities_0_soa_rname: dns.nic.ru, dns_authorities_0_soa_serial: 2017032706, dns_authorities_0_soa_refresh: 1440, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2592000, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5665335, event_type: dns, proto: UDP, dns_type: query, dns_id: 13596, dns_rrname: dtm.advertising.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5665373, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13596, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dtm.advertising.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dtm.advertising.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: dtm.advertising.com.edgekey.net, dns_answers_1_rrname: dtm.advertising.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 14358, dns_answers_1_rdata: e9669.g.akamaiedge.net, dns_answers_2_rrname: e9669.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.194.142.5, dns_grouped_CNAME_0: dtm.advertising.com.edgekey.net, dns_grouped_CNAME_1: e9669.g.akamaiedge.net, dns_grouped_A_0: 23.194.142.5 ; pcap_cnt: 6301491, event_type: dns, proto: UDP, dns_type: query, dns_id: 687, dns_rrname: 11.207.165.54.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 6301542, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 687, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 11.207.165.54.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 11.207.165.54.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 228, dns_answers_0_rdata: ec2-54-165-207-11.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-54-165-207-11.compute-1.amazonaws.com ; pcap_cnt: 6346543, event_type: dns, proto: UDP, dns_type: query, dns_id: 55345, dns_rrname: secure-us.imrworldwide.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6346590, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55345, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: secure-us.imrworldwide.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: secure-us.imrworldwide.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 8, dns_answers_0_rdata: 138.108.6.20, dns_grouped_A_0: 138.108.6.20 ; pcap_cnt: 6353605, event_type: dns, proto: UDP, dns_type: query, dns_id: 37698, dns_rrname: daisy.ubuntu.com, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 6353608, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37698, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: daisy.ubuntu.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: daisy.ubuntu.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 160, dns_answers_0_rdata: 162.213.33.133, dns_answers_1_rrname: daisy.ubuntu.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 160, dns_answers_1_rdata: 162.213.33.164, dns_grouped_A_0: 162.213.33.133, dns_grouped_A_1: 162.213.33.164 ; pcap_cnt: 6383320, event_type: dns, proto: UDP, dns_type: query, dns_id: 22414, dns_rrname: googleadapis.l.google.com, dns_rrtype: A, dns_tx_id: 6 ; pcap_cnt: 6383371, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22414, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleadapis.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: googleadapis.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.12.202, dns_grouped_A_0: 172.217.12.202 ; pcap_cnt: 6435691, event_type: dns, proto: UDP, dns_type: query, dns_id: 46043, dns_rrname: de-gmtdmp.mookie1.com, dns_rrtype: A, dns_tx_id: 8 ; pcap_cnt: 6435758, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46043, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: de-gmtdmp.mookie1.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: de-gmtdmp.mookie1.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 27, dns_answers_0_rdata: lb1-1080807752.eu-central-1.elb.amazonaws.com, dns_answers_1_rrname: lb1-1080807752.eu-central-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 23, dns_answers_1_rdata: 35.157.197.151, dns_answers_2_rrname: lb1-1080807752.eu-central-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 23, dns_answers_2_rdata: 35.156.199.43, dns_answers_3_rrname: lb1-1080807752.eu-central-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 23, dns_answers_3_rdata: 35.158.52.245, dns_answers_4_rrname: lb1-1080807752.eu-central-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 23, dns_answers_4_rdata: 35.157.81.84, dns_answers_5_rrname: lb1-1080807752.eu-central-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 23, dns_answers_5_rdata: 35.156.99.255, dns_answers_6_rrname: lb1-1080807752.eu-central-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 23, dns_answers_6_rdata: 35.156.90.132, dns_answers_7_rrname: lb1-1080807752.eu-central-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 23, dns_answers_7_rdata: 35.157.186.26, dns_answers_8_rrname: lb1-1080807752.eu-central-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 23, dns_answers_8_rdata: 35.156.240.66, dns_grouped_CNAME_0: lb1-1080807752.eu-central-1.elb.amazonaws.com, dns_grouped_A_0: 35.157.197.151, dns_grouped_A_1: 35.156.199.43, dns_grouped_A_2: 35.158.52.245, dns_grouped_A_3: 35.157.81.84, dns_grouped_A_4: 35.156.99.255, dns_grouped_A_5: 35.156.90.132, dns_grouped_A_6: 35.157.186.26, dns_grouped_A_7: 35.156.240.66 ; pcap_cnt: 6876428, event_type: dns, proto: UDP, dns_type: query, dns_id: 2654, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6876479, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2654, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 19, dns_answers_1_rdata: 2001:0418:143c:0180:0000:0000:0000:201a, dns_answers_2_rrname: e8218.dscb1.akamaiedge.net, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 19, dns_answers_2_rdata: 2001:0418:143c:018b:0000:0000:0000:201a, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_AAAA_0: 2001:0418:143c:0180:0000:0000:0000:201a, dns_grouped_AAAA_1: 2001:0418:143c:018b:0000:0000:0000:201a ; pcap_cnt: 7683279, event_type: dns, proto: UDP, dns_type: query, dns_id: 3429, dns_rrname: v10.vortex-win.data.microsoft.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7683442, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3429, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: v10.vortex-win.data.microsoft.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: v10.vortex-win.data.microsoft.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2653, dns_answers_0_rdata: v10-win.vortex.data.microsoft.com.akadns.net, dns_answers_1_rrname: v10-win.vortex.data.microsoft.