['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60215, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 188, flow_bytes_toclient: 282, flow_age: 34, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 123, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 120, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 127, flow_bytes_toclient: 255, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 193, flow_bytes_toclient: 343, flow_age: 63, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 175, flow_bytes_toclient: 239, flow_age: 51, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 213, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 235, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 106, flow_bytes_toclient: 159, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 124, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 105, flow_bytes_toclient: 165, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 169, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 194, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 156, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 172, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 81, flow_bytes_toclient: 148, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 102, flow_bytes_toclient: 154, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 198, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 171, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 182, flow_bytes_toclient: 342, flow_age: 138, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 210, flow_bytes_toclient: 308, flow_age: 107, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 182, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 109, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 162, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 348991, event_type: dns, proto: UDP, dns_type: query, dns_id: 49043, dns_rrname: c.urs.microsoft.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 348997, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49043, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: c.urs.microsoft.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: c.urs.microsoft.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3494, dns_answers_0_rdata: urs.microsoft.com.nsatc.net, dns_answers_1_rrname: urs.microsoft.com.nsatc.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 104.40.17.139, dns_grouped_CNAME_0: urs.microsoft.com.nsatc.net, dns_grouped_A_0: 104.40.17.139 ; pcap_cnt: 496965, event_type: dns, proto: UDP, dns_type: query, dns_id: 46844, dns_rrname: 4719316.fls.doubleclick.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 497224, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46844, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 4719316.fls.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: 4719316.fls.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 86399, dns_answers_0_rdata: dart.l.doubleclick.net, dns_answers_1_rrname: dart.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 298, dns_answers_1_rdata: 172.217.7.6, dns_grouped_CNAME_0: dart.l.doubleclick.net, dns_grouped_A_0: 172.217.7.6 ; pcap_cnt: 4856484, event_type: dns, proto: UDP, dns_type: query, dns_id: 46431, dns_rrname: play.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4856489, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46431, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: play.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: play.google.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 260, dns_answers_0_rdata: play.l.google.com, dns_answers_1_rrname: play.l.google.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 260, dns_answers_1_rdata: 172.217.10.78, dns_grouped_CNAME_0: play.l.google.com, dns_grouped_A_0: 172.217.10.78 ; pcap_cnt: 5575565, event_type: dns, proto: UDP, dns_type: query, dns_id: 41150, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5575638, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41150, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: scontent.xx.fbcdn.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2a03:2880:f003:0c0e:face:b00c:0000:0003, dns_grouped_AAAA_0: 2a03:2880:f003:0c0e:face:b00c:0000:0003 ; pcap_cnt: 5649472, event_type: dns, proto: UDP, dns_type: query, dns_id: 43166, dns_rrname: adservers-users-1-1251423768.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5649474, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43166, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adservers-users-1-1251423768.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: adservers-users-1-1251423768.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 55, dns_answers_0_rdata: 107.20.192.184, dns_answers_1_rrname: adservers-users-1-1251423768.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 55, dns_answers_1_rdata: 184.73.248.230, dns_answers_2_rrname: adservers-users-1-1251423768.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 55, dns_answers_2_rdata: 23.23.148.96, dns_answers_3_rrname: adservers-users-1-1251423768.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 55, dns_answers_3_rdata: 184.73.180.108, dns_answers_4_rrname: adservers-users-1-1251423768.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 55, dns_answers_4_rdata: 23.23.134.233, dns_answers_5_rrname: adservers-users-1-1251423768.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 55, dns_answers_5_rdata: 23.21.114.96, dns_answers_6_rrname: adservers-users-1-1251423768.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 55, dns_answers_6_rdata: 184.73.222.152, dns_answers_7_rrname: adservers-users-1-1251423768.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 55, dns_answers_7_rdata: 54.243.251.148, dns_grouped_A_0: 107.20.192.184, dns_grouped_A_1: 184.73.248.230, dns_grouped_A_2: 23.23.148.96, dns_grouped_A_3: 184.73.180.108, dns_grouped_A_4: 23.23.134.233, dns_grouped_A_5: 23.21.114.96, dns_grouped_A_6: 184.73.222.152, dns_grouped_A_7: 54.243.251.148 ; pcap_cnt: 5921178, event_type: dns, proto: UDP, dns_type: query, dns_id: 10929, dns_rrname: sp.analytics.yahoo.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5921288, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10929, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sp.analytics.yahoo.