['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 62123, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 80, flow_bytes_toclient: 141, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 183, flow_bytes_toclient: 391, flow_age: 137, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 298, flow_bytes_toclient: 488, flow_age: 211, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 104, flow_bytes_toclient: 132, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 135, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 275, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 351, flow_bytes_toclient: 601, flow_age: 348, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 366, flow_bytes_toclient: 703, flow_age: 231, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 194, flow_bytes_toclient: 299, flow_age: 167, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 228, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 120, flow_bytes_toclient: 248, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 178, flow_bytes_toclient: 300, flow_age: 175, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 174, flow_bytes_toclient: 273, flow_age: 179, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 135, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 150, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 103, flow_age: 0, flow_state: established, flow_reason: shutdown ; pcap_cnt: 2976237, event_type: dns, proto: UDP, dns_type: query, dns_id: 3669, dns_rrname: pt.bab.la, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 2976245, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3669, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pt.bab.la, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: bab.la, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 2785, dns_authorities_0_soa_mname: tim.ns.cloudflare.com, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2024168364, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 3055120, event_type: dns, proto: UDP, dns_type: query, dns_id: 17676, dns_rrname: ocsp.sca1b.amazontrust.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3055174, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17676, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.sca1b.amazontrust.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.sca1b.amazontrust.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.192.36.201, dns_answers_1_rrname: ocsp.sca1b.amazontrust.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 54.192.36.175, dns_answers_2_rrname: ocsp.sca1b.amazontrust.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 54.192.36.134, dns_answers_3_rrname: ocsp.sca1b.amazontrust.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 54.192.36.36, dns_answers_4_rrname: ocsp.sca1b.amazontrust.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 54.192.36.139, dns_answers_5_rrname: ocsp.sca1b.amazontrust.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.192.36.157, dns_answers_6_rrname: ocsp.sca1b.amazontrust.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 54.192.36.242, dns_answers_7_rrname: ocsp.sca1b.amazontrust.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 54.192.36.97, dns_grouped_A_0: 54.192.36.201, dns_grouped_A_1: 54.192.36.175, dns_grouped_A_2: 54.192.36.134, dns_grouped_A_3: 54.192.36.36, dns_grouped_A_4: 54.192.36.139, dns_grouped_A_5: 54.192.36.157, dns_grouped_A_6: 54.192.36.242, dns_grouped_A_7: 54.192.36.97 ; pcap_cnt: 3445699, event_type: dns, proto: UDP, dns_type: query, dns_id: 64618, dns_rrname: ad.360yield.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 3445813, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64618, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad.360yield.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ad.360yield.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 450, dns_answers_0_rdata: pool.tokyo.iponweb.net, dns_grouped_CNAME_0: pool.tokyo.iponweb.net, dns_authorities_0_rrname: iponweb.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1, dns_authorities_0_soa_mname: ns5.iponweb.net, dns_authorities_0_soa_rname: noc.iponweb.net, dns_authorities_0_soa_serial: 2017070602, dns_authorities_0_soa_refresh: 300, dns_authorities_0_soa_retry: 1800, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 4753995, event_type: dns, proto: UDP, dns_type: query, dns_id: 26714, dns_rrname: periscope.map.fastly.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4753996, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26714, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: periscope.map.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: periscope.map.fastly.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 151.101.0.65, dns_answers_1_rrname: periscope.map.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 151.101.64.65, dns_answers_2_rrname: periscope.map.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 151.101.128.65, dns_answers_3_rrname: periscope.map.