['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61018, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 228, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 120, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 204, flow_bytes_toclient: 372, flow_age: 98, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 136, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 180, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 199, flow_bytes_toclient: 282, flow_age: 122, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 173, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 155, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 226, flow_bytes_toclient: 315, flow_age: 72, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 120, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 232, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 131, flow_bytes_toclient: 209, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 147, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 267, flow_bytes_toclient: 648, flow_age: 276, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 217, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 384, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 176, flow_bytes_toclient: 265, flow_age: 64, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 194, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 136, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 183, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 137, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 841782, event_type: dns, proto: UDP, dns_type: query, dns_id: 42092, dns_rrname: d1z2jf7jlzjs58.cloudfront.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 842176, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42092, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d1z2jf7jlzjs58.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d1z2jf7jlzjs58.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 52.84.143.130, dns_answers_1_rrname: d1z2jf7jlzjs58.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.143.5, dns_answers_2_rrname: d1z2jf7jlzjs58.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.143.204, dns_answers_3_rrname: d1z2jf7jlzjs58.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.143.28, dns_answers_4_rrname: d1z2jf7jlzjs58.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.143.196, dns_answers_5_rrname: d1z2jf7jlzjs58.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.143.170, dns_answers_6_rrname: d1z2jf7jlzjs58.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.143.110, dns_answers_7_rrname: d1z2jf7jlzjs58.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.143.59, dns_grouped_A_0: 52.84.143.130, dns_grouped_A_1: 52.84.143.5, dns_grouped_A_2: 52.84.143.204, dns_grouped_A_3: 52.84.143.28, dns_grouped_A_4: 52.84.143.196, dns_grouped_A_5: 52.84.143.170, dns_grouped_A_6: 52.84.143.110, dns_grouped_A_7: 52.84.143.59 ; pcap_cnt: 3027700, event_type: dns, proto: UDP, dns_type: query, dns_id: 22902, dns_rrname: a121.g.akamai.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3027751, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22902, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a121.g.akamai.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a121.g.akamai.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 19, dns_answers_0_rdata: 23.15.4.18, dns_answers_1_rrname: a121.g.akamai.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 19, dns_answers_1_rdata: 23.15.4.8, dns_grouped_A_0: 23.15.4.18, dns_grouped_A_1: 23.15.4.8 ; pcap_cnt: 3490120, event_type: dns, proto: UDP, dns_type: query, dns_id: 28503, dns_rrname: www.tut.by, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3490145, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28503, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.tut.by, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.tut.by, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 293, dns_answers_0_rdata: cluster.tut.by, dns_answers_1_rrname: cluster.tut.by, dns_answers_1_rrtype: A, dns_answers_1_ttl: 291, dns_answers_1_rdata: 178.172.160.4, dns_answers_2_rrname: cluster.tut.by, dns_answers_2_rrtype: A, dns_answers_2_ttl: 291, dns_answers_2_rdata: 178.172.160.5, dns_answers_3_rrname: cluster.tut.by, dns_answers_3_rrtype: A, dns_answers_3_ttl: 291, dns_answers_3_rdata: 178.172.160.2, dns_answers_4_rrname: cluster.tut.by, dns_answers_4_rrtype: A, dns_answers_4_ttl: 291, dns_answers_4_rdata: 178.172.160.3, dns_grouped_A_0: 178.172.160.4, dns_grouped_A_1: 178.172.160.5, dns_grouped_A_2: 178.172.160.2, dns_grouped_A_3: 178.172.160.3, dns_grouped_CNAME_0: cluster.tut.by ; pcap_cnt: 3512675, event_type: dns, proto: UDP, dns_type: query, dns_id: 28602, dns_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 3512676, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28602, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 45, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 3909818, event_type: dns, proto: UDP, dns_type: query, dns_id: 62112, dns_rrname: com-carscom.netmng.