['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61140, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 178, flow_bytes_toclient: 300, flow_age: 22, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 235, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 189, flow_bytes_toclient: 316, flow_age: 30, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 145, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 367, flow_bytes_toclient: 768, flow_age: 258, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 109, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 109, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 180, flow_bytes_toclient: 319, flow_age: 155, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 110, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 135, flow_bytes_toclient: 217, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 138, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 102, flow_bytes_toclient: 118, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 154, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 103, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 232, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 196, flow_bytes_toclient: 315, flow_age: 41, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 207, flow_bytes_toclient: 330, flow_age: 62, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 109, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 107, flow_bytes_toclient: 230, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 155, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 203, flow_bytes_toclient: 401, flow_age: 156, flow_state: established, flow_reason: shutdown ; pcap_cnt: 2913156, event_type: dns, proto: UDP, dns_type: query, dns_id: 36168, dns_rrname: www.verizonwireless.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2913163, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36168, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.verizonwireless.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.verizonwireless.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 162.115.210.200, dns_grouped_A_0: 162.115.210.200 ; pcap_cnt: 2924715, event_type: dns, proto: UDP, dns_type: query, dns_id: 31614, dns_rrname: js.revsci.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 2924898, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31614, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: js.revsci.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: js.revsci.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 10876, dns_answers_0_rdata: pix-geo.revsci.net, dns_grouped_CNAME_0: pix-geo.revsci.net, dns_authorities_0_rrname: revsci.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1, dns_authorities_0_soa_mname: ns1.p16.dynect.net, dns_authorities_0_soa_rname: admincontact.audiencesscience.com, dns_authorities_0_soa_serial: 2009054348, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 3525284, event_type: dns, proto: UDP, dns_type: query, dns_id: 17124, dns_rrname: prodimage.images-bn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3525380, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17124, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: prodimage.images-bn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: prodimage.images-bn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 6, dns_answers_0_rdata: prodimage.images-bn.com.edgekey.net, dns_answers_1_rrname: prodimage.images-bn.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 21506, dns_answers_1_rdata: e11586.a.akamaiedge.net, dns_grouped_CNAME_0: prodimage.images-bn.com.edgekey.net, dns_grouped_CNAME_1: e11586.a.akamaiedge.net, dns_authorities_0_rrname: a.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 384, dns_authorities_0_soa_mname: n0a.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499344636, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 3609735, event_type: dns, proto: UDP, dns_type: query, dns_id: 12386, dns_rrname: a1095.g.akamai.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3609736, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12386, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a1095.g.akamai.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamai.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 595, dns_authorities_0_soa_mname: n0g.akamai.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499345032, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 3618236, event_type: dns, proto: UDP, dns_type: query, dns_id: 30425, dns_rrname: track-us.adformnet.akadns.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 3618237, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30425, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: track-us.adformnet.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 179, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499345592, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 3857598, event_type: dns, proto: UDP, dns_type: query, dns_id: 32367, dns_rrname: www.tahrirnews.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3857611, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32367, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.tahrirnews.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.tahrirnews.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2400:cb00:2048:0001:0000:0000:681c:1e6e, dns_answers_1_rrname: www.tahrirnews.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 299, dns_answers_1_rdata: 2400:cb00:2048:0001:0000:0000:681c:1f6e, dns_grouped_AAAA_0: 2400:cb00:2048:0001:0000:0000:681c:1e6e, dns_grouped_AAAA_1: 2400:cb00:2048:0001:0000:0000:681c:1f6e ; pcap_cnt: 4026619, event_type: dns, proto: UDP, dns_type: query, dns_id: 55885, dns_rrname: content.quantserve.com.edgekey.