['flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.14, src_port: 58941, dest_ip: 192.168.10.3, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 156, flow_bytes_toclient: 318, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 164, flow_bytes_toclient: 228, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 2, flow_bytes_toserver: 316, flow_bytes_toclient: 222, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 152, flow_bytes_toclient: 506, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 160, flow_bytes_toclient: 192, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 5466573, event_type: dns, proto: UDP, dns_type: query, dns_id: 45168, dns_rrname: s.thebrighttag.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5466574, event_type: dns, proto: UDP, dns_type: query, dns_id: 45168, dns_rrname: s.thebrighttag.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 5466621, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45168, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s.thebrighttag.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s.thebrighttag.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 498, dns_answers_0_rdata: td.thebrighttag.com, dns_answers_1_rrname: td.thebrighttag.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 115, dns_answers_1_rdata: 50.18.61.141, dns_answers_2_rrname: td.thebrighttag.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 115, dns_answers_2_rdata: 50.18.61.120, dns_answers_3_rrname: td.thebrighttag.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 115, dns_answers_3_rdata: 54.241.30.40, dns_answers_4_rrname: td.thebrighttag.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 115, dns_answers_4_rdata: 54.241.244.69, dns_grouped_A_0: 50.18.61.141, dns_grouped_A_1: 50.18.61.120, dns_grouped_A_2: 54.241.30.40, dns_grouped_A_3: 54.241.244.69, dns_grouped_CNAME_0: td.thebrighttag.com ; pcap_cnt: 5466622, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45168, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s.thebrighttag.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s.thebrighttag.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 498, dns_answers_0_rdata: td.thebrighttag.com, dns_answers_1_rrname: td.thebrighttag.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 115, dns_answers_1_rdata: 50.18.61.141, dns_answers_2_rrname: td.thebrighttag.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 115, dns_answers_2_rdata: 50.18.61.120, dns_answers_3_rrname: td.thebrighttag.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 115, dns_answers_3_rdata: 54.241.30.40, dns_answers_4_rrname: td.thebrighttag.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 115, dns_answers_4_rdata: 54.241.244.69, dns_grouped_CNAME_0: td.thebrighttag.com, dns_grouped_A_0: 50.18.61.141, dns_grouped_A_1: 50.18.61.120, dns_grouped_A_2: 54.241.30.40, dns_grouped_A_3: 54.241.244.69 ; pcap_cnt: 6146069, event_type: dns, proto: UDP, dns_type: query, dns_id: 14349, dns_rrname: cds.c2z5i5f6.hwcdn.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6146070, event_type: dns, proto: UDP, dns_type: query, dns_id: 14349, dns_rrname: cds.c2z5i5f6.hwcdn.net, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 6146071, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14349, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cds.c2z5i5f6.hwcdn.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cds.c2z5i5f6.hwcdn.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 153, dns_answers_0_rdata: 69.16.175.42, dns_answers_1_rrname: cds.c2z5i5f6.hwcdn.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 153, dns_answers_1_rdata: 69.16.175.10, dns_grouped_A_0: 69.16.175.42, dns_grouped_A_1: 69.16.175.10 ; pcap_cnt: 6146072, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14349, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cds.c2z5i5f6.hwcdn.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cds.c2z5i5f6.hwcdn.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 153, dns_answers_0_rdata: 69.16.175.42, dns_answers_1_rrname: cds.c2z5i5f6.hwcdn.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 153, dns_answers_1_rdata: 69.16.175.10, dns_grouped_A_0: 69.16.175.42, dns_grouped_A_1: 69.16.175.10 ; pcap_cnt: 6370756, event_type: dns, proto: UDP, dns_type: query, dns_id: 23258, dns_rrname: ssl-finn.tns-cs.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6370757, event_type: dns, proto: UDP, dns_type: query, dns_id: 23258, dns_rrname: ssl-finn.tns-cs.net, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 6370814, event_type: dns, proto: UDP, dns_type: query, dns_id: 23258, dns_rrname: ssl-finn.tns-cs.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6370815, event_type: dns, proto: UDP, dns_type: query, dns_id: 23258, dns_rrname: ssl-finn.tns-cs.net, dns_rrtype: A, dns_tx_id: 3 ; pcap_cnt: 6371180, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23258, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssl-finn.tns-cs.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ssl-finn.tns-cs.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 76, dns_answers_0_rdata: 77.88.106.124, dns_answers_1_rrname: ssl-finn.tns-cs.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 76, dns_answers_1_rdata: 77.88.106.123, dns_grouped_A_0: 77.88.106.124, dns_grouped_A_1: 77.88.106.123 ; pcap_cnt: 6371181, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23258, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssl-finn.tns-cs.