['flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.14, src_port: 64867, dest_ip: 192.168.10.3, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 2, flow_bytes_toserver: 368, flow_bytes_toclient: 276, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 154, flow_bytes_toclient: 186, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 252, flow_bytes_toclient: 508, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 2, flow_bytes_toserver: 308, flow_bytes_toclient: 540, flow_age: 1, flow_state: established, flow_reason: timeout ; pcap_cnt: 5172970, event_type: dns, proto: UDP, dns_type: query, dns_id: 3303, dns_rrname: dayu1251619369.safe.dayugslb.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5172971, event_type: dns, proto: UDP, dns_type: query, dns_id: 3303, dns_rrname: dayu1251619369.safe.dayugslb.com, dns_rrtype: AAAA, dns_tx_id: 1 ; pcap_cnt: 5172973, event_type: dns, proto: UDP, dns_type: query, dns_id: 3303, dns_rrname: dayu1251619369.safe.dayugslb.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 5172974, event_type: dns, proto: UDP, dns_type: query, dns_id: 3303, dns_rrname: dayu1251619369.safe.dayugslb.com, dns_rrtype: AAAA, dns_tx_id: 3 ; pcap_cnt: 5172997, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3303, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dayu1251619369.safe.dayugslb.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: dayugslb.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 300, dns_authorities_0_soa_mname: webmaster.dayugslb.com, dns_authorities_0_soa_rname: webmaster.dayugslb.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 300, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 600, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 5172998, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3303, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dayu1251619369.safe.dayugslb.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: dayugslb.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 300, dns_authorities_0_soa_mname: webmaster.dayugslb.com, dns_authorities_0_soa_rname: webmaster.dayugslb.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 300, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 600, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 5463627, event_type: dns, proto: UDP, dns_type: query, dns_id: 24743, dns_rrname: plus.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5463628, event_type: dns, proto: UDP, dns_type: query, dns_id: 24743, dns_rrname: plus.l.google.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 5463629, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24743, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: plus.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: plus.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 211, dns_answers_0_rdata: 172.217.12.142, dns_grouped_A_0: 172.217.12.142 ; pcap_cnt: 5463630, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24743, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: plus.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: plus.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 211, dns_answers_0_rdata: 172.217.12.142, dns_grouped_A_0: 172.217.12.142 ; pcap_cnt: 6071442, event_type: dns, proto: UDP, dns_type: query, dns_id: 49958, dns_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6071443, event_type: dns, proto: UDP, dns_type: query, dns_id: 49958, dns_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 6071444, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49958, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 25, dns_answers_0_rdata: 23.23.136.195, dns_answers_1_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 25, dns_answers_1_rdata: 23.21.56.63, dns_answers_2_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 25, dns_answers_2_rdata: 50.16.227.133, dns_answers_3_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 25, dns_answers_3_rdata: 23.21.91.36, dns_answers_4_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 25, dns_answers_4_rdata: 23.23.157.167, dns_answers_5_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 25, dns_answers_5_rdata: 23.23.251.198, dns_answers_6_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 25, dns_answers_6_rdata: 23.23.132.24, dns_answers_7_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 25, dns_answers_7_rdata: 23.21.90.177, dns_grouped_A_0: 23.23.136.195, dns_grouped_A_1: 23.21.56.63, dns_grouped_A_2: 50.16.227.133, dns_grouped_A_3: 23.21.91.36, dns_grouped_A_4: 23.23.157.167, dns_grouped_A_5: 23.23.251.198, dns_grouped_A_6: 23.23.132.24, dns_grouped_A_7: 23.21.90.177 ; pcap_cnt: 