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4026718, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55885, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: content.quantserve.com.edgekey.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: content.quantserve.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 19588, dns_answers_0_rdata: e2216.g.akamaiedge.net, dns_grouped_CNAME_0: e2216.g.akamaiedge.net, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499346919, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 4050009, event_type: dns, proto: UDP, dns_type: query, dns_id: 60654, dns_rrname: www.tabnakgilan.ir, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 4050024, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60654, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.tabnakgilan.ir, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.tabnakgilan.ir, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 345599, dns_answers_0_rdata: tabnakgilan.ir, dns_grouped_CNAME_0: tabnakgilan.ir, dns_authorities_0_rrname: tabnakgilan.ir, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 345599, dns_authorities_0_soa_mname: ns1.iransamaneh.com, dns_authorities_0_soa_rname: admin.iransamaneh.com, dns_authorities_0_soa_serial: 2016022600, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 345600 ; pcap_cnt: 4062602, event_type: dns, proto: UDP, dns_type: query, dns_id: 33896, dns_rrname: sync.go.sonobi.com, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 4062616, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33896, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sync.go.sonobi.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sync.go.sonobi.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 92, dns_answers_0_rdata: iad-2-sync.go.sonobi.com, dns_answers_1_rrname: iad-2-sync.go.sonobi.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 224, dns_answers_1_rdata: 69.166.1.10, dns_grouped_CNAME_0: iad-2-sync.go.sonobi.com, dns_grouped_A_0: 69.166.1.10 ; pcap_cnt: 4096329, event_type: dns, proto: UDP, dns_type: query, dns_id: 37429, dns_rrname: data.agkn.com, dns_rrtype: A, dns_tx_id: 6 ; pcap_cnt: 4096471, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37429, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: data.agkn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: data.agkn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 55, dns_answers_0_rdata: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 52.45.219.8, dns_answers_2_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 54.165.184.234, dns_answers_3_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 52.44.215.252, dns_answers_4_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 52.71.92.11, dns_answers_5_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 52.6.121.107, dns_answers_6_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 52.6.25.230, dns_answers_7_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 52.71.184.177, dns_answers_8_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 52.87.30.187, dns_grouped_A_0: 52.45.219.8, dns_grouped_A_1: 54.165.184.234, dns_grouped_A_2: 52.44.215.252, dns_grouped_A_3: 52.71.92.11, dns_grouped_A_4: 52.6.121.107, dns_grouped_A_5: 52.6.25.230, dns_grouped_A_6: 52.71.184.177, dns_grouped_A_7: 52.87.30.187, dns_grouped_CNAME_0: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com ; pcap_cnt: 4206367, event_type: dns, proto: UDP, dns_type: query, dns_id: 42895, dns_rrname: e8037.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4206404, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42895, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e8037.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e8037.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 23.195.253.183, dns_grouped_A_0: 23.195.253.183 ; pcap_cnt: 4419707, event_type: dns, proto: UDP, dns_type: query, dns_id: 31416, dns_rrname: tag.yieldoptimizer.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4419750, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31416, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tag.yieldoptimizer.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tag.yieldoptimizer.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1301, dns_answers_0_rdata: 68.67.154.70, dns_grouped_A_0: 68.67.154.70 ; pcap_cnt: 4625629, event_type: dns, proto: UDP, dns_type: query, dns_id: 40245, dns_rrname: www.mykiosk.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4625638, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40245, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.mykiosk.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: mykiosk.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1799, dns_authorities_0_soa_mname: pns.conceptnet.com, dns_authorities_0_soa_rname: hostmaster.conceptnet.de, dns_authorities_0_soa_serial: 2017013101, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 4679147, event_type: dns, proto: UDP, dns_type: query, dns_id: 8759, dns_rrname: cms.analytics.yahoo.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 4679237, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 8759, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cms.analytics.yahoo.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cms.analytics.yahoo.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 57, dns_answers_0_rdata: spcms-global.pbp.gysm.yahoodns.net, dns_answers_1_rrname: spcms-global.pbp.gysm.yahoodns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 126, dns_answers_1_rdata: 72.30.202.150, dns_grouped_A_0: 72.30.202.150, dns_grouped_CNAME_0: spcms-global.pbp.gysm.yahoodns.net ; pcap_cnt: 5130410, event_type: dns, proto: UDP, dns_type: query, dns_id: 40229, dns_rrname: e1879.e7.