['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61130, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 104, flow_bytes_toclient: 120, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 158, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 183, flow_bytes_toclient: 522, flow_age: 95, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 102, flow_bytes_toclient: 163, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 210, flow_bytes_toclient: 320, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 119, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 290, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 139, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 221, flow_bytes_toclient: 364, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 144, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 170, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 164, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 198, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 207, flow_bytes_toclient: 294, flow_age: 67, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 200, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 106, flow_bytes_toclient: 159, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 221, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 103, flow_bytes_toclient: 131, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 105, flow_bytes_toclient: 165, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 660620, event_type: dns, proto: UDP, dns_type: query, dns_id: 35636, dns_rrname: www-googletagmanager.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 660883, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35636, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www-googletagmanager.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www-googletagmanager.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.9.232, dns_grouped_A_0: 172.217.9.232 ; pcap_cnt: 2975185, event_type: dns, proto: UDP, dns_type: query, dns_id: 44434, dns_rrname: trc.taboola.map.fastly.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 2975195, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44434, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: trc.taboola.map.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 11, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 3690321, event_type: dns, proto: UDP, dns_type: query, dns_id: 49072, dns_rrname: images.effectivemeasure.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3690378, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49072, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: images.effectivemeasure.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: images.effectivemeasure.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3501, dns_answers_0_rdata: d1fhb1muc7ip5m.cloudfront.net, dns_answers_1_rrname: d1fhb1muc7ip5m.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.145.133, dns_answers_2_rrname: d1fhb1muc7ip5m.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.145.250, dns_answers_3_rrname: d1fhb1muc7ip5m.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.145.117, dns_answers_4_rrname: d1fhb1muc7ip5m.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.145.112, dns_answers_5_rrname: d1fhb1muc7ip5m.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.145.70, dns_answers_6_rrname: d1fhb1muc7ip5m.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.145.242, dns_answers_7_rrname: d1fhb1muc7ip5m.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.145.199, dns_answers_8_rrname: d1fhb1muc7ip5m.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 59, dns_answers_8_rdata: 52.84.145.166, dns_grouped_CNAME_0: d1fhb1muc7ip5m.cloudfront.net, dns_grouped_A_0: 52.84.145.133, dns_grouped_A_1: 52.84.145.250, dns_grouped_A_2: 52.84.145.117, dns_grouped_A_3: 52.84.145.112, dns_grouped_A_4: 52.84.145.70, dns_grouped_A_5: 52.84.145.242, dns_grouped_A_6: 52.84.145.199, dns_grouped_A_7: 52.84.145.166 ; pcap_cnt: 3704626, event_type: dns, proto: UDP, dns_type: query, dns_id: 61346, dns_rrname: s3.playscdn.tv, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 3704629, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61346, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s3.playscdn.tv, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s3.playscdn.tv, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 86400, dns_answers_0_rdata: d1uictq91igazu.cloudfront.net, dns_answers_1_rrname: d1uictq91igazu.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 15, dns_answers_1_rdata: 52.84.145.131, dns_answers_2_rrname: d1uictq91igazu.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 15, dns_answers_2_rdata: 52.84.145.19, dns_answers_3_rrname: d1uictq91igazu.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 15, dns_answers_3_rdata: 52.84.145.190, dns_answers_4_rrname: d1uictq91igazu.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 15, dns_answers_4_rdata: 52.84.145.20, dns_answers_5_rrname: d1uictq91igazu.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 15, dns_answers_5_rdata: 52.84.145.218, dns_answers_6_rrname: d1uictq91igazu.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 15, dns_answers_6_rdata: 52.84.145.246, dns_answers_7_rrname: d1uictq91igazu.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 15, dns_answers_7_rdata: 52.84.145.26, dns_answers_8_rrname: d1uictq91igazu.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 15, dns_answers_8_rdata: 52.84.145.247, dns_grouped_CNAME_0: d1uictq91igazu.cloudfront.net, dns_grouped_A_0: 52.84.145.131, dns_grouped_A_1: 52.84.145.19, dns_grouped_A_2: 52.84.145.190, dns_grouped_A_3: 52.84.145.20, dns_grouped_A_4: 52.84.145.218, dns_grouped_A_5: 52.84.145.246, dns_grouped_A_6: 52.84.145.26, dns_grouped_A_7: 52.84.145.247 ; pcap_cnt: 3858301, event_type: dns, proto: UDP, dns_type: query, dns_id: 40088, dns_rrname: cbsinteractive.d2.sc.omtrdc.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3858341, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40088, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cbsinteractive.d2.sc.omtrdc.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: omtrdc.