['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 62348, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 173, flow_bytes_toclient: 476, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 217, flow_bytes_toclient: 413, flow_age: 5, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 140, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 260, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 175, flow_bytes_toclient: 303, flow_age: 179, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 191, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 147, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 108, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 189, flow_bytes_toclient: 338, flow_age: 117, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 203, flow_bytes_toclient: 543, flow_age: 63, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 182, flow_bytes_toclient: 306, flow_age: 98, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 150, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 230, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 135, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 179, flow_bytes_toclient: 275, flow_age: 195, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 384, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 211, flow_bytes_toclient: 354, flow_age: 99, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 140, flow_age: 1, flow_state: established, flow_reason: timeout ; pcap_cnt: 2230359, event_type: dns, proto: UDP, dns_type: query, dns_id: 64067, dns_rrname: e.nexac.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2230504, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64067, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e.nexac.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e.nexac.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 7, dns_answers_0_rdata: gtm02.nexac.com, dns_answers_1_rrname: gtm02.nexac.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 8, dns_answers_1_rdata: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_answers_2_rrname: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 12, dns_answers_2_rdata: 52.86.195.127, dns_answers_3_rrname: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 12, dns_answers_3_rdata: 52.54.231.67, dns_answers_4_rrname: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 12, dns_answers_4_rdata: 34.224.19.173, dns_answers_5_rrname: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 12, dns_answers_5_rdata: 34.196.94.10, dns_answers_6_rrname: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 12, dns_answers_6_rdata: 52.5.211.30, dns_answers_7_rrname: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 12, dns_answers_7_rdata: 34.225.210.19, dns_answers_8_rrname: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 12, dns_answers_8_rdata: 34.206.140.200, dns_answers_9_rrname: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 12, dns_answers_9_rdata: 54.84.166.42, dns_grouped_CNAME_0: gtm02.nexac.com, dns_grouped_CNAME_1: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 52.86.195.127, dns_grouped_A_1: 52.54.231.67, dns_grouped_A_2: 34.224.19.173, dns_grouped_A_3: 34.196.94.10, dns_grouped_A_4: 52.5.211.30, dns_grouped_A_5: 34.225.210.19, dns_grouped_A_6: 34.206.140.200, dns_grouped_A_7: 54.84.166.42 ; pcap_cnt: 2230846, event_type: dns, proto: UDP, dns_type: query, dns_id: 10097, dns_rrname: ad.sxp.smartclip.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 2230890, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10097, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad.sxp.smartclip.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: smartclip.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 528, dns_authorities_0_soa_mname: ns-1562.awsdns-03.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 5379550, event_type: dns, proto: UDP, dns_type: query, dns_id: 54450, dns_rrname: 64.61.253.131.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 5379555, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 54450, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 64.61.253.131.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 61.253.131.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 162, dns_authorities_0_soa_mname: ns1.msft.net, dns_authorities_0_soa_rname: msnhst.microsoft.com, dns_authorities_0_soa_serial: 2015043001, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 7200000, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 5380390, event_type: dns, proto: UDP, dns_type: query, dns_id: 47942, dns_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5380392, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47942, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 29, dns_answers_0_rdata: 54.197.253.149, dns_answers_1_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 29, dns_answers_1_rdata: 50.19.80.26, dns_answers_2_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 