['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61551, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 158, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 99, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 106, flow_bytes_toclient: 207, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 199, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 151, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 156, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 106, flow_bytes_toclient: 199, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 123, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 116, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 228, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 189, flow_bytes_toclient: 447, flow_age: 137, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 185, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 133, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 189, flow_bytes_toclient: 305, flow_age: 173, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 160, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 190, flow_bytes_toclient: 377, flow_age: 200, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 154, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 111, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 151, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 142, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 79306, event_type: dns, proto: UDP, dns_type: query, dns_id: 28303, dns_rrname: 4.184.167.35.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 79313, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28303, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 4.184.167.35.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 4.184.167.35.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 34, dns_answers_0_rdata: ec2-35-167-184-4.us-west-2.compute.amazonaws.com, dns_grouped_PTR_0: ec2-35-167-184-4.us-west-2.compute.amazonaws.com ; pcap_cnt: 259543, event_type: dns, proto: UDP, dns_type: query, dns_id: 47698, dns_rrname: m.ib-ibi.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 259567, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47698, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: m.ib-ibi.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: m.ib-ibi.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 10, dns_answers_0_rdata: 69.169.86.39, dns_grouped_A_0: 69.169.86.39 ; pcap_cnt: 5724233, event_type: dns, proto: UDP, dns_type: query, dns_id: 2111, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5724403, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2111, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 11, dns_answers_1_rdata: e8218.dscb1.akamaiedge.net.0.1.cn.akamaiedge.net, dns_answers_2_rrname: e8218.dscb1.akamaiedge.net.0.1.cn.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.50.75.27, dns_grouped_A_0: 23.50.75.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_CNAME_1: e8218.dscb1.akamaiedge.net.0.1.cn.akamaiedge.net ; pcap_cnt: 6484237, event_type: dns, proto: UDP, dns_type: query, dns_id: 62002, dns_rrname: dart.l.doubleclick.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6484238, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62002, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dart.l.doubleclick.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: l.doubleclick.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 588, dns_authorities_0_soa_mname: ns4.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 160865928, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7436094, event_type: dns, proto: UDP, dns_type: query, dns_id: 12928, dns_rrname: analytics.kaltura.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7436111, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12928, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: analytics.kaltura.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: analytics.kaltura.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 240, dns_answers_0_rdata: eventtracking-access-prod-1856395362.us-west-2.elb.amazonaws.com, dns_answers_1_rrname: eventtracking-access-prod-1856395362.us-west-2.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 50.112.140.202, dns_answers_2_rrname: eventtracking-access-prod-1856395362.us-west-2.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 54.186.123.219, dns_grouped_CNAME_0: eventtracking-access-prod-1856395362.us-west-2.elb.amazonaws.com, dns_grouped_A_0: 50.112.140.202, dns_grouped_A_1: 54.186.123.219 ; pcap_cnt: 7703815, event_type: dns, proto: UDP, dns_type: query, dns_id: 33958, dns_rrname: www.ashleymadison.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7703844, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33958, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.ashleymadison.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: ashleymadison.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1799, dns_authorities_0_soa_mname: joan.ns.cloudflare.com, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2024963347, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 7731801, event_type: dns, proto: UDP, dns_type: query, dns_id: 22032, dns_rrname: 250.255.255.239.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7731817, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22032, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 250.255.255.239.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 239.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 731, dns_authorities_0_soa_mname: sns.dns.icann.org, dns_authorities_0_soa_rname: noc.dns.icann.org, dns_authorities_0_soa_serial: 2017042722, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 7878896, event_type: dns, proto: UDP, dns_type: query, dns_id: 52992, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7879288, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52992, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 18, dns_answers_1_rdata: 2001:0418:143c:0180:0000:0000:0000:201a, dns_answers_2_rrname: e8218.dscb1.akamaiedge.net, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 18, dns_answers_2_rdata: 2001:0418:143c:018b:0000:0000:0000:201a, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_AAAA_0: 2001:0418:143c:0180:0000:0000:0000:201a, dns_grouped_AAAA_1: 2001:0418:143c:018b:0000:0000:0000:201a ; pcap_cnt: 8033856, event_type: dns, proto: UDP, dns_type: query, dns_id: 5159, dns_rrname: dmg.digitaltarget.ru, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8033874, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5159, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dmg.digitaltarget.ru, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dmg.digitaltarget.ru, dns_answers_0_rrtype: A, dns_answers_0_ttl: 2706, dns_answers_0_rdata: 185.15.175.131, dns_answers_1_rrname: dmg.digitaltarget.ru, dns_answers_1_rrtype: A, dns_answers_1_ttl: 2706, dns_answers_1_rdata: 185.15.175.133, dns_grouped_A_0: 185.15.175.131, dns_grouped_A_1: 185.15.175.133 ; pcap_cnt: 8624475, event_type: dns, proto: UDP, dns_type: query, dns_id: 39400, dns_rrname: d1ibts9hn2apvm.cloudfront.