['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61634, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 171, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 172, flow_bytes_toclient: 239, flow_age: 41, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 221, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 262, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 108, flow_bytes_toclient: 164, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 107, flow_bytes_toclient: 168, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 104, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 266, flow_bytes_toclient: 491, flow_age: 167, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 112, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 175, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 147, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 141, flow_bytes_toclient: 223, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 165, flow_bytes_toclient: 297, flow_age: 199, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 296, flow_bytes_toclient: 453, flow_age: 206, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 102, flow_bytes_toclient: 130, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 197, flow_bytes_toclient: 269, flow_age: 144, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 147, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 150, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 131, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 150, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 262999, event_type: dns, proto: UDP, dns_type: query, dns_id: 5826, dns_rrname: rtb.adentifi.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 263064, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5826, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rtb.adentifi.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adentifi.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 750, dns_authorities_0_soa_mname: ns-1916.awsdns-47.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 381823, event_type: dns, proto: UDP, dns_type: query, dns_id: 47864, dns_rrname: pixel.sitescout.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 381897, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47864, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixel.sitescout.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pixel.sitescout.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 209.15.36.23, dns_grouped_A_0: 209.15.36.23 ; pcap_cnt: 405052, event_type: dns, proto: UDP, dns_type: query, dns_id: 64100, dns_rrname: img.ksl.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 405182, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64100, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: img.ksl.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: ksl.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 298, dns_authorities_0_soa_mname: ns1.ksl.com, dns_authorities_0_soa_rname: hostmaster.ksl.com, dns_authorities_0_soa_serial: 2017061602, dns_authorities_0_soa_refresh: 1800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 3978562, event_type: dns, proto: UDP, dns_type: query, dns_id: 6162, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3978858, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6162, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 5, dns_answers_0_rdata: 157.240.18.35, dns_grouped_A_0: 157.240.18.35 ; pcap_cnt: 5681829, event_type: dns, proto: UDP, dns_type: query, dns_id: 24044, dns_rrname: vid-io.springserve.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5681830, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24044, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: vid-io.springserve.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: vid-io.springserve.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 34.205.121.55, dns_answers_1_rrname: vid-io.springserve.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 52.0.73.222, dns_answers_2_rrname: vid-io.springserve.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 34.225.54.99, dns_answers_3_rrname: vid-io.springserve.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 52.200.116.219, dns_answers_4_rrname: vid-io.springserve.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 52.20.155.187, dns_answers_5_rrname: vid-io.springserve.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 34.225.204.20, dns_answers_6_rrname: vid-io.springserve.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 0, dns_answers_6_rdata: 52.20.235.234, dns_answers_7_rrname: vid-io.springserve.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 0, dns_answers_7_rdata: 52.2.103.91, dns_grouped_A_0: 34.205.121.55, dns_grouped_A_1: 52.0.73.222, dns_grouped_A_2: 34.225.54.99, dns_grouped_A_3: 52.200.116.219, dns_grouped_A_4: 52.20.155.187, dns_grouped_A_5: 34.225.204.20, dns_grouped_A_6: 52.20.235.234, dns_grouped_A_7: 52.2.103.91 ; pcap_cnt: 6343194, event_type: dns, proto: UDP, dns_type: query, dns_id: 43362, dns_rrname: r.nexac.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6343278, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43362, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: r.nexac.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: r.nexac.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 794, dns_answers_0_rdata: gtm01.nexac.com, dns_answers_1_rrname: gtm01.nexac.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 1, dns_answers_1_rdata: aws-p-nv-dc-redirect-service-1755118797.us-east-1.elb.amazonaws.com, dns_grouped_CNAME_0: gtm01.nexac.com, dns_grouped_CNAME_1: aws-p-nv-dc-redirect-service-1755118797.us-east-1.elb.amazonaws.com, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 18, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6733833, event_type: dns, proto: UDP, dns_type: query, dns_id: 33143, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6733887, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33143, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2001:4998:0058:4904:0000:0000:0000:6000, dns_answers_1_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 1, dns_answers_1_rdata: 2001:4998:0058:4904:0000:0000:0000:7000, dns_grouped_AAAA_0: 2001:4998:0058:4904:0000:0000:0000:6000, dns_grouped_AAAA_1: 2001:4998:0058:4904:0000:0000:0000:7000 ; pcap_cnt: 6893910, event_type: dns, proto: UDP, dns_type: query, dns_id: 45185, dns_rrname: prod.pinterest.global.map.fastly.