29, dns_answers_2_rdata: 50.19.236.121, dns_answers_3_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 29, dns_answers_3_rdata: 54.204.21.169, dns_answers_4_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 29, dns_answers_4_rdata: 54.197.246.53, dns_answers_5_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 29, dns_answers_5_rdata: 23.23.245.152, dns_answers_6_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 29, dns_answers_6_rdata: 54.204.26.20, dns_answers_7_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 29, dns_answers_7_rdata: 50.19.87.106, dns_grouped_A_0: 54.197.253.149, dns_grouped_A_1: 50.19.80.26, dns_grouped_A_2: 50.19.236.121, dns_grouped_A_3: 54.204.21.169, dns_grouped_A_4: 54.197.246.53, dns_grouped_A_5: 23.23.245.152, dns_grouped_A_6: 54.204.26.20, dns_grouped_A_7: 50.19.87.106 ; pcap_cnt: 6560744, event_type: dns, proto: UDP, dns_type: query, dns_id: 40851, dns_rrname: 104.108.79.45.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 6560765, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40851, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 104.108.79.45.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 104.108.79.45.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 48235, dns_answers_0_rdata: li1207-104.members.linode.com, dns_grouped_PTR_0: li1207-104.members.linode.com ; pcap_cnt: 6913954, event_type: dns, proto: UDP, dns_type: query, dns_id: 47862, dns_rrname: gscounters.eu1.gigya.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6913956, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47862, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: gscounters.eu1.gigya.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: gscounters.eu1.gigya.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 874, dns_answers_0_rdata: farm2.eu1.gigya.com, dns_answers_1_rrname: farm2.eu1.gigya.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 532, dns_answers_1_rdata: lb.eu1.gigya.com, dns_answers_2_rrname: lb.eu1.gigya.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 4, dns_answers_2_rdata: 52.17.121.244, dns_answers_3_rrname: lb.eu1.gigya.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 4, dns_answers_3_rdata: 52.19.57.181, dns_answers_4_rrname: lb.eu1.gigya.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 4, dns_answers_4_rdata: 52.31.157.92, dns_answers_5_rrname: lb.eu1.gigya.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 4, dns_answers_5_rdata: 52.212.156.205, dns_answers_6_rrname: lb.eu1.gigya.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 4, dns_answers_6_rdata: 52.49.16.186, dns_answers_7_rrname: lb.eu1.gigya.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 4, dns_answers_7_rdata: 52.30.9.119, dns_answers_8_rrname: lb.eu1.gigya.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 4, dns_answers_8_rdata: 52.17.82.217, dns_answers_9_rrname: lb.eu1.gigya.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 4, dns_answers_9_rdata: 54.229.120.124, dns_grouped_CNAME_0: farm2.eu1.gigya.com, dns_grouped_CNAME_1: lb.eu1.gigya.com, dns_grouped_A_0: 52.17.121.244, dns_grouped_A_1: 52.19.57.181, dns_grouped_A_2: 52.31.157.92, dns_grouped_A_3: 52.212.156.205, dns_grouped_A_4: 52.49.16.186, dns_grouped_A_5: 52.30.9.119, dns_grouped_A_6: 52.17.82.217, dns_grouped_A_7: 54.229.120.124 ; pcap_cnt: 7078067, event_type: dns, proto: UDP, dns_type: query, dns_id: 59395, dns_rrname: px.moatads.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7078092, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59395, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: px.moatads.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: px.moatads.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 33, dns_answers_0_rdata: wildcard.moatads.com.edgekey.net, dns_answers_1_rrname: wildcard.moatads.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 21, dns_answers_1_rdata: e11100.g.akamaiedge.net, dns_answers_2_rrname: e11100.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 8, dns_answers_2_rdata: 104.92.115.67, dns_grouped_CNAME_0: wildcard.moatads.com.edgekey.net, dns_grouped_CNAME_1: e11100.g.akamaiedge.net, dns_grouped_A_0: 104.92.115.67 ; pcap_cnt: 7122566, event_type: dns, proto: UDP, dns_type: query, dns_id: 56262, dns_rrname: x.skimresources.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 7122691, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56262, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: x.skimresources.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: x.skimresources.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 34.225.206.80, dns_answers_1_rrname: x.skimresources.