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sp.analytics.yahoo.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 609, dns_answers_0_rdata: spdc-global.pbp.gysm.yahoodns.net, dns_answers_1_rrname: spdc-global.pbp.gysm.yahoodns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 56, dns_answers_1_rdata: 98.139.225.35, dns_grouped_CNAME_0: spdc-global.pbp.gysm.yahoodns.net, dns_grouped_A_0: 98.139.225.35 ; pcap_cnt: 5933714, event_type: dns, proto: UDP, dns_type: query, dns_id: 63616, dns_rrname: d2otzcfu7vqzws.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 5933724, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63616, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d2otzcfu7vqzws.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d2otzcfu7vqzws.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 85, dns_authorities_0_soa_mname: ns-1930.awsdns-49.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6291570, event_type: dns, proto: UDP, dns_type: query, dns_id: 20663, dns_rrname: ytstatic.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6292036, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20663, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ytstatic.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ytstatic.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.11.46, dns_grouped_A_0: 172.217.11.46 ; pcap_cnt: 6315764, event_type: dns, proto: UDP, dns_type: query, dns_id: 27477, dns_rrname: franecki.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6315903, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 27477, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: franecki.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: franecki.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 108, dns_answers_0_rdata: 5.79.102.202, dns_answers_1_rrname: franecki.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 108, dns_answers_1_rdata: 5.79.102.222, dns_answers_2_rrname: franecki.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 108, dns_answers_2_rdata: 5.79.102.212, dns_grouped_A_0: 5.79.102.202, dns_grouped_A_1: 5.79.102.222, dns_grouped_A_2: 5.79.102.212 ; pcap_cnt: 6775829, event_type: dns, proto: UDP, dns_type: query, dns_id: 49027, dns_rrname: c.amazon-adsystem.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6775910, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49027, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: c.amazon-adsystem.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: c.amazon-adsystem.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 336, dns_answers_0_rdata: d1ykf07e75w7ss.cloudfront.net, dns_grouped_CNAME_0: d1ykf07e75w7ss.cloudfront.net, dns_authorities_0_rrname: d1ykf07e75w7ss.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 93, dns_authorities_0_soa_mname: ns-793.awsdns-35.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 9493607, event_type: dns, proto: UDP, dns_type: query, dns_id: 21976, dns_rrname: as.eu.angsrvr.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9493623, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21976, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: as.eu.angsrvr.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: as.eu.angsrvr.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 42, dns_answers_0_rdata: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_grouped_CNAME_0: lb-adselect-big-1138819731.us-east-1.elb.amazonaws.com, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 16, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 10008869, event_type: dns, proto: UDP, dns_type: query, dns_id: 8633, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10008900, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 8633, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 18, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 16, dns_answers_1_rdata: 23.61.187.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.61.187.27 ; pcap_cnt: 10447878, event_type: dns, proto: UDP, dns_type: query, dns_id: 11531, dns_rrname: colrep.sitelabweb.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10447902, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11531, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: colrep.sitelabweb.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: colrep.sitelabweb.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 34.197.161.100, dns_answers_1_rrname: colrep.sitelabweb.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 34.195.30.139, dns_grouped_A_0: 34.197.161.100, dns_grouped_A_1: 34.195.30.139 ; pcap_cnt: 10784072, event_type: dns, proto: UDP, dns_type: query, dns_id: 52580, dns_rrname: sumo.external.zlb.scl3.mozilla.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10784073, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52580, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sumo.external.zlb.scl3.mozilla.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: mozilla.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 537, dns_authorities_0_soa_mname: ns.mozilla.org, dns_authorities_0_soa_rname: sysadmins.mozilla.org, dns_authorities_0_soa_serial: 2017062700, dns_authorities_0_soa_refresh: 180, dns_authorities_0_soa_retry: 180, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 10874752, event_type: dns, proto: UDP, dns_type: query, dns_id: 11184, dns_rrname: ocsp.godaddy.com.akadns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10874859, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11184, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.godaddy.com.akadns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.godaddy.com.akadns.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 72.167.18.239, dns_grouped_A_0: 72.167.18.239 ; pcap_cnt: 11078534, event_type: dns, proto: UDP, dns_type: query, dns_id: 34600, dns_rrname: sync.teads.tv, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11078541, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34600, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sync.teads.tv, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: teads.tv, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 320, dns_authorities_0_soa_mname: ns-1425.awsdns-50.