['flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.5, src_port: 57507, dest_ip: 192.168.10.3, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 304, flow_bytes_toclient: 1132, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 150, flow_bytes_toclient: 264, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 220, flow_bytes_toclient: 316, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 2, flow_bytes_toserver: 300, flow_bytes_toclient: 258, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 5716385, event_type: dns, proto: UDP, dns_type: query, dns_id: 48778, dns_rrname: match.adsrvr.org, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5716386, event_type: dns, proto: UDP, dns_type: query, dns_id: 48778, dns_rrname: match.adsrvr.org, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 5716419, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48778, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: match.adsrvr.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: match.adsrvr.org, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 849, dns_answers_0_rdata: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_1_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 184.169.134.250, dns_answers_2_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 204.236.135.247, dns_answers_3_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 50.18.251.157, dns_answers_4_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 50.18.253.40, dns_answers_5_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 50.18.187.184, dns_answers_6_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 50.18.189.103, dns_answers_7_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 50.18.253.140, dns_answers_8_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 50.18.172.166, dns_grouped_CNAME_0: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_grouped_A_0: 184.169.134.250, dns_grouped_A_1: 204.236.135.247, dns_grouped_A_2: 50.18.251.157, dns_grouped_A_3: 50.18.253.40, dns_grouped_A_4: 50.18.187.184, dns_grouped_A_5: 50.18.189.103, dns_grouped_A_6: 50.18.253.140, dns_grouped_A_7: 50.18.172.166 ; pcap_cnt: 5716420, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48778, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: match.adsrvr.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: match.adsrvr.org, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 849, dns_answers_0_rdata: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_1_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 184.169.134.250, dns_answers_2_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 204.236.135.247, dns_answers_3_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 50.18.251.157, dns_answers_4_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 50.18.253.40, dns_answers_5_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 50.18.187.184, dns_answers_6_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 50.18.189.103, dns_answers_7_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 50.18.253.140, dns_answers_8_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 50.18.172.166, dns_grouped_CNAME_0: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_grouped_A_0: 184.169.134.250, dns_grouped_A_1: 204.236.135.247, dns_grouped_A_2: 50.18.251.157, dns_grouped_A_3: 50.18.253.40, dns_grouped_A_4: 50.18.187.184, dns_grouped_A_5: 50.18.189.103, dns_grouped_A_6: 50.18.253.140, dns_grouped_A_7: 50.18.172.166 ; pcap_cnt: 5716478, event_type: dns, proto: UDP, dns_type: query, dns_id: 48778, dns_rrname: match.adsrvr.org, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 5716480, event_type: dns, proto: UDP, dns_type: query, dns_id: 48778, dns_rrname: match.adsrvr.org, dns_rrtype: A, dns_tx_id: 5 ; pcap_cnt: 5716481, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48778, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: match.adsrvr.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: match.adsrvr.org, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 849, dns_answers_0_rdata: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_1_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 204.236.135.247, dns_answers_2_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 50.18.251.157, dns_answers_3_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 50.18.253.40, dns_answers_4_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 50.18.187.184, dns_answers_5_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 50.18.189.103, dns_answers_6_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 50.18.253.140, dns_answers_7_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 50.18.172.166, dns_answers_8_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 184.169.134.250, dns_grouped_CNAME_0: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_grouped_A_0: 204.236.135.247, dns_grouped_A_1: 50.18.251.157, dns_grouped_A_2: 50.18.253.40, dns_grouped_A_3: 50.18.187.184, dns_grouped_A_4: 50.18.189.103, dns_grouped_A_5: 50.18.253.140, dns_grouped_A_6: 50.18.172.166, dns_grouped_A_7: 184.169.134.250 ; pcap_cnt: 5716482, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48778, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: match.adsrvr.