['flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.9, src_port: 50545, dest_ip: 192.168.10.3, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 170, flow_bytes_toclient: 294, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 144, flow_bytes_toclient: 348, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 280, flow_bytes_toclient: 1304, flow_age: 140, flow_state: established, flow_reason: timeout ; pcap_cnt: 53835, event_type: dns, proto: UDP, dns_type: query, dns_id: 63454, dns_rrname: 65.134.34.52.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 53836, event_type: dns, proto: UDP, dns_type: query, dns_id: 63454, dns_rrname: 65.134.34.52.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 1 ; pcap_cnt: 53867, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63454, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 65.134.34.52.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 65.134.34.52.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 300, dns_answers_0_rdata: ec2-52-34-134-65.us-west-2.compute.amazonaws.com, dns_grouped_PTR_0: ec2-52-34-134-65.us-west-2.compute.amazonaws.com ; pcap_cnt: 53868, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63454, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 65.134.34.52.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 65.134.34.52.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 300, dns_answers_0_rdata: ec2-52-34-134-65.us-west-2.compute.amazonaws.com, dns_grouped_PTR_0: ec2-52-34-134-65.us-west-2.compute.amazonaws.com ; pcap_cnt: 10763018, event_type: dns, proto: UDP, dns_type: query, dns_id: 46800, dns_rrname: gv.symcd.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10763019, event_type: dns, proto: UDP, dns_type: query, dns_id: 46800, dns_rrname: gv.symcd.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 10763030, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46800, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: gv.symcd.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: gv.symcd.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1070, dns_answers_0_rdata: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_1_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 12, dns_answers_1_rdata: e8218.dscb1.akamaiedge.net, dns_answers_2_rrname: e8218.dscb1.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 8, dns_answers_2_rdata: 23.50.75.27, dns_grouped_CNAME_0: ocsp-ds.ws.symantec.com.edgekey.net, dns_grouped_CNAME_1: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.50.75.27 ; pcap_cnt: 10763031, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46800, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: gv.symcd.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: gv.symcd.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1070, dns_answers_0_rdata: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_1_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 12, dns_answers_1_rdata: e8218.dscb1.akamaiedge.net, dns_answers_2_rrname: e8218.dscb1.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 8, dns_answers_2_rdata: 23.50.75.27, dns_grouped_A_0: 23.50.75.27, dns_grouped_CNAME_0: ocsp-ds.ws.symantec.com.edgekey.net, dns_grouped_CNAME_1: e8218.dscb1.akamaiedge.net ; pcap_cnt: 10990757, event_type: dns, proto: UDP, dns_type: query, dns_id: 10141, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10990758, event_type: dns, proto: UDP, dns_type: query, dns_id: 10141, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 10990759, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10141, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: t.lkqd.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 5, dns_answers_0_rdata: 146.20.133.110, dns_answers_1_rrname: t.lkqd.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 5, dns_answers_1_rdata: 146.20.133.102, dns_answers_2_rrname: t.lkqd.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 5, dns_answers_2_rdata: 146.20.133.111, dns_answers_3_rrname: t.lkqd.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 5, dns_answers_3_rdata: 146.20.133.105, dns_answers_4_rrname: t.lkqd.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 5, dns_answers_4_rdata: 146.20.133.99, dns_answers_5_rrname: t.lkqd.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 5, dns_answers_5_rdata: 146.20.133.101, dns_answers_6_rrname: t.lkqd.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 5, dns_answers_6_rdata: 146.20.133.98, dns_answers_7_rrname: t.lkqd.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 5, dns_answers_7_rdata: 146.20.133.104, dns_answers_8_rrname: t.lkqd.