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 11445823, event_type: dns, proto: UDP, dns_type: query, dns_id: 54371, dns_rrname: aa.agkn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11445824, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 54371, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: aa.agkn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: aa.agkn.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 63.251.88.56, dns_answers_1_rrname: aa.agkn.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 156.154.200.36, dns_grouped_A_0: 63.251.88.56, dns_grouped_A_1: 156.154.200.36 ; pcap_cnt: 11525963, event_type: dns, proto: UDP, dns_type: query, dns_id: 49342, dns_rrname: widgets.coupons.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11526273, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49342, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: widgets.coupons.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: widgets.coupons.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 25, dns_answers_0_rdata: widgets.receiptiq.com, dns_answers_1_rrname: widgets.receiptiq.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 25, dns_answers_1_rdata: va2.uxm.receiptiq.com, dns_grouped_CNAME_0: widgets.receiptiq.com, dns_grouped_CNAME_1: va2.uxm.receiptiq.com, dns_authorities_0_rrname: receiptiq.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 300, dns_authorities_0_soa_mname: ns.receiptiq.com, dns_authorities_0_soa_rname: hostmaster.receiptiq.com, dns_authorities_0_soa_serial: 4160559019, dns_authorities_0_soa_refresh: 43200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 10800 ; pcap_cnt: 11668639, event_type: dns, proto: UDP, dns_type: query, dns_id: 16123, dns_rrname: ib.anycast.adnxs.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11668652, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16123, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ib.anycast.adnxs.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adnxs.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 9, dns_authorities_0_soa_mname: ns1.gslb.com, dns_authorities_0_soa_rname: support.appnexus.net, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 30, dns_authorities_0_soa_expire: 86400, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 11776029, event_type: dns, proto: UDP, dns_type: query, dns_id: 55791, dns_rrname: tps620.doubleverify.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11776092, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55791, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tps620.doubleverify.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tps620.doubleverify.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 19, dns_answers_0_rdata: nycp-hlb.doubleverify.com, dns_answers_1_rrname: nycp-hlb.doubleverify.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 247, dns_answers_1_rdata: nycp-hlb.dvgtm.akadns.net, dns_answers_2_rrname: nycp-hlb.dvgtm.akadns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 10, dns_answers_2_rdata: 204.154.111.116, dns_grouped_A_0: 204.154.111.116, dns_grouped_CNAME_0: nycp-hlb.doubleverify.com, dns_grouped_CNAME_1: nycp-hlb.dvgtm.akadns.net ; pcap_cnt: 11891787, event_type: dns, proto: UDP, dns_type: query, dns_id: 29005, dns_rrname: s.yimg.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11891857, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29005, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s.yimg.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s.yimg.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 79, dns_answers_0_rdata: s.gycs.b.yahoodns.net, dns_answers_1_rrname: s.gycs.b.yahoodns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 69.147.82.60, dns_answers_2_rrname: s.gycs.b.yahoodns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 69.147.82.61, dns_grouped_CNAME_0: s.gycs.b.yahoodns.net, dns_grouped_A_0: 69.147.82.60, dns_grouped_A_1: 69.147.82.61 ; pcap_cnt: 12022604, event_type: dns, proto: UDP, dns_type: query, dns_id: 37265, dns_rrname: www.hupucdn.com.w.kunlunhuf.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 12022605, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37265, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.hupucdn.com.w.kunlunhuf.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: w.kunlunhuf.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 105, dns_authorities_0_soa_mname: ns3.kunlunhuf.com, dns_authorities_0_soa_rname: root.taobao.com, dns_authorities_0_soa_serial: 38, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 360000, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 12187739, event_type: dns, proto: UDP, dns_type: query, dns_id: 4180, dns_rrname: search.spotxchange.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12187745, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4180, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: search.spotxchange.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: search.spotxchange.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 327, dns_answers_0_rdata: geo.search-gtm.spotxchange.com.akadns.net, dns_answers_1_rrname: geo.search-gtm.spotxchange.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 31, dns_answers_1_rdata: den.search.spotxchange.com, dns_answers_2_rrname: den.search.spotxchange.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 217, dns_answers_2_rdata: 198.54.12.96, dns_answers_3_rrname: den.search.spotxchange.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 217, dns_answers_3_rdata: 198.54.12.97, dns_grouped_CNAME_0: geo.search-gtm.spotxchange.com.akadns.net, dns_grouped_CNAME_1: den.search.spotxchange.com, dns_grouped_A_0: 198.54.12.96, dns_grouped_A_1: 198.54.12.97 ; pcap_cnt: 12326723, event_type: dns, proto: UDP, dns_type: query, dns_id: 48824, dns_rrname: static3.1tv.ru, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12326787, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48824, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static3.1tv.ru, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: static3.1tv.ru, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 560, dns_answers_0_rdata: static1.1tv.ru, dns_answers_1_rrname: static1.1tv.ru, dns_answers_1_rrtype: A, dns_answers_1_ttl: 559, dns_answers_1_rdata: 195.16.108.152, dns_answers_2_rrname: static1.1tv.ru, dns_answers_2_rrtype: A, dns_answers_2_ttl: 559, dns_answers_2_rdata: 81.177.156.116, dns_answers_3_rrname: static1.1tv.ru, dns_answers_3_rrtype: A, dns_answers_3_ttl: 559, dns_answers_3_rdata: 81.177.156.117, dns_answers_4_rrname: static1.1tv.ru, dns_answers_4_rrtype: A, dns_answers_4_ttl: 559, dns_answers_4_rdata: 195.16.108.151, dns_grouped_A_0: 195.16.108.152, dns_grouped_A_1: 81.177.156.116, dns_grouped_A_2: 81.177.156.117, dns_grouped_A_3: 195.16.108.151, dns_grouped_CNAME_0: static1.1tv.ru ; pcap_cnt: 12474018, event_type: dns, proto: UDP, dns_type: query, dns_id: 50379, dns_rrname: ads37.vertamedia.