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 54.152.24.232, dns_grouped_A_0: 34.225.206.80, dns_grouped_A_1: 54.152.24.232 ; pcap_cnt: 7528707, event_type: dns, proto: UDP, dns_type: query, dns_id: 42404, dns_rrname: tm2.r-ad.ne.jp, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7528715, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42404, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tm2.r-ad.ne.jp, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tm2.r-ad.ne.jp, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 68, dns_answers_0_rdata: tm2-prd-mktpf-jp-1119088089.ap-northeast-1.elb.amazonaws.com, dns_answers_1_rrname: tm2-prd-mktpf-jp-1119088089.ap-northeast-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 58, dns_answers_1_rdata: 52.198.93.173, dns_answers_2_rrname: tm2-prd-mktpf-jp-1119088089.ap-northeast-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 58, dns_answers_2_rdata: 52.68.111.125, dns_grouped_CNAME_0: tm2-prd-mktpf-jp-1119088089.ap-northeast-1.elb.amazonaws.com, dns_grouped_A_0: 52.198.93.173, dns_grouped_A_1: 52.68.111.125 ; pcap_cnt: 8089488, event_type: dns, proto: UDP, dns_type: query, dns_id: 45215, dns_rrname: pr-bh.ybp.yahoo.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8089624, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45215, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pr-bh.ybp.yahoo.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pr-bh.ybp.yahoo.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 0, dns_answers_0_rdata: pr-bh.ybp.gysm.yahoodns.net, dns_answers_1_rrname: pr-bh.ybp.gysm.yahoodns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 185, dns_answers_1_rdata: 72.30.2.182, dns_grouped_CNAME_0: pr-bh.ybp.gysm.yahoodns.net, dns_grouped_A_0: 72.30.2.182 ; pcap_cnt: 8548085, event_type: dns, proto: UDP, dns_type: query, dns_id: 53456, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8548098, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53456, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: scontent.xx.fbcdn.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 57, dns_answers_0_rdata: 157.240.2.25, dns_grouped_A_0: 157.240.2.25 ; pcap_cnt: 8815555, event_type: dns, proto: UDP, dns_type: query, dns_id: 58022, dns_rrname: support.mozilla.org, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8815557, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58022, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: support.mozilla.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: support.mozilla.org, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 5, dns_answers_0_rdata: sumo.external.zlb.scl3.mozilla.com, dns_answers_1_rrname: sumo.external.zlb.scl3.mozilla.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 15, dns_answers_1_rdata: 63.245.213.32, dns_grouped_A_0: 63.245.213.32, dns_grouped_CNAME_0: sumo.external.zlb.scl3.mozilla.com ; pcap_cnt: 8836140, event_type: dns, proto: UDP, dns_type: query, dns_id: 25980, dns_rrname: dcky6u1m8u6el.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 8836156, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25980, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dcky6u1m8u6el.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: dcky6u1m8u6el.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 60, dns_authorities_0_soa_mname: ns-1336.awsdns-39.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 9485163, event_type: dns, proto: UDP, dns_type: query, dns_id: 45935, dns_rrname: ads.adaptv.advertising.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9485174, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45935, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ads.adaptv.advertising.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ads.adaptv.advertising.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: control.adap.tv, dns_answers_1_rrname: control.adap.tv, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 1, dns_answers_1_rdata: control.adap.tv.akadns.net, dns_answers_2_rrname: control.adap.tv.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 196, dns_answers_2_rdata: control-ec-local.adap.tv.akadns.net, dns_answers_3_rrname: control-ec-local.adap.tv.akadns.net, dns_answers_3_rrtype: CNAME, dns_answers_3_ttl: 1, dns_answers_3_rdata: ads-zone-c-317772296.us-east-1.elb.amazonaws.com, dns_answers_4_rrname: ads-zone-c-317772296.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 52.70.24.187, dns_answers_5_rrname: ads-zone-c-317772296.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.164.249.237, dns_answers_6_rrname: ads-zone-c-317772296.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 52.71.128.178, dns_answers_7_rrname: ads-zone-c-317772296.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 54.173.89.177, dns_answers_8_rrname: ads-zone-c-317772296.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 54.81.83.91, dns_answers_9_rrname: ads-zone-c-317772296.us-east-1.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 1, dns_answers_9_rdata: 54.84.84.48, dns_answers_10_rrname: ads-zone-c-317772296.us-east-1.elb.amazonaws.