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns1.omtrdc.net, dns_authorities_0_soa_rname: dnsadmin.omniture.com, dns_authorities_0_soa_serial: 2017070601, dns_authorities_0_soa_refresh: 21600, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 4628483, event_type: dns, proto: UDP, dns_type: query, dns_id: 56617, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4628494, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56617, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: scontent.xx.fbcdn.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 59, dns_answers_0_rdata: 2a03:2880:f00e:0013:face:b00c:0000:0003, dns_grouped_AAAA_0: 2a03:2880:f00e:0013:face:b00c:0000:0003 ; pcap_cnt: 4628754, event_type: dns, proto: UDP, dns_type: query, dns_id: 31863, dns_rrname: elb082328-706898114.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 4628779, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31863, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: elb082328-706898114.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 39, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 4709682, event_type: dns, proto: UDP, dns_type: query, dns_id: 54230, dns_rrname: appspot.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4709740, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 54230, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: appspot.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: appspot.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:0805:0000:0000:0000:2011, dns_grouped_AAAA_0: 2607:f8b0:4006:0805:0000:0000:0000:2011 ; pcap_cnt: 4777871, event_type: dns, proto: UDP, dns_type: query, dns_id: 11476, dns_rrname: mb9eo-h6py7.ads.tremorhub.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4777873, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11476, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: mb9eo-h6py7.ads.tremorhub.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: mb9eo-h6py7.ads.tremorhub.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 269, dns_answers_0_rdata: wildcard-ads-1386167347.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: wildcard-ads-1386167347.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 22, dns_answers_1_rdata: 54.87.193.16, dns_answers_2_rrname: wildcard-ads-1386167347.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 22, dns_answers_2_rdata: 34.200.91.53, dns_answers_3_rrname: wildcard-ads-1386167347.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 22, dns_answers_3_rdata: 52.72.238.194, dns_answers_4_rrname: wildcard-ads-1386167347.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 22, dns_answers_4_rdata: 34.204.127.166, dns_answers_5_rrname: wildcard-ads-1386167347.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 22, dns_answers_5_rdata: 34.197.192.134, dns_answers_6_rrname: wildcard-ads-1386167347.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 22, dns_answers_6_rdata: 34.200.199.99, dns_answers_7_rrname: wildcard-ads-1386167347.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 22, dns_answers_7_rdata: 34.199.70.54, dns_answers_8_rrname: wildcard-ads-1386167347.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 22, dns_answers_8_rdata: 34.198.114.15, dns_grouped_CNAME_0: wildcard-ads-1386167347.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 54.87.193.16, dns_grouped_A_1: 34.200.91.53, dns_grouped_A_2: 52.72.238.194, dns_grouped_A_3: 34.204.127.166, dns_grouped_A_4: 34.197.192.134, dns_grouped_A_5: 34.200.199.99, dns_grouped_A_6: 34.199.70.54, dns_grouped_A_7: 34.198.114.15 ; pcap_cnt: 5250770, event_type: dns, proto: UDP, dns_type: query, dns_id: 25787, dns_rrname: googleads.g.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5250815, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25787, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleads.g.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: googleads.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 162, dns_answers_0_rdata: pagead46.l.doubleclick.net, dns_answers_1_rrname: pagead46.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 293, dns_answers_1_rdata: 172.217.10.2, dns_grouped_CNAME_0: pagead46.l.doubleclick.net, dns_grouped_A_0: 172.217.10.2 ; pcap_cnt: 5465573, event_type: dns, proto: UDP, dns_type: query, dns_id: 7693, dns_rrname: e6550.g.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5465586, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7693, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e6550.g.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 359, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499437880, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 5466945, event_type: dns, proto: UDP, dns_type: query, dns_id: 20648, dns_rrname: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 5466991, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20648, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: aws-p-nv-tag-elb-02-465563958.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 32, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5729718, event_type: dns, proto: UDP, dns_type: query, dns_id: 14545, dns_rrname: lb.ns1p.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5729736, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14545, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: lb.ns1p.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: ns1p.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 57, dns_authorities_0_soa_mname: dns1.p07.nsone.net, dns_authorities_0_soa_rname: hostmaster.nsone.net, dns_authorities_0_soa_serial: 1491324845, dns_authorities_0_soa_refresh: 43200, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 6056219, event_type: dns, proto: UDP, dns_type: query, dns_id: 52940, dns_rrname: cs.adingo.jp, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6056268, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52940, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cs.adingo.jp, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: cs.adingo.jp, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 438, dns_authorities_0_soa_mname: ns-1848.awsdns-39.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6382732, event_type: dns, proto: UDP, dns_type: query, dns_id: 16885, dns_rrname: www.2chan.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6382789, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16885, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.2chan.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.2chan.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 104.17.128.32, dns_answers_1_rrname: www.2chan.