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ssl-finn.tns-cs.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 76, dns_answers_0_rdata: 77.88.106.124, dns_answers_1_rrname: ssl-finn.tns-cs.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 76, dns_answers_1_rdata: 77.88.106.123, dns_grouped_A_0: 77.88.106.124, dns_grouped_A_1: 77.88.106.123 ; pcap_cnt: 6725467, event_type: dns, proto: UDP, dns_type: query, dns_id: 58897, dns_rrname: secure.adnxs.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6725468, event_type: dns, proto: UDP, dns_type: query, dns_id: 58897, dns_rrname: secure.adnxs.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 6725469, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58897, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: secure.adnxs.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: secure.adnxs.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 25144, dns_answers_0_rdata: g.geogslb.com, dns_answers_1_rrname: g.geogslb.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 9533, dns_answers_1_rdata: ib.anycast.adnxs.com, dns_answers_2_rrname: ib.anycast.adnxs.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 102, dns_answers_2_rdata: 68.67.178.196, dns_answers_3_rrname: ib.anycast.adnxs.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 102, dns_answers_3_rdata: 68.67.178.138, dns_answers_4_rrname: ib.anycast.adnxs.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 102, dns_answers_4_rdata: 68.67.178.173, dns_answers_5_rrname: ib.anycast.adnxs.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 102, dns_answers_5_rdata: 68.67.178.176, dns_answers_6_rrname: ib.anycast.adnxs.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 102, dns_answers_6_rdata: 68.67.178.243, dns_answers_7_rrname: ib.anycast.adnxs.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 102, dns_answers_7_rdata: 68.67.178.199, dns_answers_8_rrname: ib.anycast.adnxs.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 102, dns_answers_8_rdata: 68.67.178.246, dns_answers_9_rrname: ib.anycast.adnxs.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 102, dns_answers_9_rdata: 68.67.180.45, dns_grouped_CNAME_0: g.geogslb.com, dns_grouped_CNAME_1: ib.anycast.adnxs.com, dns_grouped_A_0: 68.67.178.196, dns_grouped_A_1: 68.67.178.138, dns_grouped_A_2: 68.67.178.173, dns_grouped_A_3: 68.67.178.176, dns_grouped_A_4: 68.67.178.243, dns_grouped_A_5: 68.67.178.199, dns_grouped_A_6: 68.67.178.246, dns_grouped_A_7: 68.67.180.45 ; pcap_cnt: 6725470, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58897, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: secure.adnxs.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: secure.adnxs.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 25144, dns_answers_0_rdata: g.geogslb.com, dns_answers_1_rrname: g.geogslb.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 9533, dns_answers_1_rdata: ib.anycast.adnxs.com, dns_answers_2_rrname: ib.anycast.adnxs.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 102, dns_answers_2_rdata: 68.67.178.196, dns_answers_3_rrname: ib.anycast.adnxs.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 102, dns_answers_3_rdata: 68.67.178.138, dns_answers_4_rrname: ib.anycast.adnxs.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 102, dns_answers_4_rdata: 68.67.178.173, dns_answers_5_rrname: ib.anycast.adnxs.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 102, dns_answers_5_rdata: 68.67.178.176, dns_answers_6_rrname: ib.anycast.adnxs.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 102, dns_answers_6_rdata: 68.67.178.243, dns_answers_7_rrname: ib.anycast.adnxs.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 102, dns_answers_7_rdata: 68.67.178.199, dns_answers_8_rrname: ib.anycast.adnxs.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 102, dns_answers_8_rdata: 68.67.178.246, dns_answers_9_rrname: ib.anycast.adnxs.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 102, dns_answers_9_rdata: 68.67.180.45, dns_grouped_CNAME_0: g.geogslb.com, dns_grouped_CNAME_1: ib.anycast.adnxs.com, dns_grouped_A_0: 68.67.178.196, dns_grouped_A_1: 68.67.178.138, dns_grouped_A_2: 68.67.178.173, dns_grouped_A_3: 68.67.178.176, dns_grouped_A_4: 68.67.178.243, dns_grouped_A_5: 68.67.178.199, dns_grouped_A_6: 68.67.178.246, dns_grouped_A_7: 68.67.180.45 ; pcap_cnt: 7385529, event_type: dns, proto: UDP, dns_type: query, dns_id: 41339, dns_rrname: advertiser.wbtrk.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7385530, event_type: dns, proto: UDP, dns_type: query, dns_id: 41339, dns_rrname: advertiser.wbtrk.net, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 7385533, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41339, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: advertiser.wbtrk.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: advertiser.wbtrk.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 598, dns_answers_0_rdata: 185.54.150.115, dns_grouped_A_0: 185.54.150.115 ; pcap_cnt: 7385534, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41339, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: advertiser.wbtrk.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: advertiser.wbtrk.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 598, dns_answers_0_rdata: 185.54.150.115, dns_grouped_A_0: 185.54.150.115
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.