['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61422, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 214, flow_bytes_toclient: 409, flow_age: 27, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 144, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 107, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 180, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 111, flow_bytes_toclient: 127, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 126, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 106, flow_bytes_toclient: 199, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 191, flow_bytes_toclient: 353, flow_age: 120, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 162, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 380, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 81, flow_bytes_toclient: 113, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 170, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 105, flow_bytes_toclient: 185, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 102, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 190, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 262, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 143, flow_bytes_toclient: 207, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 142, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 164, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 120, flow_bytes_toclient: 201, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 143, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 131, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 149, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 217, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 109, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 27528, event_type: dns, proto: UDP, dns_type: query, dns_id: 54218, dns_rrname: detectportal.firefox.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 27530, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 54218, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: detectportal.firefox.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: detectportal.firefox.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 5, dns_answers_0_rdata: detectportal.firefox.com.edgesuite.net, dns_answers_1_rrname: detectportal.firefox.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 19825, dns_answers_1_rdata: a1089.d.akamai.net, dns_answers_2_rrname: a1089.d.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.210.202.27, dns_answers_3_rrname: a1089.d.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 23.210.202.42, dns_grouped_A_0: 23.210.202.27, dns_grouped_A_1: 23.210.202.42, dns_grouped_CNAME_0: detectportal.firefox.com.edgesuite.net, dns_grouped_CNAME_1: a1089.d.akamai.net ; pcap_cnt: 44001, event_type: dns, proto: UDP, dns_type: query, dns_id: 40135, dns_rrname: elb-tse-01-133143027.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 44025, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40135, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: elb-tse-01-133143027.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 8, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5818587, event_type: dns, proto: UDP, dns_type: query, dns_id: 6145, dns_rrname: adserving.kiosked.iponweb.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5818626, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6145, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adserving.kiosked.iponweb.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: iponweb.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 178, dns_authorities_0_soa_mname: ns5.iponweb.net, dns_authorities_0_soa_rname: noc.iponweb.net, dns_authorities_0_soa_serial: 2017070401, dns_authorities_0_soa_refresh: 300, dns_authorities_0_soa_retry: 1800, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 6468915, event_type: dns, proto: UDP, dns_type: query, dns_id: 27290, dns_rrname: www.lloydsbank.co.uk, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6468918, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 27290, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.lloydsbank.co.uk, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.lloydsbank.co.uk, dns_answers_0_rrtype: A, dns_answers_0_ttl: 91, dns_answers_0_rdata: 141.92.104.30, dns_grouped_A_0: 141.92.104.30 ; pcap_cnt: 6782151, event_type: dns, proto: UDP, dns_type: query, dns_id: 34162, dns_rrname: 95.142.71.64.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 6782212, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34162, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 95.142.71.64.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 142.71.64.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 82403, dns_authorities_0_soa_mname: ns1.he.net, dns_authorities_0_soa_rname: hostmaster.he.net, dns_authorities_0_soa_serial: 2017070400, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 1800, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6871762, event_type: dns, proto: UDP, dns_type: query, dns_id: 53678, dns_rrname: sb.