['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61938, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 194, flow_bytes_toclient: 297, flow_age: 139, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 289, flow_bytes_toclient: 358, flow_age: 135, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 112, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 155, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 147, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 156, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 169, flow_bytes_toclient: 345, flow_age: 38, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 203, flow_bytes_toclient: 366, flow_age: 77, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 260, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 185, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 211, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 142, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 110, flow_bytes_toclient: 142, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 172, flow_bytes_toclient: 375, flow_age: 84, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 105, flow_bytes_toclient: 199, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 174, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 111, flow_bytes_toclient: 180, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 150, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 120, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 192, flow_bytes_toclient: 312, flow_age: 3, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 96806, event_type: dns, proto: UDP, dns_type: query, dns_id: 20609, dns_rrname: 234.63.210.34.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 96807, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20609, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 234.63.210.34.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 234.63.210.34.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 136, dns_answers_0_rdata: ec2-34-210-63-234.us-west-2.compute.amazonaws.com, dns_grouped_PTR_0: ec2-34-210-63-234.us-west-2.compute.amazonaws.com ; pcap_cnt: 235604, event_type: dns, proto: UDP, dns_type: query, dns_id: 33288, dns_rrname: secure-it.imrworldwide.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 235662, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33288, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: secure-it.imrworldwide.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: secure-it.imrworldwide.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 79129, dns_answers_0_rdata: secure-gl.imrworldwide.com, dns_answers_1_rrname: secure-gl.imrworldwide.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 20, dns_answers_1_rdata: 138.108.6.20, dns_grouped_A_0: 138.108.6.20, dns_grouped_CNAME_0: secure-gl.imrworldwide.com ; pcap_cnt: 5782187, event_type: dns, proto: UDP, dns_type: query, dns_id: 12105, dns_rrname: m1.ads.betweendigital.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5782247, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12105, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: m1.ads.betweendigital.com, dns_rrtype: AAAA, dns_rcode: NOERROR ; pcap_cnt: 5817722, event_type: dns, proto: UDP, dns_type: query, dns_id: 58563, dns_rrname: rtb.adkernel.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5817773, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58563, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rtb.adkernel.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: rtb.adkernel.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 69727, dns_answers_0_rdata: 198.134.116.50, dns_grouped_A_0: 198.134.116.50 ; pcap_cnt: 5837701, event_type: dns, proto: UDP, dns_type: query, dns_id: 64416, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 5837748, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64416, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 23.50.75.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.50.75.27 ; pcap_cnt: 6368114, event_type: dns, proto: UDP, dns_type: query, dns_id: 3650, dns_rrname: e6913.dscx.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6368210, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3650, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e6913.dscx.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e6913.dscx.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 19, dns_answers_0_rdata: 23.208.165.24, dns_grouped_A_0: 23.208.165.24 ; pcap_cnt: 6468358, event_type: dns, proto: UDP, dns_type: query, dns_id: 59729, dns_rrname: indiaonclick.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6468374, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59729, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: indiaonclick.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: indiaonclick.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 378, dns_authorities_0_soa_mname: ns27.domaincontrol.com, dns_authorities_0_soa_rname: dns.jomax.net, dns_authorities_0_soa_serial: 2017031313, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 6876270, event_type: dns, proto: UDP, dns_type: query, dns_id: 48463, dns_rrname: ssl.ligatus.com.edgekey.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6876367, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48463, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssl.ligatus.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ssl.ligatus.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 21007, dns_answers_0_rdata: e2408.g.akamaiedge.net, dns_answers_1_rrname: e2408.g.