['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60665, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 162, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 126, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 107, flow_bytes_toclient: 123, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 220, flow_bytes_toclient: 366, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 180, flow_bytes_toclient: 285, flow_age: 199, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 189, flow_bytes_toclient: 307, flow_age: 175, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 136, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 172, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 101, flow_bytes_toclient: 162, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 324, flow_bytes_toclient: 622, flow_age: 255, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 161, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 143, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 152, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 155, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 182, flow_bytes_toclient: 287, flow_age: 10, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 103, flow_bytes_toclient: 164, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 224, flow_age: 0, flow_state: established, flow_reason: shutdown ; pcap_cnt: 115676, event_type: dns, proto: UDP, dns_type: query, dns_id: 26237, dns_rrname: f2.shared.global.fastly.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 115677, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26237, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: f2.shared.global.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: f2.shared.global.fastly.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 9, dns_answers_0_rdata: 151.101.2.2, dns_answers_1_rrname: f2.shared.global.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 9, dns_answers_1_rdata: 151.101.66.2, dns_answers_2_rrname: f2.shared.global.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 9, dns_answers_2_rdata: 151.101.130.2, dns_answers_3_rrname: f2.shared.global.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 9, dns_answers_3_rdata: 151.101.194.2, dns_grouped_A_0: 151.101.2.2, dns_grouped_A_1: 151.101.66.2, dns_grouped_A_2: 151.101.130.2, dns_grouped_A_3: 151.101.194.2 ; pcap_cnt: 2834770, event_type: dns, proto: UDP, dns_type: query, dns_id: 34688, dns_rrname: syndication.twitter.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2834788, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34688, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: syndication.twitter.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: syndication.twitter.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 106, dns_answers_0_rdata: 199.16.156.120, dns_answers_1_rrname: syndication.twitter.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 106, dns_answers_1_rdata: 199.16.157.105, dns_grouped_A_0: 199.16.156.120, dns_grouped_A_1: 199.16.157.105 ; pcap_cnt: 3040060, event_type: dns, proto: UDP, dns_type: query, dns_id: 46028, dns_rrname: googlehosted.l.googleusercontent.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3040061, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46028, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googlehosted.l.googleusercontent.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: googlehosted.l.googleusercontent.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 141, dns_answers_0_rdata: 172.217.6.193, dns_grouped_A_0: 172.217.6.193 ; pcap_cnt: 3516066, event_type: dns, proto: UDP, dns_type: query, dns_id: 56528, dns_rrname: opthw.xdwscache.speedcdns.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3516067, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56528, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: opthw.xdwscache.speedcdns.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: speedcdns.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: dns1.speedcdns.info, dns_authorities_0_soa_rname: webmaster.speedcdns.info, dns_authorities_0_soa_serial: 1107011041, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 64800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 3516721, event_type: dns, proto: UDP, dns_type: query, dns_id: 5058, dns_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 3516799, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5058, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: log-zone-b-1304148952.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 55, dns_authorities_0_soa_mname: ns-699.awsdns-23.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 4094832, event_type: dns, proto: UDP, dns_type: query, dns_id: 13433, dns_rrname: na-dmpsync.3lift.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4094836, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13433, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: na-dmpsync.3lift.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: na-dmpsync.3lift.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.165.34.46, dns_answers_1_rrname: na-dmpsync.3lift.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 52.205.10.19, dns_grouped_A_0: 54.165.34.46, dns_grouped_A_1: 52.205.10.19 ; pcap_cnt: 4132454, event_type: dns, proto: UDP, dns_type: query, dns_id: 45325, dns_rrname: api.trustpilot.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 4132767, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45325, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: api.trustpilot.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: api.trustpilot.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 194, dns_answers_0_rdata: trustpilot-00.dn.apigee.net, dns_answers_1_rrname: trustpilot-00.dn.apigee.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 60, dns_answers_1_rdata: 52.4.247.45, dns_answers_2_rrname: trustpilot-00.dn.apigee.