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 151.101.192.65, dns_grouped_A_0: 151.101.0.65, dns_grouped_A_1: 151.101.64.65, dns_grouped_A_2: 151.101.128.65, dns_grouped_A_3: 151.101.192.65 ; pcap_cnt: 4874684, event_type: dns, proto: UDP, dns_type: query, dns_id: 338, dns_rrname: f2.shared.global.fastly.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 4874745, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 338, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: f2.shared.global.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 9, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 4888770, event_type: dns, proto: UDP, dns_type: query, dns_id: 43104, dns_rrname: public-webservice.geo.adpushup.com, dns_rrtype: AAAA, dns_tx_id: 4 ; pcap_cnt: 4888782, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43104, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: public-webservice.geo.adpushup.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adpushup.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1325, dns_authorities_0_soa_mname: ns1.p01.dynect.net, dns_authorities_0_soa_rname: hostmaster.adpushup.com, dns_authorities_0_soa_serial: 1499080011, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 5484879, event_type: dns, proto: UDP, dns_type: query, dns_id: 37182, dns_rrname: www-google-analytics.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5484897, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37182, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www-google-analytics.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www-google-analytics.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:0818:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0818:0000:0000:0000:200e ; pcap_cnt: 5560018, event_type: dns, proto: UDP, dns_type: query, dns_id: 34034, dns_rrname: play.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5560048, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34034, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: play.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: play.google.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 21, dns_answers_0_rdata: play.l.google.com, dns_answers_1_rrname: play.l.google.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 299, dns_answers_1_rdata: 2607:f8b0:4006:080f:0000:0000:0000:200e, dns_grouped_CNAME_0: play.l.google.com, dns_grouped_AAAA_0: 2607:f8b0:4006:080f:0000:0000:0000:200e ; pcap_cnt: 5658837, event_type: dns, proto: UDP, dns_type: query, dns_id: 22881, dns_rrname: logx.optimizely.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5659100, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22881, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: logx.optimizely.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: logx.optimizely.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 118, dns_answers_0_rdata: p13nlog-1106815646.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: p13nlog-1106815646.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 29, dns_answers_1_rdata: 52.45.199.60, dns_answers_2_rrname: p13nlog-1106815646.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 29, dns_answers_2_rdata: 52.7.130.155, dns_answers_3_rrname: p13nlog-1106815646.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 29, dns_answers_3_rdata: 52.73.154.84, dns_answers_4_rrname: p13nlog-1106815646.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 29, dns_answers_4_rdata: 52.206.192.251, dns_answers_5_rrname: p13nlog-1106815646.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 29, dns_answers_5_rdata: 52.54.237.99, dns_answers_6_rrname: p13nlog-1106815646.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 29, dns_answers_6_rdata: 52.71.219.68, dns_answers_7_rrname: p13nlog-1106815646.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 29, dns_answers_7_rdata: 52.3.20.139, dns_answers_8_rrname: p13nlog-1106815646.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 29, dns_answers_8_rdata: 52.5.245.83, dns_grouped_A_0: 52.45.199.60, dns_grouped_A_1: 52.7.130.155, dns_grouped_A_2: 52.73.154.84, dns_grouped_A_3: 52.206.192.251, dns_grouped_A_4: 52.54.237.99, dns_grouped_A_5: 52.71.219.68, dns_grouped_A_6: 52.3.20.139, dns_grouped_A_7: 52.5.245.83, dns_grouped_CNAME_0: p13nlog-1106815646.us-east-1.elb.amazonaws.com ; pcap_cnt: 5734251, event_type: dns, proto: UDP, dns_type: query, dns_id: 53815, dns_rrname: e8218.dscb1.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5734286, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53815, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e8218.dscb1.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: e8218.dscb1.akamaiedge.