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8624523, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 39400, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d1ibts9hn2apvm.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d1ibts9hn2apvm.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 41, dns_answers_0_rdata: 54.230.38.136, dns_grouped_A_0: 54.230.38.136 ; pcap_cnt: 8683681, event_type: dns, proto: UDP, dns_type: query, dns_id: 45037, dns_rrname: d1xfq2052q7thw.cloudfront.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8683721, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45037, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d1xfq2052q7thw.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d1xfq2052q7thw.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.192.36.5, dns_answers_1_rrname: d1xfq2052q7thw.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 54.192.36.163, dns_answers_2_rrname: d1xfq2052q7thw.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 54.192.36.152, dns_answers_3_rrname: d1xfq2052q7thw.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 54.192.36.242, dns_answers_4_rrname: d1xfq2052q7thw.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 54.192.36.39, dns_answers_5_rrname: d1xfq2052q7thw.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.192.36.21, dns_answers_6_rrname: d1xfq2052q7thw.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 54.192.36.183, dns_answers_7_rrname: d1xfq2052q7thw.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 54.192.36.239, dns_grouped_A_0: 54.192.36.5, dns_grouped_A_1: 54.192.36.163, dns_grouped_A_2: 54.192.36.152, dns_grouped_A_3: 54.192.36.242, dns_grouped_A_4: 54.192.36.39, dns_grouped_A_5: 54.192.36.21, dns_grouped_A_6: 54.192.36.183, dns_grouped_A_7: 54.192.36.239 ; pcap_cnt: 9422872, event_type: dns, proto: UDP, dns_type: query, dns_id: 61474, dns_rrname: ads.stickyadstv.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9423019, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61474, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ads.stickyadstv.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ads.stickyadstv.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 29, dns_answers_0_rdata: ip1.ads.stickyadstv.com.akadns.net, dns_answers_1_rrname: ip1.ads.stickyadstv.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 299, dns_answers_1_rdata: fp4.ads.stickyadstv.com.akadns.net, dns_answers_2_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 85, dns_answers_2_rdata: 158.69.116.27, dns_answers_3_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 85, dns_answers_3_rdata: 142.4.219.32, dns_answers_4_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 85, dns_answers_4_rdata: 149.56.241.109, dns_answers_5_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 85, dns_answers_5_rdata: 149.56.241.111, dns_answers_6_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 85, dns_answers_6_rdata: 158.69.53.101, dns_answers_7_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 85, dns_answers_7_rdata: 158.69.27.80, dns_answers_8_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 85, dns_answers_8_rdata: 149.56.27.148, dns_answers_9_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 85, dns_answers_9_rdata: 158.69.125.199, dns_grouped_A_0: 158.69.116.27, dns_grouped_A_1: 142.4.219.32, dns_grouped_A_2: 149.56.241.109, dns_grouped_A_3: 149.56.241.111, dns_grouped_A_4: 158.69.53.101, dns_grouped_A_5: 158.69.27.80, dns_grouped_A_6: 149.56.27.148, dns_grouped_A_7: 158.69.125.199, dns_grouped_CNAME_0: ip1.ads.stickyadstv.com.akadns.net, dns_grouped_CNAME_1: fp4.ads.stickyadstv.com.akadns.net ; pcap_cnt: 9455429, event_type: dns, proto: UDP, dns_type: query, dns_id: 2639, dns_rrname: prod.appnexus.map.fastly.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 9455455, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2639, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: prod.appnexus.map.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: prod.appnexus.map.fastly.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 13, dns_answers_0_rdata: 151.101.129.108, dns_answers_1_rrname: prod.appnexus.map.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 13, dns_answers_1_rdata: 151.101.1.108, dns_answers_2_rrname: prod.appnexus.map.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 13, dns_answers_2_rdata: 151.101.193.108, dns_answers_3_rrname: prod.appnexus.map.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 13, dns_answers_3_rdata: 151.101.65.108, dns_grouped_A_0: 151.101.129.108, dns_grouped_A_1: 151.101.1.108, dns_grouped_A_2: 151.101.193.108, dns_grouped_A_3: 151.101.65.108 ; pcap_cnt: 9780902, event_type: dns, proto: UDP, dns_type: query, dns_id: 55773, dns_rrname: d1ibts9hn2apvm.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9780948, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55773, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d1ibts9hn2apvm.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d1ibts9hn2apvm.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 307, dns_authorities_0_soa_mname: ns-1124.awsdns-12.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 10072556, event_type: dns, proto: UDP, dns_type: query, dns_id: 40713, dns_rrname: adx.g.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10072629, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40713, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adx.g.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: adx.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: pagead46.l.doubleclick.net, dns_answers_1_rrname: pagead46.