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 19, dns_answers_1_rdata: 104.97.137.120, dns_grouped_CNAME_0: e2408.g.akamaiedge.net, dns_grouped_A_0: 104.97.137.120 ; pcap_cnt: 6966198, event_type: dns, proto: UDP, dns_type: query, dns_id: 39098, dns_rrname: ib.anycast.adnxs.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6966212, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 39098, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ib.anycast.adnxs.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adnxs.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 4, dns_authorities_0_soa_mname: ns1.gslb.com, dns_authorities_0_soa_rname: support.appnexus.net, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 30, dns_authorities_0_soa_expire: 86400, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 7124707, event_type: dns, proto: UDP, dns_type: query, dns_id: 65497, dns_rrname: camdolls.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7124712, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 65497, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: camdolls.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: camdolls.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 119, dns_answers_0_rdata: 141.0.174.74, dns_answers_1_rrname: camdolls.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 119, dns_answers_1_rdata: 141.0.174.73, dns_grouped_A_0: 141.0.174.74, dns_grouped_A_1: 141.0.174.73 ; pcap_cnt: 7138635, event_type: dns, proto: UDP, dns_type: query, dns_id: 16144, dns_rrname: api.iadvize.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 7138639, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16144, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: api.iadvize.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: api.iadvize.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1280, dns_answers_0_rdata: prod-elb-359470537.eu-central-1.elb.amazonaws.com, dns_grouped_CNAME_0: prod-elb-359470537.eu-central-1.elb.amazonaws.com, dns_authorities_0_rrname: eu-central-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns-1689.awsdns-19.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7480003, event_type: dns, proto: UDP, dns_type: query, dns_id: 37271, dns_rrname: r.turn.com.akadns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7480004, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37271, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: r.turn.com.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 179, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499177042, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 7498778, event_type: dns, proto: UDP, dns_type: query, dns_id: 17140, dns_rrname: blocklists.settings.services.mozilla.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 7498791, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17140, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: blocklists.settings.services.mozilla.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: blocklists.settings.services.mozilla.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: blocklists-settings.prod.mozaws.net, dns_answers_1_rrname: blocklists-settings.prod.mozaws.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 35.164.147.83, dns_answers_2_rrname: blocklists-settings.prod.mozaws.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 35.165.206.251, dns_answers_3_rrname: blocklists-settings.prod.mozaws.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 52.40.24.51, dns_grouped_CNAME_0: blocklists-settings.prod.mozaws.net, dns_grouped_A_0: 35.164.147.83, dns_grouped_A_1: 35.165.206.251, dns_grouped_A_2: 52.40.24.51 ; pcap_cnt: 7879629, event_type: dns, proto: UDP, dns_type: query, dns_id: 29467, dns_rrname: vap.lijit.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7879649, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29467, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: vap.lijit.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: vap.lijit.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 131, dns_answers_0_rdata: 169.55.70.153, dns_answers_1_rrname: vap.lijit.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 131, dns_answers_1_rdata: 169.55.70.149, dns_answers_2_rrname: vap.lijit.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 131, dns_answers_2_rdata: 169.55.70.175, dns_answers_3_rrname: vap.lijit.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 131, dns_answers_3_rdata: 67.217.177.126, dns_answers_4_rrname: vap.lijit.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 131, dns_answers_4_rdata: 169.55.70.195, dns_answers_5_rrname: vap.lijit.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 131, dns_answers_5_rdata: 169.45.121.172, dns_answers_6_rrname: vap.lijit.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 131, dns_answers_6_rdata: 169.55.165.141, dns_answers_7_rrname: vap.lijit.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 131, dns_answers_7_rdata: 169.55.70.227, dns_answers_8_rrname: vap.lijit.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 131, dns_answers_8_rdata: 169.55.70.244, dns_answers_9_rrname: vap.lijit.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 131, dns_answers_9_rdata: 67.217.177.30, dns_answers_10_rrname: vap.lijit.