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6893911, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45185, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: prod.pinterest.global.map.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 2, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 7099622, event_type: dns, proto: UDP, dns_type: query, dns_id: 46211, dns_rrname: ckm-m.xp1.ru4.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7099638, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46211, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ckm-m.xp1.ru4.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ckm-m.xp1.ru4.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 217, dns_answers_0_rdata: 199.38.165.28, dns_grouped_A_0: 199.38.165.28 ; pcap_cnt: 7387228, event_type: dns, proto: UDP, dns_type: query, dns_id: 29637, dns_rrname: pl106573.puserving.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7387249, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29637, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pl106573.puserving.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pl106573.puserving.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 3600, dns_answers_0_rdata: 213.196.2.1, dns_grouped_A_0: 213.196.2.1 ; pcap_cnt: 7423308, event_type: dns, proto: UDP, dns_type: query, dns_id: 11642, dns_rrname: www.cricbuzz.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 7423318, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11642, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.cricbuzz.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.cricbuzz.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 635, dns_answers_0_rdata: www.cricbuzz.com.cdn.cloudflare.net, dns_grouped_CNAME_0: www.cricbuzz.com.cdn.cloudflare.net, dns_authorities_0_rrname: cloudflare.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 3596, dns_authorities_0_soa_mname: ns1.cloudflare.net, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2025061052, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 7466811, event_type: dns, proto: UDP, dns_type: query, dns_id: 31939, dns_rrname: trc.taboola.com, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 7466863, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31939, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: trc.taboola.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: trc.taboola.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 602, dns_answers_0_rdata: f2.shared.global.fastly.net, dns_answers_1_rrname: f2.shared.global.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 24, dns_answers_1_rdata: 151.101.2.2, dns_answers_2_rrname: f2.shared.global.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 24, dns_answers_2_rdata: 151.101.66.2, dns_answers_3_rrname: f2.shared.global.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 24, dns_answers_3_rdata: 151.101.130.2, dns_answers_4_rrname: f2.shared.global.fastly.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 24, dns_answers_4_rdata: 151.101.194.2, dns_grouped_CNAME_0: f2.shared.global.fastly.net, dns_grouped_A_0: 151.101.2.2, dns_grouped_A_1: 151.101.66.2, dns_grouped_A_2: 151.101.130.2, dns_grouped_A_3: 151.101.194.2 ; pcap_cnt: 7815381, event_type: dns, proto: UDP, dns_type: query, dns_id: 32614, dns_rrname: www.google.ca, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7815431, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32614, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.google.ca, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.google.ca, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:081b:0000:0000:0000:2003, dns_grouped_AAAA_0: 2607:f8b0:4006:081b:0000:0000:0000:2003 ; pcap_cnt: 7925036, event_type: dns, proto: UDP, dns_type: query, dns_id: 52273, dns_rrname: ass2.fetlife.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7925059, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52273, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ass2.fetlife.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ass2.fetlife.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 42756, dns_answers_0_rdata: f.ssl.fastly.net, dns_grouped_CNAME_0: f.ssl.fastly.net, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 21, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 8036100, event_type: dns, proto: UDP, dns_type: query, dns_id: 38671, dns_rrname: 23.222.239.213.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 8036172, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38671, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 23.222.239.213.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 23.222.239.213.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 29654, dns_answers_0_rdata: prod-hzeu-exebid-lba-5.dca-ops.tech, dns_grouped_PTR_0: prod-hzeu-exebid-lba-5.dca-ops.tech ; pcap_cnt: 8164273, event_type: dns, proto: UDP, dns_type: query, dns_id: 49900, dns_rrname: productio-webserve-1qh3bqaow96ig-474813755.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8164277, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49900, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: productio-webserve-1qh3bqaow96ig-474813755.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 16, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 8509657, event_type: dns, proto: UDP, dns_type: query, dns_id: 25852, dns_rrname: d.turn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8509685, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25852, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d.turn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d.turn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 419, dns_answers_0_rdata: d.turn.com.akadns.net, dns_answers_1_rrname: d.turn.com.