['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60445, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 338, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 134, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 134, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 268, flow_bytes_toclient: 519, flow_age: 139, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 98, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 148, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 155, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 161, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 155, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 263, flow_bytes_toclient: 664, flow_age: 267, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 139, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 102, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 122, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 200, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 136, flow_bytes_toclient: 217, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 178, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 178, flow_bytes_toclient: 346, flow_age: 170, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 183, flow_bytes_toclient: 433, flow_age: 6, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 142, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 188, flow_bytes_toclient: 441, flow_age: 111, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 188, flow_bytes_toclient: 396, flow_age: 74, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 105, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 2910528, event_type: dns, proto: UDP, dns_type: query, dns_id: 29272, dns_rrname: ads.adaptv.advertising.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 2911615, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29272, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ads.adaptv.advertising.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ads.adaptv.advertising.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 12, dns_answers_0_rdata: control.adap.tv, dns_answers_1_rrname: control.adap.tv, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 5, dns_answers_1_rdata: control.adap.tv.akadns.net, dns_answers_2_rrname: control.adap.tv.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 80, dns_answers_2_rdata: control-ec-local.adap.tv.akadns.net, dns_answers_3_rrname: control-ec-local.adap.tv.akadns.net, dns_answers_3_rrtype: CNAME, dns_answers_3_ttl: 29, dns_answers_3_rdata: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_grouped_CNAME_0: control.adap.tv, dns_grouped_CNAME_1: control.adap.tv.akadns.net, dns_grouped_CNAME_2: control-ec-local.adap.tv.akadns.net, dns_grouped_CNAME_3: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 32, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6103368, event_type: dns, proto: UDP, dns_type: query, dns_id: 51449, dns_rrname: vast.bp3858287.btrll.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6103376, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51449, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: vast.bp3858287.btrll.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: vast.bp3858287.btrll.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1244, dns_answers_0_rdata: geo-rtas.btrll.com, dns_answers_1_rrname: geo-rtas.btrll.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 162.208.20.178, dns_grouped_A_0: 162.208.20.178, dns_grouped_CNAME_0: geo-rtas.btrll.com ; pcap_cnt: 6334704, event_type: dns, proto: UDP, dns_type: query, dns_id: 19747, dns_rrname: a.algovid.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6334806, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19747, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a.algovid.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a.algovid.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 111, dns_answers_0_rdata: a.algovid.akadns.net, dns_answers_1_rrname: a.algovid.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 169.46.44.40, dns_grouped_CNAME_0: a.algovid.akadns.net, dns_grouped_A_0: 169.46.44.40 ; pcap_cnt: 6489488, event_type: dns, proto: UDP, dns_type: query, dns_id: 58172, dns_rrname: dmppixel.egslb.aol.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6489531, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58172, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dmppixel.egslb.aol.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: egslb.aol.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 218, dns_authorities_0_soa_mname: nsm-mtc-gslb.lb.aol.com, dns_authorities_0_soa_rname: hostmaster.aol.net, dns_authorities_0_soa_serial: 2016102701, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 3, dns_authorities_0_soa_expire: 3600, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 6531593, event_type: dns, proto: UDP, dns_type: query, dns_id: 56813, dns_rrname: www.rakuten.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6531883, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56813, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.rakuten.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.rakuten.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 602940, dns_answers_0_rdata: evsecure.rakuten.com.edgekey.net, dns_answers_1_rrname: evsecure.rakuten.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 2333, dns_answers_1_rdata: e10643.b.akamaiedge.net, dns_answers_2_rrname: e10643.b.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 18, dns_answers_2_rdata: 69.192.26.115, dns_grouped_CNAME_0: evsecure.rakuten.com.edgekey.net, dns_grouped_CNAME_1: e10643.b.akamaiedge.net, dns_grouped_A_0: 69.192.26.115 ; pcap_cnt: 6550445, event_type: dns, proto: UDP, dns_type: query, dns_id: 10267, dns_rrname: addons.mozilla.org, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 6550447, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10267, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: addons.mozilla.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: addons.mozilla.org, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: olympia.prod.mozaws.net, dns_answers_1_rrname: olympia.prod.mozaws.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 35.160.100.86, dns_answers_2_rrname: olympia.prod.mozaws.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 34.209.201.65, dns_answers_3_rrname: olympia.prod.mozaws.