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6871797, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53678, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sb.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: sb.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:0812:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0812:0000:0000:0000:200e ; pcap_cnt: 6993686, event_type: dns, proto: UDP, dns_type: query, dns_id: 38859, dns_rrname: www.thesun.co.uk, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6994014, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38859, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.thesun.co.uk, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.thesun.co.uk, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 124, dns_answers_0_rdata: www.thesun.co.uk.edgekey.net, dns_answers_1_rrname: www.thesun.co.uk.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 19579, dns_answers_1_rdata: e3951.e12.akamaiedge.net, dns_answers_2_rrname: e3951.e12.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 104.97.94.187, dns_grouped_CNAME_0: www.thesun.co.uk.edgekey.net, dns_grouped_CNAME_1: e3951.e12.akamaiedge.net, dns_grouped_A_0: 104.97.94.187 ; pcap_cnt: 7277978, event_type: dns, proto: UDP, dns_type: query, dns_id: 9062, dns_rrname: fontawesome-cdn.fonticons.netdna-cdn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7278004, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9062, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fontawesome-cdn.fonticons.netdna-cdn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: fontawesome-cdn.fonticons.netdna-cdn.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 187, dns_answers_0_rdata: 198.232.124.196, dns_grouped_A_0: 198.232.124.196 ; pcap_cnt: 7474052, event_type: dns, proto: UDP, dns_type: query, dns_id: 34318, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7474059, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34318, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 51, dns_answers_0_rdata: 2a03:2880:f127:0083:face:b00c:0000:25de, dns_grouped_AAAA_0: 2a03:2880:f127:0083:face:b00c:0000:25de ; pcap_cnt: 7703450, event_type: dns, proto: UDP, dns_type: query, dns_id: 28546, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7703462, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28546, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 4, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 19, dns_answers_1_rdata: 2001:0418:143c:018b:0000:0000:0000:201a, dns_answers_2_rrname: e8218.dscb1.akamaiedge.net, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 19, dns_answers_2_rdata: 2001:0418:143c:0180:0000:0000:0000:201a, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_AAAA_0: 2001:0418:143c:018b:0000:0000:0000:201a, dns_grouped_AAAA_1: 2001:0418:143c:0180:0000:0000:0000:201a ; pcap_cnt: 7742899, event_type: dns, proto: UDP, dns_type: query, dns_id: 57697, dns_rrname: 105.196.212.88.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7742928, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57697, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 105.196.212.88.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 105.196.212.88.in-addr.arpa, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 46734, dns_answers_0_rdata: 105.64/26.196.212.88.in-addr.arpa, dns_answers_1_rrname: 105.64/26.196.212.88.in-addr.arpa, dns_answers_1_rrtype: PTR, dns_answers_1_ttl: 1305, dns_answers_1_rdata: host05.rax.ru, dns_grouped_CNAME_0: 105.64/26.196.212.88.in-addr.arpa, dns_grouped_PTR_0: host05.rax.ru ; pcap_cnt: 7758201, event_type: dns, proto: UDP, dns_type: query, dns_id: 49719, dns_rrname: genius.fantasy.nfl.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 7758293, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49719, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: genius.fantasy.nfl.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: genius.fantasy.nfl.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 211, dns_answers_0_rdata: genius.fantasy.nfl.com.edgesuite.net, dns_answers_1_rrname: genius.fantasy.nfl.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 167, dns_answers_1_rdata: a1683.b.akamai.net, dns_answers_2_rrname: a1683.b.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 23.15.4.17, dns_answers_3_rrname: a1683.b.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 19, dns_answers_3_rdata: 23.15.4.10, dns_grouped_A_0: 23.15.4.17, dns_grouped_A_1: 23.15.4.10, dns_grouped_CNAME_0: genius.fantasy.nfl.com.edgesuite.net, dns_grouped_CNAME_1: a1683.b.akamai.net ; pcap_cnt: 7820681, event_type: dns, proto: UDP, dns_type: query, dns_id: 2090, dns_rrname: 64.123.97.104.