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 30, dns_answers_1_rdata: geo.vortex.data.microsoft.com.akadns.net, dns_answers_2_rrname: geo.vortex.data.microsoft.com.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 245, dns_answers_2_rdata: cy2.vortex.data.microsoft.com.akadns.net, dns_answers_3_rrname: cy2.vortex.data.microsoft.com.akadns.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 299, dns_answers_3_rdata: 64.4.54.254, dns_grouped_CNAME_0: v10-win.vortex.data.microsoft.com.akadns.net, dns_grouped_CNAME_1: geo.vortex.data.microsoft.com.akadns.net, dns_grouped_CNAME_2: cy2.vortex.data.microsoft.com.akadns.net, dns_grouped_A_0: 64.4.54.254 ; pcap_cnt: 7955366, event_type: dns, proto: UDP, dns_type: query, dns_id: 29853, dns_rrname: olympia.prod.mozaws.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7955367, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29853, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: olympia.prod.mozaws.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: prod.mozaws.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 191, dns_authorities_0_soa_mname: ns-1260.awsdns-29.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8082076, event_type: dns, proto: UDP, dns_type: query, dns_id: 31300, dns_rrname: assets.elcomercio.pe, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8082240, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31300, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: assets.elcomercio.pe, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: assets.elcomercio.pe, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 198, dns_answers_0_rdata: d1eikci09i8gwm.cloudfront.net, dns_answers_1_rrname: d1eikci09i8gwm.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 60, dns_answers_1_rdata: 54.192.37.61, dns_answers_2_rrname: d1eikci09i8gwm.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 60, dns_answers_2_rdata: 54.192.37.41, dns_answers_3_rrname: d1eikci09i8gwm.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 60, dns_answers_3_rdata: 54.192.37.83, dns_answers_4_rrname: d1eikci09i8gwm.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 60, dns_answers_4_rdata: 54.192.37.146, dns_answers_5_rrname: d1eikci09i8gwm.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 60, dns_answers_5_rdata: 54.192.37.251, dns_answers_6_rrname: d1eikci09i8gwm.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 60, dns_answers_6_rdata: 54.192.37.157, dns_answers_7_rrname: d1eikci09i8gwm.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 60, dns_answers_7_rdata: 54.192.37.205, dns_answers_8_rrname: d1eikci09i8gwm.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 60, dns_answers_8_rdata: 54.192.37.25, dns_grouped_A_0: 54.192.37.61, dns_grouped_A_1: 54.192.37.41, dns_grouped_A_2: 54.192.37.83, dns_grouped_A_3: 54.192.37.146, dns_grouped_A_4: 54.192.37.251, dns_grouped_A_5: 54.192.37.157, dns_grouped_A_6: 54.192.37.205, dns_grouped_A_7: 54.192.37.25, dns_grouped_CNAME_0: d1eikci09i8gwm.cloudfront.net ; pcap_cnt: 8229362, event_type: dns, proto: UDP, dns_type: query, dns_id: 58139, dns_rrname: b97.g.yahoo.co.jp, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8229363, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58139, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: b97.g.yahoo.co.jp, dns_rrtype: AAAA, dns_rcode: NOERROR ; pcap_cnt: 9123307, event_type: dns, proto: UDP, dns_type: query, dns_id: 819, dns_rrname: cdnjs.cloudflare.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9123318, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 819, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdnjs.cloudflare.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdnjs.cloudflare.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 104.19.193.102, dns_answers_1_rrname: cdnjs.cloudflare.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 104.19.196.102, dns_answers_2_rrname: cdnjs.cloudflare.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 104.19.195.102, dns_answers_3_rrname: cdnjs.cloudflare.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 104.19.192.102, dns_answers_4_rrname: cdnjs.cloudflare.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 104.19.194.102, dns_grouped_A_0: 104.19.193.102, dns_grouped_A_1: 104.19.196.102, dns_grouped_A_2: 104.19.195.102, dns_grouped_A_3: 104.19.192.102, dns_grouped_A_4: 104.19.194.102 ; pcap_cnt: 9202448, event_type: dns, proto: UDP, dns_type: query, dns_id: 14361, dns_rrname: e3120.g.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9202481, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14361, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e3120.g.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1000, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499188256, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 9286015, event_type: dns, proto: UDP, dns_type: query, dns_id: 58425, dns_rrname: secure.fastclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9286152, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58425, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: secure.fastclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: secure.fastclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 211, dns_answers_0_rdata: vcm-media-secure.valueclick.akadns.net, dns_answers_1_rrname: vcm-media-secure.valueclick.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 120, dns_answers_1_rdata: 8.18.45.68, dns_grouped_A_0: 8.18.45.68, dns_grouped_CNAME_0: vcm-media-secure.valueclick.akadns.net ; pcap_cnt: 9526041, event_type: dns, proto: UDP, dns_type: query, dns_id: 47491, dns_rrname: bsnj.eyeblaster.akadns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9526094, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47491, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: bsnj.eyeblaster.akadns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: bsnj.eyeblaster.akadns.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 63.241.108.103, dns_grouped_A_0: 63.241.108.103 ; pcap_cnt: 9650602, event_type: dns, proto: UDP, dns_type: query, dns_id: 58953, dns_rrname: 66.74.165.54.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 9650654, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58953, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 66.74.165.54.