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 60, dns_answers_2_rdata: 52.203.157.54, dns_grouped_CNAME_0: trustpilot-00.dn.apigee.net, dns_grouped_A_0: 52.4.247.45, dns_grouped_A_1: 52.203.157.54 ; pcap_cnt: 4289868, event_type: dns, proto: UDP, dns_type: query, dns_id: 3622, dns_rrname: www.googleadservices.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4289976, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3622, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.googleadservices.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.googleadservices.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 267, dns_answers_0_rdata: pagead.l.doubleclick.net, dns_answers_1_rrname: pagead.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 46, dns_answers_1_rdata: 172.217.12.130, dns_grouped_CNAME_0: pagead.l.doubleclick.net, dns_grouped_A_0: 172.217.12.130 ; pcap_cnt: 4321368, event_type: dns, proto: UDP, dns_type: query, dns_id: 41247, dns_rrname: stats.l.doubleclick.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 4321371, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41247, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: stats.l.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: stats.l.doubleclick.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 144, dns_answers_0_rdata: 173.194.208.155, dns_answers_1_rrname: stats.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 144, dns_answers_1_rdata: 173.194.208.154, dns_answers_2_rrname: stats.l.doubleclick.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 144, dns_answers_2_rdata: 173.194.208.157, dns_answers_3_rrname: stats.l.doubleclick.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 144, dns_answers_3_rdata: 173.194.208.156, dns_grouped_A_0: 173.194.208.155, dns_grouped_A_1: 173.194.208.154, dns_grouped_A_2: 173.194.208.157, dns_grouped_A_3: 173.194.208.156 ; pcap_cnt: 4557428, event_type: dns, proto: UDP, dns_type: query, dns_id: 60303, dns_rrname: s0.2mdn.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4557492, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60303, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s0.2mdn.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s0.2mdn.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: s0-2mdn-net.l.google.com, dns_answers_1_rrname: s0-2mdn-net.l.google.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 172.217.12.198, dns_grouped_CNAME_0: s0-2mdn-net.l.google.com, dns_grouped_A_0: 172.217.12.198 ; pcap_cnt: 4791656, event_type: dns, proto: UDP, dns_type: query, dns_id: 19035, dns_rrname: tp-emea.exactag.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4791682, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19035, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tp-emea.exactag.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: exactag.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 86, dns_authorities_0_soa_mname: ns-1125.awsdns-12.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6230313, event_type: dns, proto: UDP, dns_type: query, dns_id: 32986, dns_rrname: prod.k.ssl.global.fastlylb.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6230327, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32986, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: prod.k.ssl.global.fastlylb.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastlylb.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 11, dns_authorities_0_soa_mname: ns1.fastlylb.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2016111400, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 6335261, event_type: dns, proto: UDP, dns_type: query, dns_id: 4856, dns_rrname: sp.adbrn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6335316, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4856, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sp.adbrn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sp.adbrn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 168, dns_answers_0_rdata: abcookiesync.us-east-1.elasticbeanstalk.com, dns_answers_1_rrname: abcookiesync.us-east-1.elasticbeanstalk.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 15, dns_answers_1_rdata: 54.165.89.238, dns_answers_2_rrname: abcookiesync.us-east-1.elasticbeanstalk.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 15, dns_answers_2_rdata: 54.165.129.5, dns_answers_3_rrname: abcookiesync.us-east-1.elasticbeanstalk.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 15, dns_answers_3_rdata: 52.86.68.253, dns_answers_4_rrname: abcookiesync.us-east-1.elasticbeanstalk.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 15, dns_answers_4_rdata: 54.164.249.170, dns_answers_5_rrname: abcookiesync.us-east-1.elasticbeanstalk.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 15, dns_answers_5_rdata: 52.7.85.172, dns_answers_6_rrname: abcookiesync.us-east-1.elasticbeanstalk.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 15, dns_answers_6_rdata: 34.227.130.226, dns_grouped_A_0: 54.165.89.238, dns_grouped_A_1: 54.165.129.5, dns_grouped_A_2: 52.86.68.253, dns_grouped_A_3: 54.164.249.170, dns_grouped_A_4: 52.7.85.172, dns_grouped_A_5: 34.227.130.226, dns_grouped_CNAME_0: abcookiesync.us-east-1.elasticbeanstalk.com ; pcap_cnt: 6394865, event_type: dns, proto: UDP, dns_type: query, dns_id: 19993, dns_rrname: track-us.adformnet.akadns.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 6394868, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19993, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: track-us.adformnet.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 179, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499360158, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 6424609, event_type: dns, proto: UDP, dns_type: query, dns_id: 21402, dns_rrname: data-coll-datacoll-1c1ww2b5kbgnp-338344575.eu-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 4 ; pcap_cnt: 6424610, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21402, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: data-coll-datacoll-1c1ww2b5kbgnp-338344575.eu-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: eu-west-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 21, dns_authorities_0_soa_mname: ns-1053.awsdns-03.