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7820746, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2090, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 64.123.97.104.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 64.123.97.104.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 39199, dns_answers_0_rdata: a104-97-123-64.deploy.static.akamaitechnologies.com, dns_grouped_PTR_0: a104-97-123-64.deploy.static.akamaitechnologies.com ; pcap_cnt: 8039965, event_type: dns, proto: UDP, dns_type: query, dns_id: 35460, dns_rrname: sync.adaptv.advertising.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8039992, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35460, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sync.adaptv.advertising.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sync.adaptv.advertising.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 264, dns_answers_0_rdata: sync.adap.tv.akadns.net, dns_answers_1_rrname: sync.adap.tv.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 287, dns_answers_1_rdata: log-wc-local.adap.tv.akadns.net, dns_answers_2_rrname: log-wc-local.adap.tv.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 0, dns_answers_2_rdata: log-wc-1.adap.tv, dns_answers_3_rrname: log-wc-1.adap.tv, dns_answers_3_rrtype: CNAME, dns_answers_3_ttl: 1588, dns_answers_3_rdata: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_answers_4_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 52, dns_answers_4_rdata: 52.52.71.203, dns_answers_5_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 52, dns_answers_5_rdata: 52.52.224.195, dns_answers_6_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 52, dns_answers_6_rdata: 52.52.223.248, dns_answers_7_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 52, dns_answers_7_rdata: 52.52.43.76, dns_answers_8_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 52, dns_answers_8_rdata: 52.52.86.145, dns_answers_9_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 52, dns_answers_9_rdata: 52.52.92.30, dns_answers_10_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 52, dns_answers_10_rdata: 52.8.165.87, dns_answers_11_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_answers_11_rrtype: A, dns_answers_11_ttl: 52, dns_answers_11_rdata: 52.9.18.231, dns_grouped_CNAME_0: sync.adap.tv.akadns.net, dns_grouped_CNAME_1: log-wc-local.adap.tv.akadns.net, dns_grouped_CNAME_2: log-wc-1.adap.tv, dns_grouped_CNAME_3: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_grouped_A_0: 52.52.71.203, dns_grouped_A_1: 52.52.224.195, dns_grouped_A_2: 52.52.223.248, dns_grouped_A_3: 52.52.43.76, dns_grouped_A_4: 52.52.86.145, dns_grouped_A_5: 52.52.92.30, dns_grouped_A_6: 52.8.165.87, dns_grouped_A_7: 52.9.18.231 ; pcap_cnt: 8260397, event_type: dns, proto: UDP, dns_type: query, dns_id: 58532, dns_rrname: www.bab.la, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8260398, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58532, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.bab.la, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.bab.la, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 104.28.23.30, dns_answers_1_rrname: www.bab.la, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 104.28.22.30, dns_grouped_A_0: 104.28.23.30, dns_grouped_A_1: 104.28.22.30 ; pcap_cnt: 8291769, event_type: dns, proto: UDP, dns_type: query, dns_id: 24295, dns_rrname: plenty.analisis.io, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8291775, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24295, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: plenty.analisis.io, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: analisis.io, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 107, dns_authorities_0_soa_mname: ns-200.awsdns-25.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 9219988, event_type: dns, proto: UDP, dns_type: query, dns_id: 17677, dns_rrname: stack.imgur.com.cdn.cloudflare.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9219995, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17677, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: stack.imgur.com.cdn.cloudflare.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: stack.imgur.com.cdn.cloudflare.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 16, dns_answers_0_rdata: 104.16.111.18, dns_answers_1_rrname: stack.imgur.com.cdn.cloudflare.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 16, dns_answers_1_rdata: 104.16.108.18, dns_answers_2_rrname: stack.imgur.com.cdn.cloudflare.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 16, dns_answers_2_rdata: 104.16.110.18, dns_answers_3_rrname: stack.imgur.com.cdn.cloudflare.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 16, dns_answers_3_rdata: 104.16.109.18, dns_answers_4_rrname: stack.imgur.com.cdn.cloudflare.