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 5, dns_answers_8_rdata: 146.20.133.108, dns_answers_9_rrname: t.lkqd.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 5, dns_answers_9_rdata: 146.20.133.107, dns_answers_10_rrname: t.lkqd.net, dns_answers_10_rrtype: A, dns_answers_10_ttl: 5, dns_answers_10_rdata: 146.20.133.106, dns_answers_11_rrname: t.lkqd.net, dns_answers_11_rrtype: A, dns_answers_11_ttl: 5, dns_answers_11_rdata: 146.20.133.109, dns_answers_12_rrname: t.lkqd.net, dns_answers_12_rrtype: A, dns_answers_12_ttl: 5, dns_answers_12_rdata: 146.20.133.103, dns_answers_13_rrname: t.lkqd.net, dns_answers_13_rrtype: A, dns_answers_13_ttl: 5, dns_answers_13_rdata: 146.20.133.100, dns_answers_14_rrname: t.lkqd.net, dns_answers_14_rrtype: A, dns_answers_14_ttl: 5, dns_answers_14_rdata: 146.20.133.113, dns_answers_15_rrname: t.lkqd.net, dns_answers_15_rrtype: A, dns_answers_15_ttl: 5, dns_answers_15_rdata: 146.20.133.112, dns_grouped_A_0: 146.20.133.110, dns_grouped_A_1: 146.20.133.102, dns_grouped_A_2: 146.20.133.111, dns_grouped_A_3: 146.20.133.105, dns_grouped_A_4: 146.20.133.99, dns_grouped_A_5: 146.20.133.101, dns_grouped_A_6: 146.20.133.98, dns_grouped_A_7: 146.20.133.104, dns_grouped_A_8: 146.20.133.108, dns_grouped_A_9: 146.20.133.107, dns_grouped_A_10: 146.20.133.106, dns_grouped_A_11: 146.20.133.109, dns_grouped_A_12: 146.20.133.103, dns_grouped_A_13: 146.20.133.100, dns_grouped_A_14: 146.20.133.113, dns_grouped_A_15: 146.20.133.112 ; pcap_cnt: 10990760, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10141, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: t.lkqd.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 5, dns_answers_0_rdata: 146.20.133.110, dns_answers_1_rrname: t.lkqd.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 5, dns_answers_1_rdata: 146.20.133.102, dns_answers_2_rrname: t.lkqd.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 5, dns_answers_2_rdata: 146.20.133.111, dns_answers_3_rrname: t.lkqd.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 5, dns_answers_3_rdata: 146.20.133.105, dns_answers_4_rrname: t.lkqd.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 5, dns_answers_4_rdata: 146.20.133.99, dns_answers_5_rrname: t.lkqd.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 5, dns_answers_5_rdata: 146.20.133.101, dns_answers_6_rrname: t.lkqd.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 5, dns_answers_6_rdata: 146.20.133.98, dns_answers_7_rrname: t.lkqd.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 5, dns_answers_7_rdata: 146.20.133.104, dns_answers_8_rrname: t.lkqd.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 5, dns_answers_8_rdata: 146.20.133.108, dns_answers_9_rrname: t.lkqd.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 5, dns_answers_9_rdata: 146.20.133.107, dns_answers_10_rrname: t.lkqd.net, dns_answers_10_rrtype: A, dns_answers_10_ttl: 5, dns_answers_10_rdata: 146.20.133.106, dns_answers_11_rrname: t.lkqd.net, dns_answers_11_rrtype: A, dns_answers_11_ttl: 5, dns_answers_11_rdata: 146.20.133.109, dns_answers_12_rrname: t.lkqd.net, dns_answers_12_rrtype: A, dns_answers_12_ttl: 5, dns_answers_12_rdata: 146.20.133.103, dns_answers_13_rrname: t.lkqd.net, dns_answers_13_rrtype: A, dns_answers_13_ttl: 5, dns_answers_13_rdata: 146.20.133.100, dns_answers_14_rrname: t.lkqd.net, dns_answers_14_rrtype: A, dns_answers_14_ttl: 5, dns_answers_14_rdata: 146.20.133.113, dns_answers_15_rrname: t.lkqd.net, dns_answers_15_rrtype: A, dns_answers_15_ttl: 5, dns_answers_15_rdata: 146.20.133.112, dns_grouped_A_0: 146.20.133.110, dns_grouped_A_1: 146.20.133.102, dns_grouped_A_2: 146.20.133.111, dns_grouped_A_3: 146.20.133.105, dns_grouped_A_4: 146.20.133.99, dns_grouped_A_5: 146.20.133.101, dns_grouped_A_6: 146.20.133.98, dns_grouped_A_7: 146.20.133.104, dns_grouped_A_8: 146.20.133.108, dns_grouped_A_9: 146.20.133.107, dns_grouped_A_10: 146.20.133.106, dns_grouped_A_11: 146.20.133.109, dns_grouped_A_12: 146.20.133.103, dns_grouped_A_13: 146.20.133.100, dns_grouped_A_14: 146.20.133.113, dns_grouped_A_15: 146.20.133.112 ; pcap_cnt: 11079211, event_type: dns, proto: UDP, dns_type: query, dns_id: 59048, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 11079212, event_type: dns, proto: UDP, dns_type: query, dns_id: 59048, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_tx_id: 5 ; pcap_cnt: 11079213, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59048, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: t.lkqd.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 146.20.133.145, dns_answers_1_rrname: t.lkqd.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 146.20.133.134, dns_answers_2_rrname: t.lkqd.