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 52.11.164.190, dns_grouped_CNAME_0: olympia.prod.mozaws.net, dns_grouped_A_0: 35.160.100.86, dns_grouped_A_1: 34.209.201.65, dns_grouped_A_2: 52.11.164.190 ; pcap_cnt: 6920227, event_type: dns, proto: UDP, dns_type: query, dns_id: 30708, dns_rrname: sync.1rx.io, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6920268, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30708, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sync.1rx.io, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sync.1rx.io, dns_answers_0_rrtype: A, dns_answers_0_ttl: 4, dns_answers_0_rdata: 8.41.222.241, dns_grouped_A_0: 8.41.222.241 ; pcap_cnt: 7174479, event_type: dns, proto: UDP, dns_type: query, dns_id: 5186, dns_rrname: 101.63.7.52.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7174491, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5186, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 101.63.7.52.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 101.63.7.52.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 299, dns_answers_0_rdata: ec2-52-7-63-101.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-52-7-63-101.compute-1.amazonaws.com ; pcap_cnt: 7287406, event_type: dns, proto: UDP, dns_type: query, dns_id: 2781, dns_rrname: 154.128.120.153.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7287486, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2781, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 154.128.120.153.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 128.120.153.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 796, dns_authorities_0_soa_mname: dns.sakura.ad.jp, dns_authorities_0_soa_rname: noc.sakura.ad.jp, dns_authorities_0_soa_serial: 2017070301, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 3600000, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 7412688, event_type: dns, proto: UDP, dns_type: query, dns_id: 36185, dns_rrname: trc.taboola.map.fastly.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7412706, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36185, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: trc.taboola.map.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: trc.taboola.map.fastly.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 22, dns_answers_0_rdata: 151.101.2.49, dns_answers_1_rrname: trc.taboola.map.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 22, dns_answers_1_rdata: 151.101.66.49, dns_answers_2_rrname: trc.taboola.map.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 22, dns_answers_2_rdata: 151.101.130.49, dns_answers_3_rrname: trc.taboola.map.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 22, dns_answers_3_rdata: 151.101.194.49, dns_grouped_A_0: 151.101.2.49, dns_grouped_A_1: 151.101.66.49, dns_grouped_A_2: 151.101.130.49, dns_grouped_A_3: 151.101.194.49 ; pcap_cnt: 7526313, event_type: dns, proto: UDP, dns_type: query, dns_id: 58935, dns_rrname: 176.216.71.68.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7526487, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58935, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 176.216.71.68.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 216.71.68.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 0, dns_authorities_0_soa_mname: sens01.dig.com, dns_authorities_0_soa_rname: dns-ops.dig.com, dns_authorities_0_soa_serial: 2017063000, dns_authorities_0_soa_refresh: 1200, dns_authorities_0_soa_retry: 180, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 7747476, event_type: dns, proto: UDP, dns_type: query, dns_id: 48210, dns_rrname: tt.onthe.io, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7747477, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48210, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tt.onthe.io, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: onthe.io, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 738, dns_authorities_0_soa_mname: ns-839.awsdns-40.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 7765407, event_type: dns, proto: UDP, dns_type: query, dns_id: 35242, dns_rrname: 125.68.4.46.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 2 ; pcap_cnt: 7765428, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35242, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 125.68.4.46.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 125.68.4.46.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 18189, dns_answers_0_rdata: static.125.68.4.46.clients.your-server.de, dns_grouped_PTR_0: static.125.68.4.46.clients.your-server.de ; pcap_cnt: 7810313, event_type: dns, proto: UDP, dns_type: query, dns_id: 7338, dns_rrname: control.adap.tv, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 7810362, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7338, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: control.adap.tv, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: control.adap.tv, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 24, dns_answers_0_rdata: control.adap.tv.akadns.net, dns_answers_1_rrname: control.adap.tv.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 190, dns_answers_1_rdata: control-wc-local.adap.tv.akadns.net, dns_answers_2_rrname: control-wc-local.adap.tv.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 15, dns_answers_2_rdata: ads-zone-c-1184022283.us-west-1.elb.amazonaws.com, dns_answers_3_rrname: ads-zone-c-1184022283.us-west-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 54.219.154.103, dns_answers_4_rrname: ads-zone-c-1184022283.us-west-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 54.219.137.7, dns_answers_5_rrname: ads-zone-c-1184022283.us-west-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.219.141.181, dns_answers_6_rrname: ads-zone-c-1184022283.us-west-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 54.219.150.156, dns_answers_7_rrname: ads-zone-c-1184022283.us-west-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 50.18.199.239, dns_answers_8_rrname: ads-zone-c-1184022283.us-west-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 54.219.133.241, dns_answers_9_rrname: ads-zone-c-1184022283.us-west-1.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 1, dns_answers_9_rdata: 54.241.153.60, dns_answers_10_rrname: ads-zone-c-1184022283.us-west-1.elb.amazonaws.