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12474021, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50379, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ads37.vertamedia.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ads37.vertamedia.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1137, dns_answers_0_rdata: 23.227.138.205, dns_answers_1_rrname: ads37.vertamedia.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1137, dns_answers_1_rdata: 23.227.138.202, dns_grouped_A_0: 23.227.138.205, dns_grouped_A_1: 23.227.138.202 ; pcap_cnt: 12533716, event_type: dns, proto: UDP, dns_type: query, dns_id: 18291, dns_rrname: pxl.trafficstars.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 12533717, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18291, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pxl.trafficstars.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pxl.trafficstars.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 71, dns_answers_0_rdata: 88.208.59.142, dns_answers_1_rrname: pxl.trafficstars.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 71, dns_answers_1_rdata: 88.208.58.34, dns_answers_2_rrname: pxl.trafficstars.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 71, dns_answers_2_rdata: 88.208.59.144, dns_answers_3_rrname: pxl.trafficstars.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 71, dns_answers_3_rdata: 88.208.58.35, dns_answers_4_rrname: pxl.trafficstars.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 71, dns_answers_4_rdata: 88.208.58.30, dns_answers_5_rrname: pxl.trafficstars.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 71, dns_answers_5_rdata: 88.208.58.27, dns_answers_6_rrname: pxl.trafficstars.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 71, dns_answers_6_rdata: 88.208.58.31, dns_answers_7_rrname: pxl.trafficstars.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 71, dns_answers_7_rdata: 88.208.58.26, dns_grouped_A_0: 88.208.59.142, dns_grouped_A_1: 88.208.58.34, dns_grouped_A_2: 88.208.59.144, dns_grouped_A_3: 88.208.58.35, dns_grouped_A_4: 88.208.58.30, dns_grouped_A_5: 88.208.58.27, dns_grouped_A_6: 88.208.58.31, dns_grouped_A_7: 88.208.58.26 ; pcap_cnt: 12900550, event_type: dns, proto: UDP, dns_type: query, dns_id: 59992, dns_rrname: dart.l.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12900628, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59992, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dart.l.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dart.l.doubleclick.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 172.217.10.230, dns_grouped_A_0: 172.217.10.230 ; pcap_cnt: 12917520, event_type: dns, proto: UDP, dns_type: query, dns_id: 356, dns_rrname: p13nlog-1106815646.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 12917522, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 356, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: p13nlog-1106815646.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 3, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 12992045, event_type: dns, proto: UDP, dns_type: query, dns_id: 25903, dns_rrname: bam.nr-data.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12992057, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25903, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: bam.nr-data.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: bam.nr-data.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 2560, dns_answers_0_rdata: 162.247.242.19, dns_answers_1_rrname: bam.nr-data.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 2560, dns_answers_1_rdata: 50.31.164.173, dns_answers_2_rrname: bam.nr-data.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 2560, dns_answers_2_rdata: 50.31.164.174, dns_answers_3_rrname: bam.nr-data.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 2560, dns_answers_3_rdata: 50.31.164.175, dns_answers_4_rrname: bam.nr-data.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 2560, dns_answers_4_rdata: 162.247.242.18, dns_answers_5_rrname: bam.nr-data.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 2560, dns_answers_5_rdata: 162.247.242.20, dns_grouped_A_0: 162.247.242.19, dns_grouped_A_1: 50.31.164.173, dns_grouped_A_2: 50.31.164.174, dns_grouped_A_3: 50.31.164.175, dns_grouped_A_4: 162.247.242.18, dns_grouped_A_5: 162.247.242.20 ; pcap_cnt: 13286002, event_type: dns, proto: UDP, dns_type: query, dns_id: 41483, dns_rrname: dart.l.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 13286005, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41483, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dart.l.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dart.l.doubleclick.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.3.102, dns_grouped_A_0: 172.217.3.102 ; pcap_cnt: 13388757, event_type: dns, proto: UDP, dns_type: query, dns_id: 14635, dns_rrname: oasc-eu1b.247realmedia.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 13388758, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14635, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: oasc-eu1b.247realmedia.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: 247realmedia.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 379, dns_authorities_0_soa_mname: dns1.p05.nsone.net, dns_authorities_0_soa_rname: hostmaster.nsone.net, dns_authorities_0_soa_serial: 1496966310, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 13749796, event_type: dns, proto: UDP, dns_type: query, dns_id: 12246, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 13749800, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12246, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 157.240.2.35, dns_grouped_A_0: 157.240.2.35
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.