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: match.adsrvr.org, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 849, dns_answers_0_rdata: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_1_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 204.236.135.247, dns_answers_2_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 50.18.251.157, dns_answers_3_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 50.18.253.40, dns_answers_4_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 50.18.187.184, dns_answers_5_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 50.18.189.103, dns_answers_6_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 50.18.253.140, dns_answers_7_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 50.18.172.166, dns_answers_8_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 184.169.134.250, dns_grouped_CNAME_0: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_grouped_A_0: 204.236.135.247, dns_grouped_A_1: 50.18.251.157, dns_grouped_A_2: 50.18.253.40, dns_grouped_A_3: 50.18.187.184, dns_grouped_A_4: 50.18.189.103, dns_grouped_A_5: 50.18.253.140, dns_grouped_A_6: 50.18.172.166, dns_grouped_A_7: 184.169.134.250 ; pcap_cnt: 7516809, event_type: dns, proto: UDP, dns_type: query, dns_id: 57523, dns_rrname: trc.taboola.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7516810, event_type: dns, proto: UDP, dns_type: query, dns_id: 57523, dns_rrname: trc.taboola.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 7516811, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57523, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: trc.taboola.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: trc.taboola.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 395, dns_answers_0_rdata: f2.shared.global.fastly.net, dns_answers_1_rrname: f2.shared.global.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 151.101.22.2, dns_grouped_CNAME_0: f2.shared.global.fastly.net, dns_grouped_A_0: 151.101.22.2 ; pcap_cnt: 7516812, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57523, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: trc.taboola.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: trc.taboola.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 395, dns_answers_0_rdata: f2.shared.global.fastly.net, dns_answers_1_rrname: f2.shared.global.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 151.101.22.2, dns_grouped_CNAME_0: f2.shared.global.fastly.net, dns_grouped_A_0: 151.101.22.2 ; pcap_cnt: 7663423, event_type: dns, proto: UDP, dns_type: query, dns_id: 56761, dns_rrname: wec-nfl-2013-746755682.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7663424, event_type: dns, proto: UDP, dns_type: query, dns_id: 56761, dns_rrname: wec-nfl-2013-746755682.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 7663425, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56761, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: wec-nfl-2013-746755682.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: wec-nfl-2013-746755682.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 23.23.214.121, dns_answers_1_rrname: wec-nfl-2013-746755682.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 107.21.118.2, dns_answers_2_rrname: wec-nfl-2013-746755682.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 23.21.212.138, dns_grouped_A_0: 23.23.214.121, dns_grouped_A_1: 107.21.118.2, dns_grouped_A_2: 23.21.212.138 ; pcap_cnt: 7663426, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56761, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: wec-nfl-2013-746755682.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: wec-nfl-2013-746755682.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 23.23.214.121, dns_answers_1_rrname: wec-nfl-2013-746755682.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 107.21.118.2, dns_answers_2_rrname: wec-nfl-2013-746755682.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 23.21.212.138, dns_grouped_A_0: 23.23.214.121, dns_grouped_A_1: 107.21.118.2, dns_grouped_A_2: 23.21.212.138 ; pcap_cnt: 8695414, event_type: dns, proto: UDP, dns_type: query, dns_id: 11873, dns_rrname: cdn.exactag.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8695415, event_type: dns, proto: UDP, dns_type: query, dns_id: 11873, dns_rrname: cdn.exactag.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 8695498, event_type: dns, proto: UDP, dns_type: query, dns_id: 11873, dns_rrname: cdn.exactag.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 8695499, event_type: dns, proto: UDP, dns_type: query, dns_id: 11873, dns_rrname: cdn.exactag.com, dns_rrtype: A, dns_tx_id: 3 ; pcap_cnt: 8695506, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11873, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.exactag.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.exactag.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2976, dns_answers_0_rdata: 1864845291.rsc.cdn77.org, dns_answers_1_rrname: 1864845291.rsc.cdn77.org, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 185.59.223.13, dns_grouped_CNAME_0: 1864845291.rsc.cdn77.org, dns_grouped_A_0: 185.59.223.13 ; pcap_cnt: 8695507, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11873, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.exactag.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.exactag.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2976, dns_answers_0_rdata: 1864845291.rsc.cdn77.org, dns_answers_1_rrname: 1864845291.rsc.cdn77.org, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 185.59.223.13, dns_grouped_A_0: 185.59.223.13, dns_grouped_CNAME_0: 1864845291.rsc.cdn77.org
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.