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 1, dns_answers_10_rdata: 54.67.93.226, dns_grouped_A_0: 54.219.154.103, dns_grouped_A_1: 54.219.137.7, dns_grouped_A_2: 54.219.141.181, dns_grouped_A_3: 54.219.150.156, dns_grouped_A_4: 50.18.199.239, dns_grouped_A_5: 54.219.133.241, dns_grouped_A_6: 54.241.153.60, dns_grouped_A_7: 54.67.93.226, dns_grouped_CNAME_0: control.adap.tv.akadns.net, dns_grouped_CNAME_1: control-wc-local.adap.tv.akadns.net, dns_grouped_CNAME_2: ads-zone-c-1184022283.us-west-1.elb.amazonaws.com ; pcap_cnt: 8763375, event_type: dns, proto: UDP, dns_type: query, dns_id: 21753, dns_rrname: googleads.g.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8763402, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21753, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleads.g.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: googleads.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: pagead46.l.doubleclick.net, dns_answers_1_rrname: pagead46.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 140, dns_answers_1_rdata: 172.217.10.98, dns_grouped_A_0: 172.217.10.98, dns_grouped_CNAME_0: pagead46.l.doubleclick.net ; pcap_cnt: 8861209, event_type: dns, proto: UDP, dns_type: query, dns_id: 50263, dns_rrname: www.gstatic.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8861214, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50263, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.gstatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.gstatic.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.10.227, dns_grouped_A_0: 172.217.10.227 ; pcap_cnt: 8982917, event_type: dns, proto: UDP, dns_type: query, dns_id: 33324, dns_rrname: x.skimresources.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8982939, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33324, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: x.skimresources.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: x.skimresources.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.152.24.232, dns_answers_1_rrname: x.skimresources.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 34.225.206.80, dns_grouped_A_0: 54.152.24.232, dns_grouped_A_1: 34.225.206.80 ; pcap_cnt: 9404965, event_type: dns, proto: UDP, dns_type: query, dns_id: 40036, dns_rrname: simage2.pubmatic.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9405226, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40036, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: simage2.pubmatic.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: simage2.pubmatic.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: pug44000nc.pubmatic.com, dns_answers_1_rrname: pug44000nc.pubmatic.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 119, dns_answers_1_rdata: pug44000n.pubmatic.com, dns_grouped_CNAME_0: pug44000nc.pubmatic.com, dns_grouped_CNAME_1: pug44000n.pubmatic.com, dns_authorities_0_rrname: pubmatic.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 0, dns_authorities_0_soa_mname: ns1.p29.dynect.net, dns_authorities_0_soa_rname: anand.pubmatic.com, dns_authorities_0_soa_serial: 12705, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 9711390, event_type: dns, proto: UDP, dns_type: query, dns_id: 59546, dns_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9711451, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59546, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 16, dns_authorities_0_soa_mname: ns-699.awsdns-23.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 9954612, event_type: dns, proto: UDP, dns_type: query, dns_id: 29333, dns_rrname: blm-vip-web.ny.deezer.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9954617, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29333, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: blm-vip-web.ny.deezer.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: deezer.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 8393, dns_authorities_0_soa_mname: ns-1072.awsdns-06.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 10140014, event_type: dns, proto: UDP, dns_type: query, dns_id: 57828, dns_rrname: r53-api-vip.pbs.org, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10140015, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57828, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: r53-api-vip.pbs.org, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: pbs.org, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 130, dns_authorities_0_soa_mname: ns-855.awsdns-42.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1369402734, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 10174103, event_type: dns, proto: UDP, dns_type: query, dns_id: 7808, dns_rrname: heapanalytics.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 10174149, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7808, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: heapanalytics.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: heapanalytics.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 531, dns_authorities_0_soa_mname: ns-2009.awsdns-59.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 10271097, event_type: dns, proto: UDP, dns_type: query, dns_id: 46797, dns_rrname: googleads4.g.doubleclick.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10271160, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46797, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleads4.g.doubleclick.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: googleads4.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: pagead.l.doubleclick.net, dns_grouped_CNAME_0: pagead.l.doubleclick.net, dns_authorities_0_rrname: l.doubleclick.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 560, dns_authorities_0_soa_mname: ns2.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 160815405, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 10274714, event_type: dns, proto: UDP, dns_type: query, dns_id: 36279, dns_rrname: s2.adform.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 10274856, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36279, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s2.adform.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: s2.adform.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3015, dns_answers_0_rdata: s2.adformnet.akadns.net, dns_answers_1_rrname: s2.adformnet.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 190, dns_answers_1_rdata: s2.adform.net.cn.edgekey.net, dns_answers_2_rrname: s2.adform.net.cn.edgekey.