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 16, dns_answers_4_rdata: 104.16.112.18, dns_grouped_A_0: 104.16.111.18, dns_grouped_A_1: 104.16.108.18, dns_grouped_A_2: 104.16.110.18, dns_grouped_A_3: 104.16.109.18, dns_grouped_A_4: 104.16.112.18 ; pcap_cnt: 9683659, event_type: dns, proto: UDP, dns_type: query, dns_id: 32672, dns_rrname: defr1.variti.ch, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9683768, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32672, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: defr1.variti.ch, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: defr1.variti.ch, dns_answers_0_rrtype: A, dns_answers_0_ttl: 162, dns_answers_0_rdata: 91.191.183.65, dns_grouped_A_0: 91.191.183.65 ; pcap_cnt: 9787374, event_type: dns, proto: UDP, dns_type: query, dns_id: 41703, dns_rrname: www.commentcamarche.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9787427, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41703, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.commentcamarche.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.commentcamarche.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 52, dns_answers_0_rdata: www.commentcamarche.net.edgekey.net, dns_answers_1_rrname: www.commentcamarche.net.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 5006, dns_answers_1_rdata: e12525.b.akamaiedge.net, dns_answers_2_rrname: e12525.b.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 173.223.153.156, dns_grouped_A_0: 173.223.153.156, dns_grouped_CNAME_0: www.commentcamarche.net.edgekey.net, dns_grouped_CNAME_1: e12525.b.akamaiedge.net ; pcap_cnt: 9875595, event_type: dns, proto: UDP, dns_type: query, dns_id: 1144, dns_rrname: dbg52463.moatads.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9875645, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1144, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dbg52463.moatads.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dbg52463.moatads.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 267, dns_answers_0_rdata: d3lnso1ag1sznl.cloudfront.net, dns_answers_1_rrname: d3lnso1ag1sznl.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 17, dns_answers_1_rdata: 54.192.37.207, dns_answers_2_rrname: d3lnso1ag1sznl.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 17, dns_answers_2_rdata: 54.192.37.70, dns_answers_3_rrname: d3lnso1ag1sznl.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 17, dns_answers_3_rdata: 54.192.37.119, dns_answers_4_rrname: d3lnso1ag1sznl.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 17, dns_answers_4_rdata: 54.192.37.121, dns_answers_5_rrname: d3lnso1ag1sznl.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 17, dns_answers_5_rdata: 54.192.37.87, dns_answers_6_rrname: d3lnso1ag1sznl.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 17, dns_answers_6_rdata: 54.192.37.231, dns_answers_7_rrname: d3lnso1ag1sznl.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 17, dns_answers_7_rdata: 54.192.37.7, dns_answers_8_rrname: d3lnso1ag1sznl.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 17, dns_answers_8_rdata: 54.192.37.94, dns_grouped_CNAME_0: d3lnso1ag1sznl.cloudfront.net, dns_grouped_A_0: 54.192.37.207, dns_grouped_A_1: 54.192.37.70, dns_grouped_A_2: 54.192.37.119, dns_grouped_A_3: 54.192.37.121, dns_grouped_A_4: 54.192.37.87, dns_grouped_A_5: 54.192.37.231, dns_grouped_A_6: 54.192.37.7, dns_grouped_A_7: 54.192.37.94 ; pcap_cnt: 10084694, event_type: dns, proto: UDP, dns_type: query, dns_id: 12755, dns_rrname: 0.e.0.0.0.0.1.0.d.8.3.b.0.7.c.a.0.0.0.0.2.0.3.6.c.6.f.c.2.c.d.a.ip6.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 10084696, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12755, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 0.e.0.0.0.0.1.0.d.8.3.b.0.7.c.a.0.0.0.0.2.0.3.6.c.6.f.c.2.c.d.a.ip6.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: ip6.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1103, dns_authorities_0_soa_mname: b.ip6-servers.arpa, dns_authorities_0_soa_rname: nstld.iana.org, dns_authorities_0_soa_serial: 2017042716, dns_authorities_0_soa_refresh: 1800, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 10164499, event_type: dns, proto: UDP, dns_type: query, dns_id: 20446, dns_rrname: clients1.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10164511, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20446, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: clients1.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: clients1.google.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: clients.l.google.com, dns_answers_1_rrname: clients.l.google.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 284, dns_answers_1_rdata: 2607:f8b0:4006:0812:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0812:0000:0000:0000:200e, dns_grouped_CNAME_0: clients.l.google.com ; pcap_cnt: 10262162, event_type: dns, proto: UDP, dns_type: query, dns_id: 5875, dns_rrname: get.adobe.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10262371, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5875, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: get.adobe.