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 1, dns_answers_10_rdata: 34.195.104.108, dns_answers_11_rrname: ads-zone-c-317772296.us-east-1.elb.amazonaws.com, dns_answers_11_rrtype: A, dns_answers_11_ttl: 1, dns_answers_11_rdata: 23.20.226.199, dns_grouped_A_0: 52.70.24.187, dns_grouped_A_1: 54.164.249.237, dns_grouped_A_2: 52.71.128.178, dns_grouped_A_3: 54.173.89.177, dns_grouped_A_4: 54.81.83.91, dns_grouped_A_5: 54.84.84.48, dns_grouped_A_6: 34.195.104.108, dns_grouped_A_7: 23.20.226.199, dns_grouped_CNAME_0: control.adap.tv, dns_grouped_CNAME_1: control.adap.tv.akadns.net, dns_grouped_CNAME_2: control-ec-local.adap.tv.akadns.net, dns_grouped_CNAME_3: ads-zone-c-317772296.us-east-1.elb.amazonaws.com ; pcap_cnt: 9492184, event_type: dns, proto: UDP, dns_type: query, dns_id: 38581, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 9492245, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38581, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 23.50.75.27, dns_grouped_A_0: 23.50.75.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net ; pcap_cnt: 9709487, event_type: dns, proto: UDP, dns_type: query, dns_id: 61403, dns_rrname: platform-eb.twitter.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9709506, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61403, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: platform-eb.twitter.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: twitter.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 48, dns_authorities_0_soa_mname: ns1.p26.dynect.net, dns_authorities_0_soa_rname: zone-admin.dyndns.com, dns_authorities_0_soa_serial: 2007136030, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 9717563, event_type: dns, proto: UDP, dns_type: query, dns_id: 20698, dns_rrname: fonts.gstatic.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 9717605, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20698, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fonts.gstatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: fonts.gstatic.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 25, dns_answers_0_rdata: gstaticadssl.l.google.com, dns_answers_1_rrname: gstaticadssl.l.google.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 174, dns_answers_1_rdata: 172.217.9.227, dns_grouped_A_0: 172.217.9.227, dns_grouped_CNAME_0: gstaticadssl.l.google.com ; pcap_cnt: 10374440, event_type: dns, proto: UDP, dns_type: query, dns_id: 22357, dns_rrname: a1213.g.akamai.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10374442, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22357, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a1213.g.akamai.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamai.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 811, dns_authorities_0_soa_mname: n0g.akamai.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499105908, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 10450292, event_type: dns, proto: UDP, dns_type: query, dns_id: 24855, dns_rrname: rtp-static.marketo.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10450317, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24855, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rtp-static.marketo.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: rtp-static.marketo.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 449, dns_answers_0_rdata: wildcard.marketo.com.edgekey.net, dns_answers_1_rrname: wildcard.marketo.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 889, dns_answers_1_rdata: e8999.b.akamaiedge.net, dns_grouped_CNAME_0: wildcard.marketo.com.edgekey.net, dns_grouped_CNAME_1: e8999.b.akamaiedge.net, dns_authorities_0_rrname: b.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 320, dns_authorities_0_soa_mname: n0b.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499105496, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 10497998, event_type: dns, proto: UDP, dns_type: query, dns_id: 51899, dns_rrname: top-fwz1.mail.ru, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10498046, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51899, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: top-fwz1.mail.ru, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: top-fwz1.mail.ru, dns_answers_0_rrtype: A, dns_answers_0_ttl: 9, dns_answers_0_rdata: 217.69.133.148, dns_answers_1_rrname: top-fwz1.mail.ru, dns_answers_1_rrtype: A, dns_answers_1_ttl: 9, dns_answers_1_rdata: 217.69.136.175, dns_answers_2_rrname: top-fwz1.mail.ru, dns_answers_2_rrtype: A, dns_answers_2_ttl: 9, dns_answers_2_rdata: 217.69.133.145, dns_grouped_A_0: 217.69.133.148, dns_grouped_A_1: 217.69.136.175, dns_grouped_A_2: 217.69.133.145 ; pcap_cnt: 11171447, event_type: dns, proto: UDP, dns_type: query, dns_id: 38522, dns_rrname: target.smi2.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11171478, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38522, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: target.smi2.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: target.smi2.