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3909920, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62112, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: com-carscom.netmng.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: com-carscom.netmng.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2879, dns_answers_0_rdata: lb-02_us-wdc.netmng.com, dns_answers_1_rrname: lb-02_us-wdc.netmng.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 104.193.82.55, dns_grouped_A_0: 104.193.82.55, dns_grouped_CNAME_0: lb-02_us-wdc.netmng.com ; pcap_cnt: 4271193, event_type: dns, proto: UDP, dns_type: query, dns_id: 62610, dns_rrname: rtb.kubnt.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4271232, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62610, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rtb.kubnt.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: rtb.kubnt.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 52.207.63.53, dns_answers_1_rrname: rtb.kubnt.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.54.236.150, dns_answers_2_rrname: rtb.kubnt.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.21.84.47, dns_answers_3_rrname: rtb.kubnt.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 34.199.20.76, dns_answers_4_rrname: rtb.kubnt.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 54.210.235.192, dns_answers_5_rrname: rtb.kubnt.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 54.85.75.181, dns_grouped_A_0: 52.207.63.53, dns_grouped_A_1: 52.54.236.150, dns_grouped_A_2: 52.21.84.47, dns_grouped_A_3: 34.199.20.76, dns_grouped_A_4: 54.210.235.192, dns_grouped_A_5: 54.85.75.181 ; pcap_cnt: 4499139, event_type: dns, proto: UDP, dns_type: query, dns_id: 2350, dns_rrname: 174.87.173.54.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 4499173, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2350, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 174.87.173.54.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 174.87.173.54.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 81, dns_answers_0_rdata: ec2-54-173-87-174.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-54-173-87-174.compute-1.amazonaws.com ; pcap_cnt: 4549661, event_type: dns, proto: UDP, dns_type: query, dns_id: 21462, dns_rrname: safebrowsing.cache.l.google.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 4549713, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21462, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: safebrowsing.cache.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: safebrowsing.cache.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:0811:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0811:0000:0000:0000:200e ; pcap_cnt: 4720016, event_type: dns, proto: UDP, dns_type: query, dns_id: 31990, dns_rrname: pbs.twimg.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4720050, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31990, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pbs.twimg.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: pbs.twimg.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 150, dns_answers_0_rdata: wildcard.twimg.com, dns_grouped_CNAME_0: wildcard.twimg.com, dns_authorities_0_rrname: twimg.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1, dns_authorities_0_soa_mname: ns1.p26.dynect.net, dns_authorities_0_soa_rname: ops.twitter.com, dns_authorities_0_soa_serial: 195220, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 4823731, event_type: dns, proto: UDP, dns_type: query, dns_id: 57518, dns_rrname: video-tub-ru.yandex.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4823746, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57518, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: video-tub-ru.yandex.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: video-tub-ru.yandex.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 440, dns_answers_0_rdata: video-tub.yandex.ru, dns_answers_1_rrname: video-tub.yandex.ru, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 122, dns_answers_1_rdata: 2a02:06b8:0000:0000:0000:0000:0000:0101, dns_grouped_AAAA_0: 2a02:06b8:0000:0000:0000:0000:0000:0101, dns_grouped_CNAME_0: video-tub.yandex.ru ; pcap_cnt: 4986210, event_type: dns, proto: UDP, dns_type: query, dns_id: 32903, dns_rrname: pastebin.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4986212, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32903, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pastebin.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pastebin.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 104.20.209.21, dns_answers_1_rrname: pastebin.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 104.20.208.21, dns_grouped_A_0: 104.20.209.21, dns_grouped_A_1: 104.20.208.21 ; pcap_cnt: 5011408, event_type: dns, proto: UDP, dns_type: query, dns_id: 35702, dns_rrname: p4-d7274le6ftrhc-duiiknpyiujmom54-996719-s1-v6exp3-v4.metric.gstatic.