6071445, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49958, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 25, dns_answers_0_rdata: 23.23.136.195, dns_answers_1_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 25, dns_answers_1_rdata: 23.21.56.63, dns_answers_2_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 25, dns_answers_2_rdata: 50.16.227.133, dns_answers_3_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 25, dns_answers_3_rdata: 23.21.91.36, dns_answers_4_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 25, dns_answers_4_rdata: 23.23.157.167, dns_answers_5_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 25, dns_answers_5_rdata: 23.23.251.198, dns_answers_6_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 25, dns_answers_6_rdata: 23.23.132.24, dns_answers_7_rrname: ttd-useast-match-adsrvr-org-1999903436.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 25, dns_answers_7_rdata: 23.21.90.177, dns_grouped_A_0: 23.23.136.195, dns_grouped_A_1: 23.21.56.63, dns_grouped_A_2: 50.16.227.133, dns_grouped_A_3: 23.21.91.36, dns_grouped_A_4: 23.23.157.167, dns_grouped_A_5: 23.23.251.198, dns_grouped_A_6: 23.23.132.24, dns_grouped_A_7: 23.21.90.177 ; pcap_cnt: 7359136, event_type: dns, proto: UDP, dns_type: query, dns_id: 791, dns_rrname: as.eu.angsrvr.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7359137, event_type: dns, proto: UDP, dns_type: query, dns_id: 791, dns_rrname: as.eu.angsrvr.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 7359376, event_type: dns, proto: UDP, dns_type: query, dns_id: 791, dns_rrname: as.eu.angsrvr.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 7359377, event_type: dns, proto: UDP, dns_type: query, dns_id: 791, dns_rrname: as.eu.angsrvr.com, dns_rrtype: A, dns_tx_id: 3 ; pcap_cnt: 7359473, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 791, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: as.eu.angsrvr.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: as.eu.angsrvr.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 59, dns_answers_0_rdata: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 14, dns_answers_1_rdata: 52.204.155.195, dns_answers_2_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 14, dns_answers_2_rdata: 52.3.18.154, dns_answers_3_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 14, dns_answers_3_rdata: 52.45.8.194, dns_answers_4_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 14, dns_answers_4_rdata: 52.203.66.139, dns_answers_5_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 14, dns_answers_5_rdata: 52.21.36.125, dns_answers_6_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 14, dns_answers_6_rdata: 52.206.20.83, dns_answers_7_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 14, dns_answers_7_rdata: 52.4.97.10, dns_answers_8_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 14, dns_answers_8_rdata: 52.206.164.253, dns_grouped_CNAME_0: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 52.204.155.195, dns_grouped_A_1: 52.3.18.154, dns_grouped_A_2: 52.45.8.194, dns_grouped_A_3: 52.203.66.139, dns_grouped_A_4: 52.21.36.125, dns_grouped_A_5: 52.206.20.83, dns_grouped_A_6: 52.4.97.10, dns_grouped_A_7: 52.206.164.253 ; pcap_cnt: 7359474, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 791, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: as.eu.angsrvr.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: as.eu.angsrvr.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 59, dns_answers_0_rdata: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 14, dns_answers_1_rdata: 52.204.155.195, dns_answers_2_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 14, dns_answers_2_rdata: 52.3.18.154, dns_answers_3_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 14, dns_answers_3_rdata: 52.45.8.194, dns_answers_4_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 14, dns_answers_4_rdata: 52.203.66.139, dns_answers_5_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 14, dns_answers_5_rdata: 52.21.36.125, dns_answers_6_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 14, dns_answers_6_rdata: 52.206.20.83, dns_answers_7_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 14, dns_answers_7_rdata: 52.4.97.10, dns_answers_8_rrname: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 14, dns_answers_8_rdata: 52.206.164.253, dns_grouped_CNAME_0: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 52.204.155.195, dns_grouped_A_1: 52.3.18.154, dns_grouped_A_2: 52.45.8.194, dns_grouped_A_3: 52.203.66.139, dns_grouped_A_4: 52.21.36.125, dns_grouped_A_5: 52.206.20.83, dns_grouped_A_6: 52.4.97.10, dns_grouped_A_7: 52.206.164.253
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.