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 219, dns_answers_0_rdata: 5.9.92.53, dns_answers_1_rrname: target.smi2.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 219, dns_answers_1_rdata: 144.76.224.27, dns_answers_2_rrname: target.smi2.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 219, dns_answers_2_rdata: 144.76.224.26, dns_answers_3_rrname: target.smi2.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 219, dns_answers_3_rdata: 148.251.13.189, dns_answers_4_rrname: target.smi2.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 219, dns_answers_4_rdata: 144.76.20.141, dns_grouped_A_0: 5.9.92.53, dns_grouped_A_1: 144.76.224.27, dns_grouped_A_2: 144.76.224.26, dns_grouped_A_3: 148.251.13.189, dns_grouped_A_4: 144.76.20.141 ; pcap_cnt: 11242490, event_type: dns, proto: UDP, dns_type: query, dns_id: 14637, dns_rrname: dart.l.doubleclick.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 11242539, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14637, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dart.l.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dart.l.doubleclick.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 216.58.219.198, dns_grouped_A_0: 216.58.219.198 ; pcap_cnt: 11287115, event_type: dns, proto: UDP, dns_type: query, dns_id: 1526, dns_rrname: ads.adaptv.advertising.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11287117, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1526, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ads.adaptv.advertising.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ads.adaptv.advertising.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: control.adap.tv, dns_answers_1_rrname: control.adap.tv, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 1, dns_answers_1_rdata: control.adap.tv.akadns.net, dns_answers_2_rrname: control.adap.tv.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 0, dns_answers_2_rdata: control-ec-local.adap.tv.akadns.net, dns_answers_3_rrname: control-ec-local.adap.tv.akadns.net, dns_answers_3_rrtype: CNAME, dns_answers_3_ttl: 1, dns_answers_3_rdata: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_4_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 52.0.229.16, dns_answers_5_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 52.0.71.156, dns_answers_6_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 52.20.60.244, dns_answers_7_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 52.2.15.203, dns_answers_8_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 52.20.247.142, dns_answers_9_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 1, dns_answers_9_rdata: 52.0.144.83, dns_answers_10_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 1, dns_answers_10_rdata: 52.1.98.83, dns_answers_11_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_11_rrtype: A, dns_answers_11_ttl: 1, dns_answers_11_rdata: 52.0.146.142, dns_grouped_A_0: 52.0.229.16, dns_grouped_A_1: 52.0.71.156, dns_grouped_A_2: 52.20.60.244, dns_grouped_A_3: 52.2.15.203, dns_grouped_A_4: 52.20.247.142, dns_grouped_A_5: 52.0.144.83, dns_grouped_A_6: 52.1.98.83, dns_grouped_A_7: 52.0.146.142, dns_grouped_CNAME_0: control.adap.tv, dns_grouped_CNAME_1: control.adap.tv.akadns.net, dns_grouped_CNAME_2: control-ec-local.adap.tv.akadns.net, dns_grouped_CNAME_3: ads-zone-b-486611221.us-east-1.elb.amazonaws.com ; pcap_cnt: 11418269, event_type: dns, proto: UDP, dns_type: query, dns_id: 6911, dns_rrname: a948.b.akamai.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11418290, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6911, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a948.b.akamai.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: b.akamai.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1000, dns_authorities_0_soa_mname: n0b.akamai.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499111089, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 11452878, event_type: dns, proto: UDP, dns_type: query, dns_id: 55346, dns_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 11452934, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55346, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 30, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 11610990, event_type: dns, proto: UDP, dns_type: query, dns_id: 5135, dns_rrname: sr30.ocsp.secomtrust.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11611323, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5135, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sr30.ocsp.secomtrust.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sr30.ocsp.secomtrust.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 260, dns_answers_0_rdata: ksdc0016-11.dr.secomtrust.net, dns_answers_1_rrname: ksdc0016-11.dr.secomtrust.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 29, dns_answers_1_rdata: 113.52.156.18, dns_grouped_CNAME_0: ksdc0016-11.dr.secomtrust.net, dns_grouped_A_0: 113.52.156.18
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.