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 5011417, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35702, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: p4-d7274le6ftrhc-duiiknpyiujmom54-996719-s1-v6exp3-v4.metric.gstatic.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: gstatic.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 584, dns_authorities_0_soa_mname: ns3.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 161179285, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5286542, event_type: dns, proto: UDP, dns_type: query, dns_id: 20728, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5286556, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20728, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: scontent.xx.fbcdn.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 38, dns_answers_0_rdata: 2a03:2880:f027:0018:face:b00c:0000:0003, dns_grouped_AAAA_0: 2a03:2880:f027:0018:face:b00c:0000:0003 ; pcap_cnt: 5531239, event_type: dns, proto: UDP, dns_type: query, dns_id: 72, dns_rrname: cdn.globalsigncdn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5531270, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 72, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.globalsigncdn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.globalsigncdn.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2400:cb00:2048:0001:0000:0000:6810:1bd8, dns_answers_1_rrname: cdn.globalsigncdn.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 299, dns_answers_1_rdata: 2400:cb00:2048:0001:0000:0000:6810:18d8, dns_answers_2_rrname: cdn.globalsigncdn.com, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 299, dns_answers_2_rdata: 2400:cb00:2048:0001:0000:0000:6810:1cd8, dns_answers_3_rrname: cdn.globalsigncdn.com, dns_answers_3_rrtype: AAAA, dns_answers_3_ttl: 299, dns_answers_3_rdata: 2400:cb00:2048:0001:0000:0000:6810:1ad8, dns_answers_4_rrname: cdn.globalsigncdn.com, dns_answers_4_rrtype: AAAA, dns_answers_4_ttl: 299, dns_answers_4_rdata: 2400:cb00:2048:0001:0000:0000:6810:19d8, dns_grouped_AAAA_0: 2400:cb00:2048:0001:0000:0000:6810:1bd8, dns_grouped_AAAA_1: 2400:cb00:2048:0001:0000:0000:6810:18d8, dns_grouped_AAAA_2: 2400:cb00:2048:0001:0000:0000:6810:1cd8, dns_grouped_AAAA_3: 2400:cb00:2048:0001:0000:0000:6810:1ad8, dns_grouped_AAAA_4: 2400:cb00:2048:0001:0000:0000:6810:19d8 ; pcap_cnt: 5567919, event_type: dns, proto: UDP, dns_type: query, dns_id: 61732, dns_rrname: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5567924, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61732, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-2.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 36, dns_authorities_0_soa_mname: ns-332.awsdns-41.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5710730, event_type: dns, proto: UDP, dns_type: query, dns_id: 10993, dns_rrname: eu-u.openx.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5710736, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10993, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: eu-u.openx.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: openx.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 266, dns_authorities_0_soa_mname: dns1.p04.nsone.net, dns_authorities_0_soa_rname: hostmaster.nsone.net, dns_authorities_0_soa_serial: 1499394995, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 6006959, event_type: dns, proto: UDP, dns_type: query, dns_id: 21641, dns_rrname: wetteronline-d.openx.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6007016, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21641, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: wetteronline-d.openx.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: openx.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1799, dns_authorities_0_soa_mname: dns1.p04.nsone.net, dns_authorities_0_soa_rname: hostmaster.nsone.net, dns_authorities_0_soa_serial: 1499394995, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 6076066, event_type: dns, proto: UDP, dns_type: query, dns_id: 12608, dns_rrname: sdk.streamrail.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6076130, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12608, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sdk.streamrail.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sdk.streamrail.