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 131, dns_answers_10_rdata: 169.45.121.189, dns_grouped_A_0: 169.55.70.153, dns_grouped_A_1: 169.55.70.149, dns_grouped_A_2: 169.55.70.175, dns_grouped_A_3: 67.217.177.126, dns_grouped_A_4: 169.55.70.195, dns_grouped_A_5: 169.45.121.172, dns_grouped_A_6: 169.55.165.141, dns_grouped_A_7: 169.55.70.227, dns_grouped_A_8: 169.55.70.244, dns_grouped_A_9: 67.217.177.30, dns_grouped_A_10: 169.45.121.189 ; pcap_cnt: 8113312, event_type: dns, proto: UDP, dns_type: query, dns_id: 63862, dns_rrname: www.prosieben.de, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8113360, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63862, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.prosieben.de, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.prosieben.de, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 147, dns_answers_0_rdata: www.prosieben.de-v1.edgekey.net, dns_answers_1_rrname: www.prosieben.de-v1.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 3383, dns_answers_1_rdata: e5103.dsce2.akamaiedge.net, dns_answers_2_rrname: e5103.dsce2.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 104.88.55.195, dns_grouped_CNAME_0: www.prosieben.de-v1.edgekey.net, dns_grouped_CNAME_1: e5103.dsce2.akamaiedge.net, dns_grouped_A_0: 104.88.55.195 ; pcap_cnt: 8156859, event_type: dns, proto: UDP, dns_type: query, dns_id: 53559, dns_rrname: c.go-mpulse.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8156900, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53559, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: c.go-mpulse.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: c.go-mpulse.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 472, dns_answers_0_rdata: c.go-mpulse.net.cdn.cloudflare.net, dns_answers_1_rrname: c.go-mpulse.net.cdn.cloudflare.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 30, dns_answers_1_rdata: 104.16.124.228, dns_answers_2_rrname: c.go-mpulse.net.cdn.cloudflare.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 30, dns_answers_2_rdata: 104.16.125.228, dns_answers_3_rrname: c.go-mpulse.net.cdn.cloudflare.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 30, dns_answers_3_rdata: 104.16.126.228, dns_answers_4_rrname: c.go-mpulse.net.cdn.cloudflare.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 30, dns_answers_4_rdata: 104.16.32.229, dns_answers_5_rrname: c.go-mpulse.net.cdn.cloudflare.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 30, dns_answers_5_rdata: 104.16.127.228, dns_grouped_CNAME_0: c.go-mpulse.net.cdn.cloudflare.net, dns_grouped_A_0: 104.16.124.228, dns_grouped_A_1: 104.16.125.228, dns_grouped_A_2: 104.16.126.228, dns_grouped_A_3: 104.16.32.229, dns_grouped_A_4: 104.16.127.228 ; pcap_cnt: 8781722, event_type: dns, proto: UDP, dns_type: query, dns_id: 63334, dns_rrname: ec-ns.sascdn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8781726, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63334, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ec-ns.sascdn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ec-ns.sascdn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 52, dns_answers_0_rdata: cs410.wac.edgecastcdn.net, dns_answers_1_rrname: cs410.wac.edgecastcdn.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 747, dns_answers_1_rdata: 93.184.216.16, dns_grouped_CNAME_0: cs410.wac.edgecastcdn.net, dns_grouped_A_0: 93.184.216.16 ; pcap_cnt: 9130314, event_type: dns, proto: UDP, dns_type: query, dns_id: 29114, dns_rrname: level3.cedexis-test.com.c.footprint.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9130354, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29114, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: level3.cedexis-test.com.c.footprint.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: level3.cedexis-test.com.c.footprint.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 218, dns_answers_0_rdata: 192.221.118.250, dns_answers_1_rrname: level3.cedexis-test.com.c.footprint.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 218, dns_answers_1_rdata: 205.128.70.122, dns_grouped_A_0: 192.221.118.250, dns_grouped_A_1: 205.128.70.122 ; pcap_cnt: 9308325, event_type: dns, proto: UDP, dns_type: query, dns_id: 31509, dns_rrname: www.20minutes.fr, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9308468, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31509, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.20minutes.fr, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.20minutes.fr, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 491, dns_answers_0_rdata: www.20minutes.fr.2-01-2715-001e.cdx.cedexis.net, dns_answers_1_rrname: www.20minutes.fr.2-01-2715-001e.cdx.cedexis.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20, dns_answers_1_rdata: ssl-20minutes.fr.c.footprint.net, dns_answers_2_rrname: ssl-20minutes.fr.c.footprint.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 230, dns_answers_2_rdata: 8.247.96.128, dns_grouped_A_0: 8.247.96.128, dns_grouped_CNAME_0: www.20minutes.fr.2-01-2715-001e.cdx.cedexis.net, dns_grouped_CNAME_1: ssl-20minutes.fr.c.footprint.net ; pcap_cnt: 9371684, event_type: dns, proto: UDP, dns_type: query, dns_id: 51607, dns_rrname: mail.yahoo.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 9371767, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51607, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: mail.yahoo.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: mail.yahoo.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 955, dns_answers_0_rdata: login.yahoo.com, dns_answers_1_rrname: login.yahoo.