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2600:1408:e000:0188:0000:0000:0000:201a, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 1, dns_answers_1_rdata: 2600:1408:e000:018b:0000:0000:0000:201a, dns_grouped_AAAA_0: 2600:1408:e000:0188:0000:0000:0000:201a, dns_grouped_AAAA_1: 2600:1408:e000:018b:0000:0000:0000:201a ; pcap_cnt: 5797156, event_type: dns, proto: UDP, dns_type: query, dns_id: 5944, dns_rrname: www.tek.no, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5797657, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5944, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.tek.no, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.tek.no, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 334, dns_answers_0_rdata: tek.no, dns_answers_1_rrname: tek.no, dns_answers_1_rrtype: A, dns_answers_1_ttl: 600, dns_answers_1_rdata: 87.238.60.136, dns_answers_2_rrname: tek.no, dns_answers_2_rrtype: A, dns_answers_2_ttl: 600, dns_answers_2_rdata: 87.238.60.135, dns_grouped_CNAME_0: tek.no, dns_grouped_A_0: 87.238.60.136, dns_grouped_A_1: 87.238.60.135 ; pcap_cnt: 5828758, event_type: dns, proto: UDP, dns_type: query, dns_id: 57250, dns_rrname: sync.outbrain.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5828840, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57250, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sync.outbrain.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sync.outbrain.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 195, dns_answers_0_rdata: prod.outbrain.map.fastlylb.net, dns_answers_1_rrname: prod.outbrain.map.fastlylb.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 20, dns_answers_1_rdata: 151.101.0.68, dns_answers_2_rrname: prod.outbrain.map.fastlylb.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 20, dns_answers_2_rdata: 151.101.64.68, dns_answers_3_rrname: prod.outbrain.map.fastlylb.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 20, dns_answers_3_rdata: 151.101.128.68, dns_answers_4_rrname: prod.outbrain.map.fastlylb.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 20, dns_answers_4_rdata: 151.101.192.68, dns_grouped_A_0: 151.101.0.68, dns_grouped_A_1: 151.101.64.68, dns_grouped_A_2: 151.101.128.68, dns_grouped_A_3: 151.101.192.68, dns_grouped_CNAME_0: prod.outbrain.map.fastlylb.net ; pcap_cnt: 5833746, event_type: dns, proto: UDP, dns_type: query, dns_id: 55672, dns_rrname: weather.emsmobile.de, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 5833853, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55672, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: weather.emsmobile.de, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: weather.emsmobile.de, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 53655, dns_answers_0_rdata: www.emsmobile.de, dns_answers_1_rrname: www.emsmobile.de, dns_answers_1_rrtype: A, dns_answers_1_ttl: 75405, dns_answers_1_rdata: 144.76.45.40, dns_grouped_CNAME_0: www.emsmobile.de, dns_grouped_A_0: 144.76.45.40 ; pcap_cnt: 5876186, event_type: dns, proto: UDP, dns_type: query, dns_id: 24607, dns_rrname: a159.casalemedia.com, dns_rrtype: AAAA, dns_tx_id: 6 ; pcap_cnt: 5876231, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24607, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a159.casalemedia.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: casalemedia.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns1.p09.dynect.net, dns_authorities_0_soa_rname: domains.casalemedia.com, dns_authorities_0_soa_serial: 2017070501, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5928550, event_type: dns, proto: UDP, dns_type: query, dns_id: 62965, dns_rrname: tiles-cloudfront.cdn.mozilla.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5928689, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62965, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tiles-cloudfront.cdn.mozilla.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tiles-cloudfront.cdn.mozilla.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 153, dns_answers_0_rdata: dcky6u1m8u6el.cloudfront.net, dns_answers_1_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.26.182, dns_answers_2_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.26.24, dns_answers_3_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.26.87, dns_answers_4_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.26.139, dns_answers_5_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.26.132, dns_answers_6_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.26.175, dns_answers_7_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.26.156, dns_answers_8_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 59, dns_answers_8_rdata: 52.84.26.155, dns_grouped_A_0: 52.84.26.182, dns_grouped_A_1: 52.84.26.24, dns_grouped_A_2: 52.84.26.87, dns_grouped_A_3: 52.84.26.139, dns_grouped_A_4: 52.84.26.132, dns_grouped_A_5: 52.84.26.175, dns_grouped_A_6: 52.84.26.156, dns_grouped_A_7: 52.84.26.155, dns_grouped_CNAME_0: dcky6u1m8u6el.cloudfront.net ; pcap_cnt: 5941458, event_type: dns, proto: UDP, dns_type: query, dns_id: 19056, dns_rrname: global.ssl.fastly.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 5941510, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19056, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: global.ssl.