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 234, dns_answers_0_rdata: d3o49rridkfcxi.cloudfront.net, dns_answers_1_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.145.206, dns_answers_2_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.145.111, dns_answers_3_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.145.83, dns_answers_4_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.145.216, dns_answers_5_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.145.199, dns_answers_6_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.145.142, dns_answers_7_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.145.198, dns_answers_8_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 59, dns_answers_8_rdata: 52.84.145.26, dns_grouped_A_0: 52.84.145.206, dns_grouped_A_1: 52.84.145.111, dns_grouped_A_2: 52.84.145.83, dns_grouped_A_3: 52.84.145.216, dns_grouped_A_4: 52.84.145.199, dns_grouped_A_5: 52.84.145.142, dns_grouped_A_6: 52.84.145.198, dns_grouped_A_7: 52.84.145.26, dns_grouped_CNAME_0: d3o49rridkfcxi.cloudfront.net ; pcap_cnt: 6142754, event_type: dns, proto: UDP, dns_type: query, dns_id: 12338, dns_rrname: cdn.mgid.com, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 6142806, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12338, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.mgid.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.mgid.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3230, dns_answers_0_rdata: a3-10444-so.ssl.cdn13.com, dns_answers_1_rrname: a3-10444-so.ssl.cdn13.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 179, dns_answers_1_rdata: 204.155.145.198, dns_answers_2_rrname: a3-10444-so.ssl.cdn13.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 179, dns_answers_2_rdata: 206.54.174.7, dns_answers_3_rrname: a3-10444-so.ssl.cdn13.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 179, dns_answers_3_rdata: 204.155.145.214, dns_answers_4_rrname: a3-10444-so.ssl.cdn13.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 179, dns_answers_4_rdata: 204.155.145.215, dns_answers_5_rrname: a3-10444-so.ssl.cdn13.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 179, dns_answers_5_rdata: 204.155.145.200, dns_answers_6_rrname: a3-10444-so.ssl.cdn13.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 179, dns_answers_6_rdata: 204.155.145.199, dns_answers_7_rrname: a3-10444-so.ssl.cdn13.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 179, dns_answers_7_rdata: 204.155.148.113, dns_grouped_CNAME_0: a3-10444-so.ssl.cdn13.com, dns_grouped_A_0: 204.155.145.198, dns_grouped_A_1: 206.54.174.7, dns_grouped_A_2: 204.155.145.214, dns_grouped_A_3: 204.155.145.215, dns_grouped_A_4: 204.155.145.200, dns_grouped_A_5: 204.155.145.199, dns_grouped_A_6: 204.155.148.113 ; pcap_cnt: 6220897, event_type: dns, proto: UDP, dns_type: query, dns_id: 24247, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6220899, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24247, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ping.chartbeat.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.197.255.253, dns_answers_1_rrname: ping.chartbeat.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 54.221.250.240, dns_answers_2_rrname: ping.chartbeat.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 50.19.83.4, dns_answers_3_rrname: ping.chartbeat.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 54.225.179.152, dns_answers_4_rrname: ping.chartbeat.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 23.23.170.207, dns_answers_5_rrname: ping.chartbeat.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.225.163.44, dns_answers_6_rrname: ping.chartbeat.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 54.225.147.154, dns_answers_7_rrname: ping.chartbeat.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 50.16.197.102, dns_grouped_A_0: 54.197.255.253, dns_grouped_A_1: 54.221.250.240, dns_grouped_A_2: 50.19.83.4, dns_grouped_A_3: 54.225.179.152, dns_grouped_A_4: 23.23.170.207, dns_grouped_A_5: 54.225.163.44, dns_grouped_A_6: 54.225.147.154, dns_grouped_A_7: 50.16.197.102 ; pcap_cnt: 6249766, event_type: dns, proto: UDP, dns_type: query, dns_id: 7599, dns_rrname: ads.adaptv.advertising.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6249825, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7599, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ads.adaptv.advertising.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ads.adaptv.advertising.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: control.adap.tv, dns_answers_1_rrname: control.adap.tv, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 1, dns_answers_1_rdata: control.adap.tv.akadns.net, dns_answers_2_rrname: control.adap.tv.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 1, dns_answers_2_rdata: control-ec-local.adap.tv.akadns.net, dns_answers_3_rrname: control-ec-local.adap.tv.akadns.net, dns_answers_3_rrtype: CNAME, dns_answers_3_ttl: 1, dns_answers_3_rdata: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_4_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 34.194.130.192, dns_answers_5_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 52.0.71.156, dns_answers_6_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 52.1.98.83, dns_answers_7_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 34.195.74.24, dns_answers_8_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 54.87.255.179, dns_answers_9_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 1, dns_answers_9_rdata: 52.0.229.16, dns_answers_10_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 1, dns_answers_10_rdata: 52.2.15.203, dns_answers_11_rrname: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_answers_11_rrtype: A, dns_answers_11_ttl: 1, dns_answers_11_rdata: 52.0.146.142, dns_grouped_CNAME_0: control.adap.tv, dns_grouped_CNAME_1: control.adap.tv.akadns.net, dns_grouped_CNAME_2: control-ec-local.adap.tv.akadns.net, dns_grouped_CNAME_3: ads-zone-b-486611221.