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 111, dns_answers_1_rdata: 50.116.194.23, dns_grouped_A_0: 50.116.194.23, dns_grouped_CNAME_0: d.turn.com.akadns.net ; pcap_cnt: 8537483, event_type: dns, proto: UDP, dns_type: query, dns_id: 46308, dns_rrname: ps.eyeota.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 8537486, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46308, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ps.eyeota.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: eyeota.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 359, dns_authorities_0_soa_mname: ns-659.awsdns-18.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8686580, event_type: dns, proto: UDP, dns_type: query, dns_id: 28044, dns_rrname: youtube-ui.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8686588, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28044, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: youtube-ui.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: youtube-ui.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 52, dns_answers_0_rdata: 2607:f8b0:4006:0802:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0802:0000:0000:0000:200e ; pcap_cnt: 8697150, event_type: dns, proto: UDP, dns_type: query, dns_id: 15506, dns_rrname: www.gewinnspiel-suche.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 8697205, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15506, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.gewinnspiel-suche.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: gewinnspiel-suche.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 86400, dns_authorities_0_soa_mname: nsa3.schlundtech.de, dns_authorities_0_soa_rname: julian.huebner.gmail.com, dns_authorities_0_soa_serial: 2016101301, dns_authorities_0_soa_refresh: 43200, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8712764, event_type: dns, proto: UDP, dns_type: query, dns_id: 3723, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 8712775, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3723, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 23.54.187.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.54.187.27 ; pcap_cnt: 8946803, event_type: dns, proto: UDP, dns_type: query, dns_id: 16940, dns_rrname: safebrowsing.cache.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8946808, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16940, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: safebrowsing.cache.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: safebrowsing.cache.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:0818:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0818:0000:0000:0000:200e ; pcap_cnt: 9105613, event_type: dns, proto: UDP, dns_type: query, dns_id: 32138, dns_rrname: d3t3uevkmnzgv4.cloudfront.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9105614, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32138, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d3t3uevkmnzgv4.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d3t3uevkmnzgv4.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 54.192.38.64, dns_grouped_A_0: 54.192.38.64 ; pcap_cnt: 9131354, event_type: dns, proto: UDP, dns_type: query, dns_id: 50330, dns_rrname: 225.37.192.54.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 2 ; pcap_cnt: 9131403, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50330, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 225.37.192.54.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 225.37.192.54.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 42212, dns_answers_0_rdata: server-54-192-37-225.jfk1.r.cloudfront.net, dns_grouped_PTR_0: server-54-192-37-225.jfk1.r.cloudfront.net ; pcap_cnt: 9516201, event_type: dns, proto: UDP, dns_type: query, dns_id: 31089, dns_rrname: vap.lijit.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9516243, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31089, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: vap.lijit.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: lijit.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 36, dns_authorities_0_soa_mname: ns1.p15.dynect.net, dns_authorities_0_soa_rname: sysadmin.lijit.com, dns_authorities_0_soa_serial: 2017070630, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 10461709, event_type: dns, proto: UDP, dns_type: query, dns_id: 36809, dns_rrname: fo-api.omnitagjs.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10461731, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36809, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fo-api.omnitagjs.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: omnitagjs.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1317, dns_authorities_0_soa_mname: emma.ns.cloudflare.com, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2024722288, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 10505091, event_type: dns, proto: UDP, dns_type: query, dns_id: 10290, dns_rrname: a.onliner.by, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10505102, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10290, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a.onliner.by, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a.onliner.by, dns_answers_0_rrtype: A, dns_answers_0_ttl: 2563, dns_answers_0_rdata: 178.124.129.12, dns_answers_1_rrname: a.onliner.by, dns_answers_1_rrtype: A, dns_answers_1_ttl: 2563, dns_answers_1_rdata: 178.124.129.14, dns_answers_2_rrname: a.onliner.by, dns_answers_2_rrtype: A, dns_answers_2_ttl: 2563, dns_answers_2_rdata: 178.124.129.16, dns_grouped_A_0: 178.124.129.12, dns_grouped_A_1: 178.124.129.14, dns_grouped_A_2: 178.124.129.16 ; pcap_cnt: 11284116, event_type: dns, proto: UDP, dns_type: query, dns_id: 25403, dns_rrname: 180.7.226.34.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 11284185, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25403, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 180.7.226.34.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 180.7.226.34.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 241, dns_answers_0_rdata: ec2-34-226-7-180.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-34-226-7-180.compute-1.amazonaws.com
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.