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 204, dns_answers_1_rdata: 172.217.12.194, dns_grouped_CNAME_0: pagead46.l.doubleclick.net, dns_grouped_A_0: 172.217.12.194 ; pcap_cnt: 10417474, event_type: dns, proto: UDP, dns_type: query, dns_id: 7039, dns_rrname: ca.answers.yahoo.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10417507, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7039, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ca.answers.yahoo.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ca.answers.yahoo.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 274, dns_answers_0_rdata: fd-geoycpi-uno-deluxe.gycpi.b.yahoodns.net, dns_answers_1_rrname: fd-geoycpi-uno-deluxe.gycpi.b.yahoodns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 146, dns_answers_1_rdata: 98.139.199.204, dns_answers_2_rrname: fd-geoycpi-uno-deluxe.gycpi.b.yahoodns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 146, dns_answers_2_rdata: 98.139.199.205, dns_grouped_CNAME_0: fd-geoycpi-uno-deluxe.gycpi.b.yahoodns.net, dns_grouped_A_0: 98.139.199.204, dns_grouped_A_1: 98.139.199.205 ; pcap_cnt: 10441605, event_type: dns, proto: UDP, dns_type: query, dns_id: 17847, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 10441609, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17847, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2a03:2880:f103:0083:face:b00c:0000:25de, dns_grouped_AAAA_0: 2a03:2880:f103:0083:face:b00c:0000:25de ; pcap_cnt: 10678595, event_type: dns, proto: UDP, dns_type: query, dns_id: 58810, dns_rrname: 234.63.210.34.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 10678604, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58810, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 234.63.210.34.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 234.63.210.34.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 298, dns_answers_0_rdata: ec2-34-210-63-234.us-west-2.compute.amazonaws.com, dns_grouped_PTR_0: ec2-34-210-63-234.us-west-2.compute.amazonaws.com ; pcap_cnt: 10814333, event_type: dns, proto: UDP, dns_type: query, dns_id: 21941, dns_rrname: cbmedia3.contobox.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10814431, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21941, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cbmedia3.contobox.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cbmedia3.contobox.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 343, dns_answers_0_rdata: d2kl5thcs0h6rr.cloudfront.net, dns_answers_1_rrname: d2kl5thcs0h6rr.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.145.27, dns_answers_2_rrname: d2kl5thcs0h6rr.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.145.229, dns_answers_3_rrname: d2kl5thcs0h6rr.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.145.19, dns_answers_4_rrname: d2kl5thcs0h6rr.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.145.221, dns_answers_5_rrname: d2kl5thcs0h6rr.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.145.117, dns_answers_6_rrname: d2kl5thcs0h6rr.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.145.247, dns_answers_7_rrname: d2kl5thcs0h6rr.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.145.158, dns_answers_8_rrname: d2kl5thcs0h6rr.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 59, dns_answers_8_rdata: 52.84.145.252, dns_grouped_CNAME_0: d2kl5thcs0h6rr.cloudfront.net, dns_grouped_A_0: 52.84.145.27, dns_grouped_A_1: 52.84.145.229, dns_grouped_A_2: 52.84.145.19, dns_grouped_A_3: 52.84.145.221, dns_grouped_A_4: 52.84.145.117, dns_grouped_A_5: 52.84.145.247, dns_grouped_A_6: 52.84.145.158, dns_grouped_A_7: 52.84.145.252 ; pcap_cnt: 10836900, event_type: dns, proto: UDP, dns_type: query, dns_id: 30932, dns_rrname: urs.microsoft.com.nsatc.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 10836904, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30932, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: urs.microsoft.com.nsatc.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: urs.microsoft.com.nsatc.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 13.84.218.189, dns_grouped_A_0: 13.84.218.189 ; pcap_cnt: 10918301, event_type: dns, proto: UDP, dns_type: query, dns_id: 1011, dns_rrname: 223.208.73.184.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 10918355, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1011, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 223.208.73.184.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 223.208.73.184.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 263, dns_answers_0_rdata: ec2-184-73-208-223.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-184-73-208-223.compute-1.amazonaws.com ; pcap_cnt: 11116075, event_type: dns, proto: UDP, dns_type: query, dns_id: 46581, dns_rrname: video-stats.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11116080, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46581, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: video-stats.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: video-stats.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.3.110, dns_grouped_A_0: 172.217.3.110 ; pcap_cnt: 11404046, event_type: dns, proto: UDP, dns_type: query, dns_id: 46349, dns_rrname: livechat.navyfederal.org, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11404057, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46349, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: livechat.navyfederal.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: livechat.navyfederal.org, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 29, dns_answers_0_rdata: navyfederal.liveperson.net, dns_answers_1_rrname: navyfederal.liveperson.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 57, dns_answers_1_rdata: 162.252.74.14, dns_grouped_CNAME_0: navyfederal.liveperson.net, dns_grouped_A_0: 162.252.74.14 ; pcap_cnt: 11472245, event_type: dns, proto: UDP, dns_type: query, dns_id: 40043, dns_rrname: 116.178.231.173.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 11472272, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40043, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 116.178.231.173.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 116.178.231.173.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 967, dns_answers_0_rdata: lga-delivery-8.sys.adgear.com, dns_grouped_PTR_0: lga-delivery-8.sys.adgear.com
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.