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 8, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 5962644, event_type: dns, proto: UDP, dns_type: query, dns_id: 31330, dns_rrname: dmp.3ay73.de, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 5962645, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31330, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dmp.3ay73.de, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dmp.3ay73.de, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 89.163.159.108, dns_grouped_A_0: 89.163.159.108 ; pcap_cnt: 5982834, event_type: dns, proto: UDP, dns_type: query, dns_id: 36989, dns_rrname: www.foxsports.com, dns_rrtype: A, dns_tx_id: 6 ; pcap_cnt: 5982962, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36989, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.foxsports.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.foxsports.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 548, dns_answers_0_rdata: san.foxsports.com.edgekey.net, dns_answers_1_rrname: san.foxsports.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 77, dns_answers_1_rdata: e6814.e4.akamaiedge.net, dns_answers_2_rrname: e6814.e4.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.195.101.132, dns_grouped_CNAME_0: san.foxsports.com.edgekey.net, dns_grouped_CNAME_1: e6814.e4.akamaiedge.net, dns_grouped_A_0: 23.195.101.132 ; pcap_cnt: 6037350, event_type: dns, proto: UDP, dns_type: query, dns_id: 1967, dns_rrname: www-googletagmanager.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6037387, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1967, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www-googletagmanager.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www-googletagmanager.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2607:f8b0:4006:0805:0000:0000:0000:2008, dns_grouped_AAAA_0: 2607:f8b0:4006:0805:0000:0000:0000:2008 ; pcap_cnt: 6085948, event_type: dns, proto: UDP, dns_type: query, dns_id: 28753, dns_rrname: lpcdn.lpsnmedia.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 6086056, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28753, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: lpcdn.lpsnmedia.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: lpcdn.lpsnmedia.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 436, dns_answers_0_rdata: lpcdn.lpsnmedia.livepersonk.akadns.net, dns_answers_1_rrname: lpcdn.lpsnmedia.livepersonk.akadns.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 1, dns_answers_1_rdata: 2a03:6400:0008:0000:0208:0089:0012:0090, dns_grouped_CNAME_0: lpcdn.lpsnmedia.livepersonk.akadns.net, dns_grouped_AAAA_0: 2a03:6400:0008:0000:0208:0089:0012:0090 ; pcap_cnt: 6418679, event_type: dns, proto: UDP, dns_type: query, dns_id: 52013, dns_rrname: d24n15hnbwhuhn.cloudfront.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6418831, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52013, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d24n15hnbwhuhn.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d24n15hnbwhuhn.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.230.51.206, dns_answers_1_rrname: d24n15hnbwhuhn.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 54.230.51.28, dns_answers_2_rrname: d24n15hnbwhuhn.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 54.230.51.23, dns_answers_3_rrname: d24n15hnbwhuhn.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 54.230.51.140, dns_answers_4_rrname: d24n15hnbwhuhn.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 54.230.51.126, dns_answers_5_rrname: d24n15hnbwhuhn.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.230.51.252, dns_answers_6_rrname: d24n15hnbwhuhn.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 54.230.51.5, dns_answers_7_rrname: d24n15hnbwhuhn.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 54.230.51.227, dns_grouped_A_0: 54.230.51.206, dns_grouped_A_1: 54.230.51.28, dns_grouped_A_2: 54.230.51.23, dns_grouped_A_3: 54.230.51.140, dns_grouped_A_4: 54.230.51.126, dns_grouped_A_5: 54.230.51.252, dns_grouped_A_6: 54.230.51.5, dns_grouped_A_7: 54.230.51.227 ; pcap_cnt: 7455954, event_type: dns, proto: UDP, dns_type: query, dns_id: 40013, dns_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7455981, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40013, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 50.17.211.84, dns_answers_1_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 50.19.121.243, dns_answers_2_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 50.19.223.117, dns_answers_3_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 23.23.250.246, dns_answers_4_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 50.16.220.202, dns_answers_5_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.225.149.201, dns_answers_6_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 54.225.187.162, dns_answers_7_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 54.225.188.92, dns_grouped_A_0: 50.17.211.84, dns_grouped_A_1: 50.19.121.243, dns_grouped_A_2: 50.19.223.117, dns_grouped_A_3: 23.23.250.246, dns_grouped_A_4: 50.16.220.202, dns_grouped_A_5: 54.225.149.201, dns_grouped_A_6: 54.225.187.162, dns_grouped_A_7: 54.225.188.92 ; pcap_cnt: 7945439, event_type: dns, proto: UDP, dns_type: query, dns_id: 44053, dns_rrname: rtb0.doubleverify.