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: get.adobe.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 5156, dns_answers_0_rdata: get.wip4.adobe.com, dns_grouped_CNAME_0: get.wip4.adobe.com, dns_authorities_0_rrname: wip4.adobe.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 5, dns_authorities_0_soa_mname: sj1gtm001.adobe.com, dns_authorities_0_soa_rname: hostmaster.sj1gtm001.adobe.com, dns_authorities_0_soa_serial: 1448, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 45 ; pcap_cnt: 10384806, event_type: dns, proto: UDP, dns_type: query, dns_id: 56559, dns_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10384823, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56559, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 28, dns_authorities_0_soa_mname: ns-699.awsdns-23.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 10576337, event_type: dns, proto: UDP, dns_type: query, dns_id: 55621, dns_rrname: mk.telegrafi.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10576342, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55621, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: mk.telegrafi.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: mk.telegrafi.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 300, dns_answers_0_rdata: 2400:cb00:2048:0001:0000:0000:6819:4e18, dns_answers_1_rrname: mk.telegrafi.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 300, dns_answers_1_rdata: 2400:cb00:2048:0001:0000:0000:6819:4f18, dns_grouped_AAAA_0: 2400:cb00:2048:0001:0000:0000:6819:4e18, dns_grouped_AAAA_1: 2400:cb00:2048:0001:0000:0000:6819:4f18 ; pcap_cnt: 10634738, event_type: dns, proto: UDP, dns_type: query, dns_id: 44649, dns_rrname: www.mirtesen.ru, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10634866, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44649, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.mirtesen.ru, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: mirtesen.ru, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 300, dns_authorities_0_soa_mname: ns1.mirtesen.ru, dns_authorities_0_soa_rname: root.mirtesen.ru, dns_authorities_0_soa_serial: 2017070301, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1814400, dns_authorities_0_soa_minimum: 7200 ; pcap_cnt: 10663655, event_type: dns, proto: UDP, dns_type: query, dns_id: 48909, dns_rrname: 4.bp.blogspot.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10663677, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48909, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 4.bp.blogspot.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: 4.bp.blogspot.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 586323, dns_answers_0_rdata: photos-ugc.l.googleusercontent.com, dns_answers_1_rrname: photos-ugc.l.googleusercontent.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 237, dns_answers_1_rdata: 172.217.10.1, dns_grouped_A_0: 172.217.10.1, dns_grouped_CNAME_0: photos-ugc.l.googleusercontent.com ; pcap_cnt: 11037339, event_type: dns, proto: UDP, dns_type: query, dns_id: 41946, dns_rrname: api.demandbase.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11037340, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41946, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: api.demandbase.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: api.demandbase.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.192.37.44, dns_answers_1_rrname: api.demandbase.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 54.192.37.6, dns_answers_2_rrname: api.demandbase.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 54.192.37.131, dns_answers_3_rrname: api.demandbase.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 54.192.37.249, dns_answers_4_rrname: api.demandbase.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 54.192.37.182, dns_answers_5_rrname: api.demandbase.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.192.37.225, dns_answers_6_rrname: api.demandbase.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 54.192.37.189, dns_answers_7_rrname: api.demandbase.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 54.192.37.91, dns_grouped_A_0: 54.192.37.44, dns_grouped_A_1: 54.192.37.6, dns_grouped_A_2: 54.192.37.131, dns_grouped_A_3: 54.192.37.249, dns_grouped_A_4: 54.192.37.182, dns_grouped_A_5: 54.192.37.225, dns_grouped_A_6: 54.192.37.189, dns_grouped_A_7: 54.192.37.91 ; pcap_cnt: 11446741, event_type: dns, proto: UDP, dns_type: query, dns_id: 19203, dns_rrname: e5799.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11446760, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19203, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e5799.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e5799.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 23.194.141.58, dns_grouped_A_0: 23.194.141.58
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.