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 66.74.165.54.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 275, dns_answers_0_rdata: ec2-54-165-74-66.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-54-165-74-66.compute-1.amazonaws.com ; pcap_cnt: 9684362, event_type: dns, proto: UDP, dns_type: query, dns_id: 18545, dns_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 9684411, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18545, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 179, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499189614, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 10332693, event_type: dns, proto: UDP, dns_type: query, dns_id: 15275, dns_rrname: os.shutterfly.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10332989, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15275, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: os.shutterfly.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: os.shutterfly.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 12, dns_answers_0_rdata: shutterfly.com.ssl.sc.omtrdc.net, dns_answers_1_rrname: shutterfly.com.ssl.sc.omtrdc.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 837, dns_answers_1_rdata: 216.104.218.66, dns_grouped_CNAME_0: shutterfly.com.ssl.sc.omtrdc.net, dns_grouped_A_0: 216.104.218.66 ; pcap_cnt: 10333128, event_type: dns, proto: UDP, dns_type: query, dns_id: 15959, dns_rrname: ytimg.l.google.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 10333137, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15959, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ytimg.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ytimg.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:0802:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0802:0000:0000:0000:200e ; pcap_cnt: 10561798, event_type: dns, proto: UDP, dns_type: query, dns_id: 13246, dns_rrname: secure-us.imrworldwide.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10561829, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13246, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: secure-us.imrworldwide.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: secure-us.imrworldwide.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 7, dns_answers_0_rdata: 138.108.7.20, dns_grouped_A_0: 138.108.7.20 ; pcap_cnt: 10729856, event_type: dns, proto: UDP, dns_type: query, dns_id: 18203, dns_rrname: 46.12.242.66.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 10729917, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18203, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 46.12.242.66.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 66.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 3991, dns_authorities_0_soa_mname: z.arin.net, dns_authorities_0_soa_rname: dns-ops.arin.net, dns_authorities_0_soa_serial: 2017023089, dns_authorities_0_soa_refresh: 1800, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 691200, dns_authorities_0_soa_minimum: 10800 ; pcap_cnt: 10746495, event_type: dns, proto: UDP, dns_type: query, dns_id: 64430, dns_rrname: twitter.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10746507, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64430, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: twitter.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: twitter.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1631, dns_answers_0_rdata: 104.244.42.65, dns_answers_1_rrname: twitter.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1631, dns_answers_1_rdata: 104.244.42.193, dns_grouped_A_0: 104.244.42.65, dns_grouped_A_1: 104.244.42.193 ; pcap_cnt: 10781772, event_type: dns, proto: UDP, dns_type: query, dns_id: 52060, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10781777, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52060, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 5, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 10, dns_answers_1_rdata: 23.60.139.27, dns_grouped_A_0: 23.60.139.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net ; pcap_cnt: 10795085, event_type: dns, proto: UDP, dns_type: query, dns_id: 30367, dns_rrname: s1.wp.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 10795087, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30367, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s1.wp.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s1.wp.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 7783, dns_answers_0_rdata: 192.0.77.32, dns_grouped_A_0: 192.0.77.32 ; pcap_cnt: 11130768, event_type: dns, proto: UDP, dns_type: query, dns_id: 64295, dns_rrname: static.criteo.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11130776, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64295, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static.criteo.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: criteo.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 3066, dns_authorities_0_soa_mname: ns1.criteo.com, dns_authorities_0_soa_rname: dns.criteo.com, dns_authorities_0_soa_serial: 2014061915, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 11277720, event_type: dns, proto: UDP, dns_type: query, dns_id: 56431, dns_rrname: 217.244.72.184.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 11277798, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56431, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 217.244.72.184.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 217.244.72.184.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 271, dns_answers_0_rdata: ec2-184-72-244-217.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-184-72-244-217.compute-1.amazonaws.com ; pcap_cnt: 11314203, event_type: dns, proto: UDP, dns_type: query, dns_id: 45166, dns_rrname: ssl.gstatic.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 11314205, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45166, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssl.gstatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ssl.gstatic.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 221, dns_answers_0_rdata: 172.217.9.227, dns_grouped_A_0: 172.217.9.227
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.