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6507649, event_type: dns, proto: UDP, dns_type: query, dns_id: 43959, dns_rrname: parentanswercentre.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6507655, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43959, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: parentanswercentre.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: parentanswercentre.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 599, dns_authorities_0_soa_mname: ns29.domaincontrol.com, dns_authorities_0_soa_rname: dns.jomax.net, dns_authorities_0_soa_serial: 2016052302, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 6908668, event_type: dns, proto: UDP, dns_type: query, dns_id: 51559, dns_rrname: staticxx.facebook.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6908749, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51559, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: staticxx.facebook.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: staticxx.facebook.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3485, dns_answers_0_rdata: scontent.xx.fbcdn.net, dns_answers_1_rrname: scontent.xx.fbcdn.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 157.240.2.25, dns_grouped_CNAME_0: scontent.xx.fbcdn.net, dns_grouped_A_0: 157.240.2.25 ; pcap_cnt: 7064216, event_type: dns, proto: UDP, dns_type: query, dns_id: 43677, dns_rrname: nrpc-gcp.olark.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7064217, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43677, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: nrpc-gcp.olark.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: olark.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 151, dns_authorities_0_soa_mname: dns1.stabletransit.com, dns_authorities_0_soa_rname: ipadmin.stabletransit.com, dns_authorities_0_soa_serial: 1498595207, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 300, dns_authorities_0_soa_expire: 1814400, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 7250855, event_type: dns, proto: UDP, dns_type: query, dns_id: 11117, dns_rrname: app.mappy.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7251042, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11117, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: app.mappy.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: mappy.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1799, dns_authorities_0_soa_mname: ns1.mappy.net, dns_authorities_0_soa_rname: hostmasters.wanadooportails.com, dns_authorities_0_soa_serial: 2017061201, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 86400, dns_authorities_0_soa_expire: 60, dns_authorities_0_soa_minimum: 7200 ; pcap_cnt: 8005516, event_type: dns, proto: UDP, dns_type: query, dns_id: 14535, dns_rrname: partnerad.l.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8005545, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14535, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: partnerad.l.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: partnerad.l.doubleclick.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.10.34, dns_grouped_A_0: 172.217.10.34 ; pcap_cnt: 8013695, event_type: dns, proto: UDP, dns_type: query, dns_id: 53024, dns_rrname: sig.atdmt.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 8013873, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53024, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sig.atdmt.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: sig.atdmt.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 159, dns_answers_0_rdata: geo.atlassbx.com, dns_answers_1_rrname: geo.atlassbx.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 145, dns_answers_1_rdata: atlas.c10r.facebook.com, dns_answers_2_rrname: atlas.c10r.facebook.com, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 0, dns_answers_2_rdata: 2a03:2880:f012:0002:face:b00c:0000:0001, dns_grouped_AAAA_0: 2a03:2880:f012:0002:face:b00c:0000:0001, dns_grouped_CNAME_0: geo.atlassbx.com, dns_grouped_CNAME_1: atlas.c10r.facebook.com ; pcap_cnt: 8908328, event_type: dns, proto: UDP, dns_type: query, dns_id: 32610, dns_rrname: istockphoto.com.d2.sc.omtrdc.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8908329, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32610, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: istockphoto.com.d2.sc.omtrdc.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: omtrdc.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns1.omtrdc.net, dns_authorities_0_soa_rname: dnsadmin.omniture.com, dns_authorities_0_soa_serial: 2017070501, dns_authorities_0_soa_refresh: 21600, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 9288613, event_type: dns, proto: UDP, dns_type: query, dns_id: 9668, dns_rrname: audiweb.azureedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9288684, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9668, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: audiweb.azureedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: audiweb.azureedge.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1226, dns_answers_0_rdata: audiweb.akstd.azureedge.net, dns_answers_1_rrname: audiweb.akstd.azureedge.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 568, dns_answers_1_rdata: cdn-standard.azureedge.net.edgekey.net, dns_answers_2_rrname: cdn-standard.azureedge.net.edgekey.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 20735, dns_answers_2_rdata: e10076.dsce16.akamaiedge.net, dns_answers_3_rrname: e10076.dsce16.akamaiedge.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 19, dns_answers_3_rdata: 104.97.101.128, dns_grouped_CNAME_0: audiweb.akstd.azureedge.net, dns_grouped_CNAME_1: cdn-standard.azureedge.net.edgekey.net, dns_grouped_CNAME_2: e10076.dsce16.akamaiedge.net, dns_grouped_A_0: 104.97.101.128
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.