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 13443, dns_answers_2_rdata: e7817.g.akamaiedge.net, dns_grouped_CNAME_0: s2.adformnet.akadns.net, dns_grouped_CNAME_1: s2.adform.net.cn.edgekey.net, dns_grouped_CNAME_2: e7817.g.akamaiedge.net, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 448, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499105173, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 10812128, event_type: dns, proto: UDP, dns_type: query, dns_id: 48937, dns_rrname: tutsplus.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10812133, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48937, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tutsplus.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: tutsplus.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 845, dns_authorities_0_soa_mname: jean.ns.cloudflare.com, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2022668337, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 10927575, event_type: dns, proto: UDP, dns_type: query, dns_id: 12920, dns_rrname: capture.condenastdigital.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10927581, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12920, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: capture.condenastdigital.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: capture.condenastdigital.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 34.224.92.80, dns_answers_1_rrname: capture.condenastdigital.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 54.209.123.201, dns_answers_2_rrname: capture.condenastdigital.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 34.197.164.44, dns_answers_3_rrname: capture.condenastdigital.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 54.164.83.83, dns_answers_4_rrname: capture.condenastdigital.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 52.4.232.179, dns_answers_5_rrname: capture.condenastdigital.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 34.226.236.171, dns_grouped_A_0: 34.224.92.80, dns_grouped_A_1: 54.209.123.201, dns_grouped_A_2: 34.197.164.44, dns_grouped_A_3: 54.164.83.83, dns_grouped_A_4: 52.4.232.179, dns_grouped_A_5: 34.226.236.171 ; pcap_cnt: 10958356, event_type: dns, proto: UDP, dns_type: query, dns_id: 13348, dns_rrname: bypass.ad-stir.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 10958456, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13348, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: bypass.ad-stir.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: bypass.ad-stir.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1633, dns_answers_0_rdata: bypassn-607928833.ap-northeast-1.elb.amazonaws.com, dns_answers_1_rrname: bypassn-607928833.ap-northeast-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 29, dns_answers_1_rdata: 54.249.232.254, dns_answers_2_rrname: bypassn-607928833.ap-northeast-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 29, dns_answers_2_rdata: 54.249.254.148, dns_answers_3_rrname: bypassn-607928833.ap-northeast-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 29, dns_answers_3_rdata: 54.248.104.1, dns_answers_4_rrname: bypassn-607928833.ap-northeast-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 29, dns_answers_4_rdata: 176.34.20.89, dns_answers_5_rrname: bypassn-607928833.ap-northeast-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 29, dns_answers_5_rdata: 46.51.251.34, dns_answers_6_rrname: bypassn-607928833.ap-northeast-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 29, dns_answers_6_rdata: 176.32.93.58, dns_grouped_A_0: 54.249.232.254, dns_grouped_A_1: 54.249.254.148, dns_grouped_A_2: 54.248.104.1, dns_grouped_A_3: 176.34.20.89, dns_grouped_A_4: 46.51.251.34, dns_grouped_A_5: 176.32.93.58, dns_grouped_CNAME_0: bypassn-607928833.ap-northeast-1.elb.amazonaws.com ; pcap_cnt: 11463799, event_type: dns, proto: UDP, dns_type: query, dns_id: 13057, dns_rrname: www.elcomercio.pe, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11463806, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13057, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.elcomercio.pe, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.elcomercio.pe, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 86400, dns_answers_0_rdata: elcomercio.pe, dns_grouped_CNAME_0: elcomercio.pe, dns_authorities_0_rrname: elcomercio.pe, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 300, dns_authorities_0_soa_mname: dns1.stabletransit.com, dns_authorities_0_soa_rname: ipadmin.stabletransit.com, dns_authorities_0_soa_serial: 1497904088, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 11491501, event_type: dns, proto: UDP, dns_type: query, dns_id: 25097, dns_rrname: d1o1v4alhgrqng.cloudfront.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 11491529, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25097, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d1o1v4alhgrqng.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d1o1v4alhgrqng.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.192.37.121, dns_answers_1_rrname: d1o1v4alhgrqng.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 54.192.37.217, dns_answers_2_rrname: d1o1v4alhgrqng.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 54.192.37.141, dns_answers_3_rrname: d1o1v4alhgrqng.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 54.192.37.237, dns_answers_4_rrname: d1o1v4alhgrqng.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 54.192.37.35, dns_answers_5_rrname: d1o1v4alhgrqng.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.192.37.87, dns_answers_6_rrname: d1o1v4alhgrqng.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 54.192.37.26, dns_answers_7_rrname: d1o1v4alhgrqng.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 54.192.37.231, dns_grouped_A_0: 54.192.37.121, dns_grouped_A_1: 54.192.37.217, dns_grouped_A_2: 54.192.37.141, dns_grouped_A_3: 54.192.37.237, dns_grouped_A_4: 54.192.37.35, dns_grouped_A_5: 54.192.37.87, dns_grouped_A_6: 54.192.37.26, dns_grouped_A_7: 54.192.37.231 ; pcap_cnt: 11579536, event_type: dns, proto: UDP, dns_type: query, dns_id: 61423, dns_rrname: ocsp.usertrust.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11579560, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61423, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.usertrust.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.usertrust.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 178.255.83.1, dns_grouped_A_0: 178.255.83.1
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.