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5130428, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40229, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e1879.e7.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e1879.e7.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 8, dns_answers_0_rdata: 184.30.4.121, dns_grouped_A_0: 184.30.4.121 ; pcap_cnt: 5860396, event_type: dns, proto: UDP, dns_type: query, dns_id: 17789, dns_rrname: adserver-useast-haproxy02-2085308329.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5860447, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17789, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adserver-useast-haproxy02-2085308329.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 40, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6020854, event_type: dns, proto: UDP, dns_type: query, dns_id: 9214, dns_rrname: googleads4.g.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6020866, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9214, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleads4.g.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: googleads4.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 9, dns_answers_0_rdata: pagead.l.doubleclick.net, dns_answers_1_rrname: pagead.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 265, dns_answers_1_rdata: 172.217.9.226, dns_grouped_CNAME_0: pagead.l.doubleclick.net, dns_grouped_A_0: 172.217.9.226 ; pcap_cnt: 6630150, event_type: dns, proto: UDP, dns_type: query, dns_id: 41687, dns_rrname: rec.mouseflowaps.netdna-cdn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6630158, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41687, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rec.mouseflowaps.netdna-cdn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: rec.mouseflowaps.netdna-cdn.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 198.232.125.23, dns_grouped_A_0: 198.232.125.23 ; pcap_cnt: 6907106, event_type: dns, proto: UDP, dns_type: query, dns_id: 50850, dns_rrname: p.skimresources.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6907172, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50850, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: p.skimresources.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: p.skimresources.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 54.209.201.101, dns_answers_1_rrname: p.skimresources.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 34.227.128.119, dns_answers_2_rrname: p.skimresources.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.203.233.41, dns_answers_3_rrname: p.skimresources.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 34.224.179.209, dns_grouped_A_0: 54.209.201.101, dns_grouped_A_1: 34.227.128.119, dns_grouped_A_2: 52.203.233.41, dns_grouped_A_3: 34.224.179.209 ; pcap_cnt: 7542463, event_type: dns, proto: UDP, dns_type: query, dns_id: 58535, dns_rrname: geo-um.btrll.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7542493, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58535, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: geo-um.btrll.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: geo-um.btrll.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 20, dns_answers_0_rdata: 162.208.20.184, dns_grouped_A_0: 162.208.20.184 ; pcap_cnt: 7916394, event_type: dns, proto: UDP, dns_type: query, dns_id: 53714, dns_rrname: www.toysrus.co.uk, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7916504, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53714, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.toysrus.co.uk, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.toysrus.co.uk, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 300, dns_answers_0_rdata: webstoreprod.toysrus.com.edgekey.net, dns_answers_1_rrname: webstoreprod.toysrus.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 14913, dns_answers_1_rdata: e2003.x.akamaiedge.net, dns_grouped_CNAME_0: webstoreprod.toysrus.com.edgekey.net, dns_grouped_CNAME_1: e2003.x.akamaiedge.net, dns_authorities_0_rrname: x.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1000, dns_authorities_0_soa_mname: n0x.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499365232, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 8012036, event_type: dns, proto: UDP, dns_type: query, dns_id: 19552, dns_rrname: anycast.fw.adsafeprotected.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8012037, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19552, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: anycast.fw.adsafeprotected.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adsafeprotected.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 30, dns_authorities_0_soa_mname: dns1.p05.nsone.net, dns_authorities_0_soa_rname: hostmaster.nsone.net, dns_authorities_0_soa_serial: 1497564449, dns_authorities_0_soa_refresh: 180, dns_authorities_0_soa_retry: 180, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 7200 ; pcap_cnt: 8024245, event_type: dns, proto: UDP, dns_type: query, dns_id: 8113, dns_rrname: pbtngx-u-b-ds.nuggad.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 8024255, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 8113, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pbtngx-u-b-ds.nuggad.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: pbtngx-u-b-ds.nuggad.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 111, dns_answers_0_rdata: pbtngx-u-ds.nuggad.net, dns_answers_1_rrname: pbtngx-u-ds.nuggad.