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 34.194.130.192, dns_grouped_A_1: 52.0.71.156, dns_grouped_A_2: 52.1.98.83, dns_grouped_A_3: 34.195.74.24, dns_grouped_A_4: 54.87.255.179, dns_grouped_A_5: 52.0.229.16, dns_grouped_A_6: 52.2.15.203, dns_grouped_A_7: 52.0.146.142 ; pcap_cnt: 6497017, event_type: dns, proto: UDP, dns_type: query, dns_id: 52254, dns_rrname: a221.g.akamai.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6497045, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52254, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a221.g.akamai.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamai.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 999, dns_authorities_0_soa_mname: n0g.akamai.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499447328, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 6508039, event_type: dns, proto: UDP, dns_type: query, dns_id: 39874, dns_rrname: ocsp.comodoca.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 6508085, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 39874, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.comodoca.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.comodoca.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 134, dns_answers_0_rdata: 2a02:1788:02fd:0000:0000:0000:b2ff:5301, dns_grouped_AAAA_0: 2a02:1788:02fd:0000:0000:0000:b2ff:5301 ; pcap_cnt: 6645746, event_type: dns, proto: UDP, dns_type: query, dns_id: 28711, dns_rrname: icode.renren.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6645796, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28711, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: icode.renren.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: icode.renren.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 305, dns_answers_0_rdata: x3.l.xiaonei.com, dns_answers_1_rrname: x3.l.xiaonei.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 898, dns_answers_1_rdata: a.l.xiaonei.com, dns_grouped_CNAME_0: x3.l.xiaonei.com, dns_grouped_CNAME_1: a.l.xiaonei.com, dns_authorities_0_rrname: xiaonei.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 88, dns_authorities_0_soa_mname: ns1.5q.com, dns_authorities_0_soa_rname: jiafu.wei.renren-inc.com, dns_authorities_0_soa_serial: 2017052408, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 6966719, event_type: dns, proto: UDP, dns_type: query, dns_id: 16274, dns_rrname: east.um.simpli.fi, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6966756, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16274, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: east.um.simpli.fi, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: east.um.simpli.fi, dns_answers_0_rrtype: A, dns_answers_0_ttl: 19, dns_answers_0_rdata: 169.60.66.35, dns_answers_1_rrname: east.um.simpli.fi, dns_answers_1_rrtype: A, dns_answers_1_ttl: 19, dns_answers_1_rdata: 169.60.66.39, dns_answers_2_rrname: east.um.simpli.fi, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 169.60.66.38, dns_grouped_A_0: 169.60.66.35, dns_grouped_A_1: 169.60.66.39, dns_grouped_A_2: 169.60.66.38 ; pcap_cnt: 7404404, event_type: dns, proto: UDP, dns_type: query, dns_id: 20999, dns_rrname: cdn.tt.omtrdc.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7404469, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20999, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.tt.omtrdc.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.tt.omtrdc.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 483, dns_answers_0_rdata: wildcard.tt.omtrdc.net.edgekey.net, dns_answers_1_rrname: wildcard.tt.omtrdc.net.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 14186, dns_answers_1_rdata: e10231.g.akamaiedge.net, dns_answers_2_rrname: e10231.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 96.16.161.54, dns_grouped_A_0: 96.16.161.54, dns_grouped_CNAME_0: wildcard.tt.omtrdc.net.edgekey.net, dns_grouped_CNAME_1: e10231.g.akamaiedge.net ; pcap_cnt: 9899446, event_type: dns, proto: UDP, dns_type: query, dns_id: 38884, dns_rrname: dalton.orf.at, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9899447, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38884, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dalton.orf.at, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: orf.at, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 27068, dns_authorities_0_soa_mname: ns1.apa.at, dns_authorities_0_soa_rname: netadmin.orf.at, dns_authorities_0_soa_serial: 2017062901, dns_authorities_0_soa_refresh: 14400, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.