['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.9, src_port: 56142, dest_ip: 192.168.10.3, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 148, flow_bytes_toclient: 356, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 154, flow_bytes_toclient: 478, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 158, flow_bytes_toclient: 352, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 186, flow_bytes_toclient: 218, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 174, flow_bytes_toclient: 206, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 144, flow_bytes_toclient: 176, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 4330482, event_type: dns, proto: UDP, dns_type: query, dns_id: 6652, dns_rrname: wf.taboola.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4330483, event_type: dns, proto: UDP, dns_type: query, dns_id: 6652, dns_rrname: wf.taboola.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 4330512, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6652, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: wf.taboola.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: wf.taboola.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 4598, dns_answers_0_rdata: trc.taboola.map.fastly.net, dns_answers_1_rrname: trc.taboola.map.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 25, dns_answers_1_rdata: 151.101.2.49, dns_answers_2_rrname: trc.taboola.map.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 25, dns_answers_2_rdata: 151.101.66.49, dns_answers_3_rrname: trc.taboola.map.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 25, dns_answers_3_rdata: 151.101.130.49, dns_answers_4_rrname: trc.taboola.map.fastly.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 25, dns_answers_4_rdata: 151.101.194.49, dns_grouped_A_0: 151.101.2.49, dns_grouped_A_1: 151.101.66.49, dns_grouped_A_2: 151.101.130.49, dns_grouped_A_3: 151.101.194.49, dns_grouped_CNAME_0: trc.taboola.map.fastly.net ; pcap_cnt: 4330513, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6652, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: wf.taboola.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: wf.taboola.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 4598, dns_answers_0_rdata: trc.taboola.map.fastly.net, dns_answers_1_rrname: trc.taboola.map.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 25, dns_answers_1_rdata: 151.101.2.49, dns_answers_2_rrname: trc.taboola.map.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 25, dns_answers_2_rdata: 151.101.66.49, dns_answers_3_rrname: trc.taboola.map.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 25, dns_answers_3_rdata: 151.101.130.49, dns_answers_4_rrname: trc.taboola.map.fastly.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 25, dns_answers_4_rdata: 151.101.194.49, dns_grouped_A_0: 151.101.2.49, dns_grouped_A_1: 151.101.66.49, dns_grouped_A_2: 151.101.130.49, dns_grouped_A_3: 151.101.194.49, dns_grouped_CNAME_0: trc.taboola.map.fastly.net ; pcap_cnt: 5533687, event_type: dns, proto: UDP, dns_type: query, dns_id: 21895, dns_rrname: spa56c.eolcdn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5533688, event_type: dns, proto: UDP, dns_type: query, dns_id: 21895, dns_rrname: spa56c.eolcdn.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 5534028, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21895, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: spa56c.eolcdn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: spa56c.eolcdn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2600, dns_answers_0_rdata: eu.eolcdn.com, dns_answers_1_rrname: eu.eolcdn.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 7197, dns_answers_1_rdata: fr.eu.eolcdn.com, dns_answers_2_rrname: fr.eu.eolcdn.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 7198, dns_answers_2_rdata: 109.232.194.246, dns_answers_3_rrname: fr.eu.eolcdn.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 7198, dns_answers_3_rdata: 109.232.194.249, dns_answers_4_rrname: fr.eu.eolcdn.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 7198, dns_answers_4_rdata: 109.232.194.248, dns_answers_5_rrname: fr.eu.eolcdn.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 7198, dns_answers_5_rdata: 109.232.194.251, dns_answers_6_rrname: fr.eu.eolcdn.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 7198, dns_answers_6_rdata: 109.232.194.254, dns_answers_7_rrname: fr.eu.eolcdn.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 7198, dns_answers_7_rdata: 109.232.194.247, dns_answers_8_rrname: fr.eu.eolcdn.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 7198, dns_answers_8_rdata: 109.232.194.253, dns_answers_9_rrname: fr.eu.eolcdn.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 7198, dns_answers_9_rdata: 109.232.194.252, dns_grouped_A_0: 109.232.194.246, dns_grouped_A_1: 109.232.194.249, dns_grouped_A_2: 109.232.194.248, dns_grouped_A_3: 109.232.194.251, dns_grouped_A_4: 109.232.194.254, dns_grouped_A_5: 109.232.194.247, dns_grouped_A_6: 109.232.194.253, dns_grouped_A_7: 109.232.194.252, dns_grouped_CNAME_0: eu.eolcdn.com, dns_grouped_CNAME_1: fr.eu.eolcdn.com ; pcap_cnt: 5534029, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21895, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: spa56c.eolcdn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: spa56c.eolcdn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2600, dns_answers_0_rdata: eu.eolcdn.com, dns_answers_1_rrname: eu.eolcdn.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 7197, dns_answers_1_rdata: fr.eu.eolcdn.com, dns_answers_2_rrname: fr.eu.eolcdn.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 7198, dns_answers_2_rdata: 109.232.194.246, dns_answers_3_rrname: fr.eu.eolcdn.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 7198, dns_answers_3_rdata: 109.232.194.249, dns_answers_4_rrname: fr.eu.eolcdn.