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 1762, dns_answers_1_rdata: 2a00:0cd0:1005:0002:0080:0082:0201:0080, dns_grouped_CNAME_0: pbtngx-u-ds.nuggad.net, dns_grouped_AAAA_0: 2a00:0cd0:1005:0002:0080:0082:0201:0080 ; pcap_cnt: 8527950, event_type: dns, proto: UDP, dns_type: query, dns_id: 21834, dns_rrname: googleads.g.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8527975, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21834, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleads.g.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: googleads.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 228, dns_answers_0_rdata: pagead46.l.doubleclick.net, dns_answers_1_rrname: pagead46.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 172.217.12.162, dns_grouped_CNAME_0: pagead46.l.doubleclick.net, dns_grouped_A_0: 172.217.12.162 ; pcap_cnt: 8537315, event_type: dns, proto: UDP, dns_type: query, dns_id: 4634, dns_rrname: balrog-aus5.r53-2.services.mozilla.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 8537317, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4634, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: balrog-aus5.r53-2.services.mozilla.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: r53-2.services.mozilla.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 48, dns_authorities_0_soa_mname: ns-1507.awsdns-60.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8646371, event_type: dns, proto: UDP, dns_type: query, dns_id: 30281, dns_rrname: e7341.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8646372, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30281, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e7341.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e7341.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 23.194.140.89, dns_grouped_A_0: 23.194.140.89 ; pcap_cnt: 8972452, event_type: dns, proto: UDP, dns_type: query, dns_id: 17389, dns_rrname: cdn.account.microsoft.com.akadns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8972767, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17389, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.account.microsoft.com.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.account.microsoft.com.akadns.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: mem.gfx.ms.edgekey.net, dns_answers_1_rrname: mem.gfx.ms.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 564, dns_answers_1_rdata: e55.dspb.akamaiedge.net, dns_answers_2_rrname: e55.dspb.akamaiedge.net, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 19, dns_answers_2_rdata: 2001:0418:143c:0195:0000:0000:0000:0037, dns_answers_3_rrname: e55.dspb.akamaiedge.net, dns_answers_3_rrtype: AAAA, dns_answers_3_ttl: 19, dns_answers_3_rdata: 2001:0418:143c:019f:0000:0000:0000:0037, dns_grouped_AAAA_0: 2001:0418:143c:0195:0000:0000:0000:0037, dns_grouped_AAAA_1: 2001:0418:143c:019f:0000:0000:0000:0037, dns_grouped_CNAME_0: mem.gfx.ms.edgekey.net, dns_grouped_CNAME_1: e55.dspb.akamaiedge.net ; pcap_cnt: 9205850, event_type: dns, proto: UDP, dns_type: query, dns_id: 52607, dns_rrname: image2.pubmatic.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9205970, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52607, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: image2.pubmatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: image2.pubmatic.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 71, dns_answers_0_rdata: pug33000nc.pubmatic.com, dns_answers_1_rrname: pug33000nc.pubmatic.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 60, dns_answers_1_rdata: pug33000n.pubmatic.com, dns_answers_2_rrname: pug33000n.pubmatic.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 163, dns_answers_2_rdata: 162.248.16.28, dns_grouped_A_0: 162.248.16.28, dns_grouped_CNAME_0: pug33000nc.pubmatic.com, dns_grouped_CNAME_1: pug33000n.pubmatic.com ; pcap_cnt: 9263991, event_type: dns, proto: UDP, dns_type: query, dns_id: 37692, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9263996, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37692, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 0, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 11, dns_answers_1_rdata: 2001:0418:143c:018b:0000:0000:0000:201a, dns_answers_2_rrname: e8218.dscb1.akamaiedge.net, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 11, dns_answers_2_rdata: 2001:0418:143c:0180:0000:0000:0000:201a, dns_grouped_AAAA_0: 2001:0418:143c:018b:0000:0000:0000:201a, dns_grouped_AAAA_1: 2001:0418:143c:0180:0000:0000:0000:201a, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net ; pcap_cnt: 9301377, event_type: dns, proto: UDP, dns_type: query, dns_id: 16509, dns_rrname: c4static-lw001.xcdnpro.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 9301458, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16509, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: c4static-lw001.xcdnpro.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: c4static-lw001.xcdnpro.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 85786, dns_answers_0_rdata: 802f8536ef2695304cfbc736e3765306.lswcdn.net, dns_answers_1_rrname: 802f8536ef2695304cfbc736e3765306.lswcdn.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 89.255.249.53, dns_answers_2_rrname: 802f8536ef2695304cfbc736e3765306.lswcdn.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 89.255.249.54, dns_answers_3_rrname: 802f8536ef2695304cfbc736e3765306.lswcdn.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 89.255.249.55, dns_grouped_A_0: 89.255.249.53, dns_grouped_A_1: 89.255.249.54, dns_grouped_A_2: 89.255.249.55, dns_grouped_CNAME_0: 802f8536ef2695304cfbc736e3765306.lswcdn.net
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.