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 146.20.133.144, dns_answers_3_rrname: t.lkqd.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 146.20.133.137, dns_answers_4_rrname: t.lkqd.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 146.20.133.133, dns_answers_5_rrname: t.lkqd.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 146.20.133.143, dns_answers_6_rrname: t.lkqd.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 0, dns_answers_6_rdata: 146.20.133.136, dns_answers_7_rrname: t.lkqd.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 0, dns_answers_7_rdata: 146.20.133.135, dns_answers_8_rrname: t.lkqd.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 0, dns_answers_8_rdata: 146.20.133.139, dns_answers_9_rrname: t.lkqd.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 0, dns_answers_9_rdata: 146.20.133.142, dns_answers_10_rrname: t.lkqd.net, dns_answers_10_rrtype: A, dns_answers_10_ttl: 0, dns_answers_10_rdata: 146.20.133.132, dns_answers_11_rrname: t.lkqd.net, dns_answers_11_rrtype: A, dns_answers_11_ttl: 0, dns_answers_11_rdata: 146.20.133.140, dns_answers_12_rrname: t.lkqd.net, dns_answers_12_rrtype: A, dns_answers_12_ttl: 0, dns_answers_12_rdata: 146.20.133.141, dns_answers_13_rrname: t.lkqd.net, dns_answers_13_rrtype: A, dns_answers_13_ttl: 0, dns_answers_13_rdata: 146.20.133.138, dns_answers_14_rrname: t.lkqd.net, dns_answers_14_rrtype: A, dns_answers_14_ttl: 0, dns_answers_14_rdata: 146.20.133.130, dns_answers_15_rrname: t.lkqd.net, dns_answers_15_rrtype: A, dns_answers_15_ttl: 0, dns_answers_15_rdata: 146.20.133.131, dns_grouped_A_0: 146.20.133.145, dns_grouped_A_1: 146.20.133.134, dns_grouped_A_2: 146.20.133.144, dns_grouped_A_3: 146.20.133.137, dns_grouped_A_4: 146.20.133.133, dns_grouped_A_5: 146.20.133.143, dns_grouped_A_6: 146.20.133.136, dns_grouped_A_7: 146.20.133.135, dns_grouped_A_8: 146.20.133.139, dns_grouped_A_9: 146.20.133.142, dns_grouped_A_10: 146.20.133.132, dns_grouped_A_11: 146.20.133.140, dns_grouped_A_12: 146.20.133.141, dns_grouped_A_13: 146.20.133.138, dns_grouped_A_14: 146.20.133.130, dns_grouped_A_15: 146.20.133.131 ; pcap_cnt: 11079214, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59048, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: t.lkqd.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 146.20.133.145, dns_answers_1_rrname: t.lkqd.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 146.20.133.134, dns_answers_2_rrname: t.lkqd.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 146.20.133.144, dns_answers_3_rrname: t.lkqd.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 146.20.133.137, dns_answers_4_rrname: t.lkqd.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 146.20.133.133, dns_answers_5_rrname: t.lkqd.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 146.20.133.143, dns_answers_6_rrname: t.lkqd.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 0, dns_answers_6_rdata: 146.20.133.136, dns_answers_7_rrname: t.lkqd.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 0, dns_answers_7_rdata: 146.20.133.135, dns_answers_8_rrname: t.lkqd.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 0, dns_answers_8_rdata: 146.20.133.139, dns_answers_9_rrname: t.lkqd.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 0, dns_answers_9_rdata: 146.20.133.142, dns_answers_10_rrname: t.lkqd.net, dns_answers_10_rrtype: A, dns_answers_10_ttl: 0, dns_answers_10_rdata: 146.20.133.132, dns_answers_11_rrname: t.lkqd.net, dns_answers_11_rrtype: A, dns_answers_11_ttl: 0, dns_answers_11_rdata: 146.20.133.140, dns_answers_12_rrname: t.lkqd.net, dns_answers_12_rrtype: A, dns_answers_12_ttl: 0, dns_answers_12_rdata: 146.20.133.141, dns_answers_13_rrname: t.lkqd.net, dns_answers_13_rrtype: A, dns_answers_13_ttl: 0, dns_answers_13_rdata: 146.20.133.138, dns_answers_14_rrname: t.lkqd.net, dns_answers_14_rrtype: A, dns_answers_14_ttl: 0, dns_answers_14_rdata: 146.20.133.130, dns_answers_15_rrname: t.lkqd.net, dns_answers_15_rrtype: A, dns_answers_15_ttl: 0, dns_answers_15_rdata: 146.20.133.131, dns_grouped_A_0: 146.20.133.145, dns_grouped_A_1: 146.20.133.134, dns_grouped_A_2: 146.20.133.144, dns_grouped_A_3: 146.20.133.137, dns_grouped_A_4: 146.20.133.133, dns_grouped_A_5: 146.20.133.143, dns_grouped_A_6: 146.20.133.136, dns_grouped_A_7: 146.20.133.135, dns_grouped_A_8: 146.20.133.139, dns_grouped_A_9: 146.20.133.142, dns_grouped_A_10: 146.20.133.132, dns_grouped_A_11: 146.20.133.140, dns_grouped_A_12: 146.20.133.141, dns_grouped_A_13: 146.20.133.138, dns_grouped_A_14: 146.20.133.130, dns_grouped_A_15: 146.20.133.131
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.