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 7198, dns_answers_4_rdata: 109.232.194.248, dns_answers_5_rrname: fr.eu.eolcdn.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 7198, dns_answers_5_rdata: 109.232.194.251, dns_answers_6_rrname: fr.eu.eolcdn.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 7198, dns_answers_6_rdata: 109.232.194.254, dns_answers_7_rrname: fr.eu.eolcdn.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 7198, dns_answers_7_rdata: 109.232.194.247, dns_answers_8_rrname: fr.eu.eolcdn.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 7198, dns_answers_8_rdata: 109.232.194.253, dns_answers_9_rrname: fr.eu.eolcdn.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 7198, dns_answers_9_rdata: 109.232.194.252, dns_grouped_CNAME_0: eu.eolcdn.com, dns_grouped_CNAME_1: fr.eu.eolcdn.com, dns_grouped_A_0: 109.232.194.246, dns_grouped_A_1: 109.232.194.249, dns_grouped_A_2: 109.232.194.248, dns_grouped_A_3: 109.232.194.251, dns_grouped_A_4: 109.232.194.254, dns_grouped_A_5: 109.232.194.247, dns_grouped_A_6: 109.232.194.253, dns_grouped_A_7: 109.232.194.252 ; pcap_cnt: 6280982, event_type: dns, proto: UDP, dns_type: query, dns_id: 46552, dns_rrname: cnt.wetteronline.de, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6280983, event_type: dns, proto: UDP, dns_type: query, dns_id: 46552, dns_rrname: cnt.wetteronline.de, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 6281560, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46552, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cnt.wetteronline.de, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cnt.wetteronline.de, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 899, dns_answers_0_rdata: cnt.wetteronline.de.edgekey.net, dns_answers_1_rrname: cnt.wetteronline.de.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 12129, dns_answers_1_rdata: e2191.dscg.akamaiedge.net, dns_answers_2_rrname: e2191.dscg.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 18, dns_answers_2_rdata: 104.97.137.26, dns_grouped_CNAME_0: cnt.wetteronline.de.edgekey.net, dns_grouped_CNAME_1: e2191.dscg.akamaiedge.net, dns_grouped_A_0: 104.97.137.26 ; pcap_cnt: 6281561, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46552, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cnt.wetteronline.de, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cnt.wetteronline.de, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 899, dns_answers_0_rdata: cnt.wetteronline.de.edgekey.net, dns_answers_1_rrname: cnt.wetteronline.de.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 12129, dns_answers_1_rdata: e2191.dscg.akamaiedge.net, dns_answers_2_rrname: e2191.dscg.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 18, dns_answers_2_rdata: 104.97.137.26, dns_grouped_CNAME_0: cnt.wetteronline.de.edgekey.net, dns_grouped_CNAME_1: e2191.dscg.akamaiedge.net, dns_grouped_A_0: 104.97.137.26 ; pcap_cnt: 6388379, event_type: dns, proto: UDP, dns_type: query, dns_id: 12911, dns_rrname: www-googletagmanager.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6388380, event_type: dns, proto: UDP, dns_type: query, dns_id: 12911, dns_rrname: www-googletagmanager.l.google.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 6388381, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12911, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www-googletagmanager.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www-googletagmanager.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 113, dns_answers_0_rdata: 172.217.10.8, dns_grouped_A_0: 172.217.10.8 ; pcap_cnt: 6388382, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12911, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www-googletagmanager.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www-googletagmanager.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 113, dns_answers_0_rdata: 172.217.10.8, dns_grouped_A_0: 172.217.10.8 ; pcap_cnt: 6619378, event_type: dns, proto: UDP, dns_type: query, dns_id: 6892, dns_rrname: map.dynectmedia6degrees.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6619379, event_type: dns, proto: UDP, dns_type: query, dns_id: 6892, dns_rrname: map.dynectmedia6degrees.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 6619381, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6892, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: map.dynectmedia6degrees.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: map.dynectmedia6degrees.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 687, dns_answers_0_rdata: 204.2.197.201, dns_grouped_A_0: 204.2.197.201 ; pcap_cnt: 6619382, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6892, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: map.dynectmedia6degrees.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: map.dynectmedia6degrees.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 687, dns_answers_0_rdata: 204.2.197.201, dns_grouped_A_0: 204.2.197.201 ; pcap_cnt: 9756192, event_type: dns, proto: UDP, dns_type: query, dns_id: 62950, dns_rrname: ad.zanox.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9756193, event_type: dns, proto: UDP, dns_type: query, dns_id: 62950, dns_rrname: ad.zanox.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 9756198, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62950, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad.zanox.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ad.zanox.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 3249, dns_answers_0_rdata: 195.216.249.67, dns_grouped_A_0: 195.216.249.67 ; pcap_cnt: 9756199, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62950, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad.zanox.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ad.zanox.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 3249, dns_answers_0_rdata: 195.216.249.67, dns_grouped_A_0: 195.216.249.67
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.