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 104.17.129.32, dns_answers_2_rrname: www.2chan.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 299, dns_answers_2_rdata: 104.17.130.32, dns_answers_3_rrname: www.2chan.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 299, dns_answers_3_rdata: 104.17.127.32, dns_answers_4_rrname: www.2chan.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 299, dns_answers_4_rdata: 104.17.131.32, dns_grouped_A_0: 104.17.128.32, dns_grouped_A_1: 104.17.129.32, dns_grouped_A_2: 104.17.130.32, dns_grouped_A_3: 104.17.127.32, dns_grouped_A_4: 104.17.131.32 ; pcap_cnt: 6565908, event_type: dns, proto: UDP, dns_type: query, dns_id: 51022, dns_rrname: analytics.twitter.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6566063, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51022, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: analytics.twitter.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: analytics.twitter.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 231, dns_answers_0_rdata: ads.twitter.com, dns_answers_1_rrname: ads.twitter.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 15, dns_answers_1_rdata: s.twitter.com, dns_grouped_CNAME_0: ads.twitter.com, dns_grouped_CNAME_1: s.twitter.com, dns_authorities_0_rrname: twitter.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 20, dns_authorities_0_soa_mname: ns1.p26.dynect.net, dns_authorities_0_soa_rname: zone-admin.dyndns.com, dns_authorities_0_soa_serial: 2007136037, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6635573, event_type: dns, proto: UDP, dns_type: query, dns_id: 17372, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6635590, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17372, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 47, dns_answers_0_rdata: 72.30.3.43, dns_answers_1_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 47, dns_answers_1_rdata: 98.139.225.43, dns_grouped_A_0: 72.30.3.43, dns_grouped_A_1: 98.139.225.43 ; pcap_cnt: 6643294, event_type: dns, proto: UDP, dns_type: query, dns_id: 11420, dns_rrname: ctologger01.analytics.go.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 6643335, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11420, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ctologger01.analytics.go.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: go.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 0, dns_authorities_0_soa_mname: sens01.dig.com, dns_authorities_0_soa_rname: dns-ops.dig.com, dns_authorities_0_soa_serial: 2017070700, dns_authorities_0_soa_refresh: 1200, dns_authorities_0_soa_retry: 180, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 6885168, event_type: dns, proto: UDP, dns_type: query, dns_id: 18978, dns_rrname: simage2.pubmatic.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6885596, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18978, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: simage2.pubmatic.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: simage2.pubmatic.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 14, dns_answers_0_rdata: pug44000nc.pubmatic.com, dns_answers_1_rrname: pug44000nc.pubmatic.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 94, dns_answers_1_rdata: pug44000n.pubmatic.com, dns_grouped_CNAME_0: pug44000nc.pubmatic.com, dns_grouped_CNAME_1: pug44000n.pubmatic.com, dns_authorities_0_rrname: pubmatic.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1, dns_authorities_0_soa_mname: ns1.p29.dynect.net, dns_authorities_0_soa_rname: anand.pubmatic.com, dns_authorities_0_soa_serial: 12714, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7555180, event_type: dns, proto: UDP, dns_type: query, dns_id: 60370, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7555183, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60370, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 9, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 14, dns_answers_1_rdata: 23.61.187.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.61.187.27 ; pcap_cnt: 7812930, event_type: dns, proto: UDP, dns_type: query, dns_id: 2703, dns_rrname: openx2-match.dotomi.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7813117, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2703, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: openx2-match.dotomi.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: openx2-match.dotomi.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 292, dns_answers_0_rdata: usadmm.dotomi.com.dotomi.weighted.com.akadns.net, dns_answers_1_rrname: usadmm.dotomi.com.dotomi.weighted.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 283, dns_answers_1_rdata: nsy-sjc.dotomi.weighted.com.akadns.net, dns_answers_2_rrname: nsy-sjc.dotomi.weighted.com.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 3, dns_answers_2_rdata: sjc05-usadmm.dotomi.com, dns_answers_3_rrname: sjc05-usadmm.dotomi.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 15, dns_answers_3_rdata: 205.180.86.169, dns_grouped_A_0: 205.180.86.169, dns_grouped_CNAME_0: usadmm.dotomi.com.dotomi.weighted.com.akadns.net, dns_grouped_CNAME_1: nsy-sjc.dotomi.weighted.com.akadns.net, dns_grouped_CNAME_2: sjc05-usadmm.dotomi.com ; pcap_cnt: 7951907, event_type: dns, proto: UDP, dns_type: query, dns_id: 56606, dns_rrname: pagead-googlehosted.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7951937, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56606, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pagead-googlehosted.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: pagead-googlehosted.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:0819:0000:0000:0000:2001, dns_grouped_AAAA_0: 2607:f8b0:4006:0819:0000:0000:0000:2001 ; pcap_cnt: 8049389, event_type: dns, proto: UDP, dns_type: query, dns_id: 44994, dns_rrname: sumo.external.zlb.scl3.mozilla.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8049390, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44994, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sumo.external.zlb.scl3.mozilla.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: mozilla.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1398, dns_authorities_0_soa_mname: ns.mozilla.org, dns_authorities_0_soa_rname: sysadmins.mozilla.org, dns_authorities_0_soa_serial: 2017070700, dns_authorities_0_soa_refresh: 180, dns_authorities_0_soa_retry: 180, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.