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7945519, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44053, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rtb0.doubleverify.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: rtb0.doubleverify.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 7, dns_answers_0_rdata: bs-geo.dvgtm.akadns.net, dns_answers_1_rrname: bs-geo.dvgtm.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 113, dns_answers_1_rdata: bs-failover-useast.dvgtm.akadns.net, dns_answers_2_rrname: bs-failover-useast.dvgtm.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 1, dns_answers_2_rdata: bs-ec.doubleverify.com, dns_answers_3_rrname: bs-ec.doubleverify.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 204.154.110.79, dns_grouped_CNAME_0: bs-geo.dvgtm.akadns.net, dns_grouped_CNAME_1: bs-failover-useast.dvgtm.akadns.net, dns_grouped_CNAME_2: bs-ec.doubleverify.com, dns_grouped_A_0: 204.154.110.79 ; pcap_cnt: 8011801, event_type: dns, proto: UDP, dns_type: query, dns_id: 62747, dns_rrname: ssl.gstatic.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 8011803, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62747, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssl.gstatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ssl.gstatic.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 165, dns_answers_0_rdata: 172.217.11.3, dns_grouped_A_0: 172.217.11.3 ; pcap_cnt: 8890389, event_type: dns, proto: UDP, dns_type: query, dns_id: 11447, dns_rrname: js.hs-analytics.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8890463, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11447, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: js.hs-analytics.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: js.hs-analytics.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 171, dns_answers_0_rdata: hubspot.net.edgekey.net, dns_answers_1_rrname: hubspot.net.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 6837, dns_answers_1_rdata: e9483.a.akamaiedge.net, dns_answers_2_rrname: e9483.a.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 104.88.103.53, dns_grouped_CNAME_0: hubspot.net.edgekey.net, dns_grouped_CNAME_1: e9483.a.akamaiedge.net, dns_grouped_A_0: 104.88.103.53 ; pcap_cnt: 8920776, event_type: dns, proto: UDP, dns_type: query, dns_id: 34518, dns_rrname: ngastatic.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 8921649, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34518, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ngastatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ngastatic.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 8, dns_answers_0_rdata: 185.31.24.171, dns_grouped_A_0: 185.31.24.171 ; pcap_cnt: 9164691, event_type: dns, proto: UDP, dns_type: query, dns_id: 42790, dns_rrname: dpm.lefigaro.fr, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9164965, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42790, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dpm.lefigaro.fr, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dpm.lefigaro.fr, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 567, dns_answers_0_rdata: figdpm.zebestof.com, dns_answers_1_rrname: figdpm.zebestof.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 297, dns_answers_1_rdata: 195.154.148.3, dns_grouped_CNAME_0: figdpm.zebestof.com, dns_grouped_A_0: 195.154.148.3 ; pcap_cnt: 9247736, event_type: dns, proto: UDP, dns_type: query, dns_id: 18844, dns_rrname: audex.userreport.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9247999, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18844, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: audex.userreport.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: audex.userreport.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2799, dns_answers_0_rdata: d2u28gf9o4d1cv.cloudfront.net, dns_answers_1_rrname: d2u28gf9o4d1cv.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 54.230.50.108, dns_grouped_CNAME_0: d2u28gf9o4d1cv.cloudfront.net, dns_grouped_A_0: 54.230.50.108 ; pcap_cnt: 9315308, event_type: dns, proto: UDP, dns_type: query, dns_id: 35447, dns_rrname: ums.adtechus.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9315313, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35447, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ums.adtechus.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ums.adtechus.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 447, dns_answers_0_rdata: 152.163.56.2, dns_grouped_A_0: 152.163.56.2
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.