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 1, dns_answers_1_rdata: fo-ds-ats.member.g02.yahoodns.net, dns_answers_2_rrname: fo-ds-ats.member.g02.yahoodns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 98.139.21.169, dns_grouped_A_0: 98.139.21.169, dns_grouped_CNAME_0: login.yahoo.com, dns_grouped_CNAME_1: fo-ds-ats.member.g02.yahoodns.net ; pcap_cnt: 10047832, event_type: dns, proto: UDP, dns_type: query, dns_id: 53637, dns_rrname: as-sec.casalemedia.com.edgekey.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10047834, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53637, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: as-sec.casalemedia.com.edgekey.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: as-sec.casalemedia.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 21244, dns_answers_0_rdata: e8037.g.akamaiedge.net, dns_grouped_CNAME_0: e8037.g.akamaiedge.net, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 400, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499190076, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 10124924, event_type: dns, proto: UDP, dns_type: query, dns_id: 43669, dns_rrname: d.ermisvc.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10124941, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43669, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d.ermisvc.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: ermisvc.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 78, dns_authorities_0_soa_mname: ns-cloud-b1.googledomains.com, dns_authorities_0_soa_rname: cloud-dns-hostmaster.google.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 21600, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 259200, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 10296040, event_type: dns, proto: UDP, dns_type: query, dns_id: 42399, dns_rrname: www.santander.online-quote-and-buy.co.uk, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10296305, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42399, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.santander.online-quote-and-buy.co.uk, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: online-quote-and-buy.co.uk, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1799, dns_authorities_0_soa_mname: a4.nstld.com, dns_authorities_0_soa_rname: hostmaster.cscdns.net, dns_authorities_0_soa_serial: 2016061408, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 14400 ; pcap_cnt: 10498213, event_type: dns, proto: UDP, dns_type: query, dns_id: 44260, dns_rrname: 68.194.83.54.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 10498218, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44260, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 68.194.83.54.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 68.194.83.54.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 172, dns_answers_0_rdata: ec2-54-83-194-68.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-54-83-194-68.compute-1.amazonaws.com ; pcap_cnt: 10739284, event_type: dns, proto: UDP, dns_type: query, dns_id: 32934, dns_rrname: www.linkbucks.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10739285, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32934, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.linkbucks.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.linkbucks.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 104.20.12.25, dns_answers_1_rrname: www.linkbucks.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 104.20.13.25, dns_grouped_A_0: 104.20.12.25, dns_grouped_A_1: 104.20.13.25 ; pcap_cnt: 10814319, event_type: dns, proto: UDP, dns_type: query, dns_id: 49524, dns_rrname: 176.255.243.54.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 10814334, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49524, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 176.255.243.54.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 176.255.243.54.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 53, dns_answers_0_rdata: ec2-54-243-255-176.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-54-243-255-176.compute-1.amazonaws.com ; pcap_cnt: 10815730, event_type: dns, proto: UDP, dns_type: query, dns_id: 50278, dns_rrname: d.ssl.global.fastly.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 10815751, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50278, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d.ssl.global.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d.ssl.global.fastly.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 11, dns_answers_0_rdata: 151.101.0.207, dns_answers_1_rrname: d.ssl.global.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 11, dns_answers_1_rdata: 151.101.64.207, dns_answers_2_rrname: d.ssl.global.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 11, dns_answers_2_rdata: 151.101.128.207, dns_answers_3_rrname: d.ssl.global.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 11, dns_answers_3_rdata: 151.101.192.207, dns_grouped_A_0: 151.101.0.207, dns_grouped_A_1: 151.101.64.207, dns_grouped_A_2: 151.101.128.207, dns_grouped_A_3: 151.101.192.207 ; pcap_cnt: 10853911, event_type: dns, proto: UDP, dns_type: query, dns_id: 6623, dns_rrname: aa.agkn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10853955, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6623, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: aa.agkn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: aa.agkn.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 156.154.200.36, dns_answers_1_rrname: aa.agkn.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 63.251.88.56, dns_grouped_A_0: 156.154.200.36, dns_grouped_A_1: 63.251.88.56
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.