['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60565, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 213, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 166, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 192, flow_bytes_toclient: 269, flow_age: 59, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 275, flow_bytes_toclient: 393, flow_age: 92, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 182, flow_bytes_toclient: 371, flow_age: 3, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 165, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 225, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 209, flow_bytes_toclient: 278, flow_age: 104, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 102, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 156, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 205, flow_bytes_toclient: 324, flow_age: 195, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 110, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 270, flow_bytes_toclient: 380, flow_age: 225, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 96, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 133, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 153, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 103, flow_bytes_toclient: 167, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 172, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 144, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 177, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 47329, event_type: dns, proto: UDP, dns_type: query, dns_id: 37727, dns_rrname: dp-sync.dotomi.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 47438, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37727, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dp-sync.dotomi.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dp-sync.dotomi.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: login-ds.dotomi.weighted.com.akadns.net, dns_answers_1_rrname: login-ds.dotomi.weighted.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 271, dns_answers_1_rdata: nsy-iad-ds.dotomi.weighted.com.akadns.net, dns_answers_2_rrname: nsy-iad-ds.dotomi.weighted.com.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 1, dns_answers_2_rdata: iad02-usadmm-ds.dotomi.com, dns_answers_3_rrname: iad02-usadmm-ds.dotomi.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 51, dns_answers_3_rdata: 205.180.85.169, dns_grouped_CNAME_0: login-ds.dotomi.weighted.com.akadns.net, dns_grouped_CNAME_1: nsy-iad-ds.dotomi.weighted.com.akadns.net, dns_grouped_CNAME_2: iad02-usadmm-ds.dotomi.com, dns_grouped_A_0: 205.180.85.169 ; pcap_cnt: 5611340, event_type: dns, proto: UDP, dns_type: query, dns_id: 63469, dns_rrname: kinja-img.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5611341, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63469, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: kinja-img.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: kinja-img.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 768, dns_authorities_0_soa_mname: ns-1403.awsdns-47.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6450872, event_type: dns, proto: UDP, dns_type: query, dns_id: 6992, dns_rrname: prod.pinterest.global.map.fastly.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6450891, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6992, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: prod.pinterest.global.map.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 19, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 6461141, event_type: dns, proto: UDP, dns_type: query, dns_id: 14748, dns_rrname: rp.gwallet.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6461178, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14748, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rp.gwallet.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: rp.gwallet.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 3599, dns_answers_0_rdata: 74.217.253.61, dns_grouped_A_0: 74.217.253.61 ; pcap_cnt: 6625098, event_type: dns, proto: UDP, dns_type: query, dns_id: 41246, dns_rrname: syndication.twitter.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6625121, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41246, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: syndication.twitter.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: syndication.twitter.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 18, dns_answers_0_rdata: 199.59.150.11, dns_answers_1_rrname: syndication.twitter.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 18, dns_answers_1_rdata: 199.59.150.46, dns_grouped_A_0: 199.59.150.11, dns_grouped_A_1: 199.59.150.46 ; pcap_cnt: 6646180, event_type: dns, proto: UDP, dns_type: query, dns_id: 2710, dns_rrname: 17.139.235.66.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 2 ; pcap_cnt: 6646209, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2710, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 17.139.235.66.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 17.139.235.66.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 9074, dns_answers_0_rdata: *.112.2o7.net, dns_grouped_PTR_0: *.112.2o7.net ; pcap_cnt: 6664843, event_type: dns, proto: UDP, dns_type: query, dns_id: 63097, dns_rrname: rtb.adgrx.com, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 6664950, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63097, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rtb.adgrx.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: rtb.adgrx.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 376, dns_answers_0_rdata: rtb.adgrx.com.tech.akadns.net, dns_answers_1_rrname: rtb.adgrx.com.tech.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 29, dns_answers_1_rdata: 74.201.229.68, dns_grouped_CNAME_0: rtb.adgrx.com.tech.akadns.net, dns_grouped_A_0: 74.201.229.68 ; pcap_cnt: 6844160, event_type: dns, proto: UDP, dns_type: query, dns_id: 2516, dns_rrname: psi.tubemogul.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6844269, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2516, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: psi.tubemogul.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: tubemogul.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 80689, dns_authorities_0_soa_mname: pdns68.ultradns.com, dns_authorities_0_soa_rname: dns-admin.tubemogul.com, dns_authorities_0_soa_serial: 2016106983, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6847394, event_type: dns, proto: UDP, dns_type: query, dns_id: 64369, dns_rrname: openx2-match.dotomi.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6847589, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64369, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: openx2-match.dotomi.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: openx2-match.dotomi.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 21, dns_answers_0_rdata: usadmm.dotomi.com.dotomi.weighted.com.akadns.net, dns_answers_1_rrname: usadmm.dotomi.com.dotomi.weighted.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 231, dns_answers_1_rdata: nsy-sjc.dotomi.weighted.com.akadns.net, dns_answers_2_rrname: nsy-sjc.dotomi.weighted.com.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 53, dns_answers_2_rdata: sjc06-usadmm.dotomi.com, dns_answers_3_rrname: sjc06-usadmm.dotomi.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 252, dns_answers_3_rdata: 205.180.87.201, dns_grouped_A_0: 205.180.87.201, dns_grouped_CNAME_0: usadmm.dotomi.com.dotomi.weighted.com.akadns.net, dns_grouped_CNAME_1: nsy-sjc.dotomi.weighted.com.akadns.net, dns_grouped_CNAME_2: sjc06-usadmm.dotomi.com ; pcap_cnt: 6981467, event_type: dns, proto: UDP, dns_type: query, dns_id: 26417, dns_rrname: 137.131.69.52.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 6981555, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26417, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 137.131.69.52.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 137.131.69.52.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 299, dns_answers_0_rdata: ec2-52-69-131-137.ap-northeast-1.compute.amazonaws.com, dns_grouped_PTR_0: ec2-52-69-131-137.ap-northeast-1.compute.amazonaws.com ; pcap_cnt: 7055367, event_type: dns, proto: UDP, dns_type: query, dns_id: 38774, dns_rrname: ocsp.sca1b.amazontrust.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7055398, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38774, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.sca1b.amazontrust.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.sca1b.amazontrust.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 52.84.143.148, dns_answers_1_rrname: ocsp.sca1b.amazontrust.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.143.81, dns_answers_2_rrname: ocsp.sca1b.amazontrust.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.143.147, dns_answers_3_rrname: ocsp.sca1b.amazontrust.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.143.13, dns_answers_4_rrname: ocsp.sca1b.amazontrust.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.143.31, dns_answers_5_rrname: ocsp.sca1b.amazontrust.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.143.97, dns_answers_6_rrname: ocsp.sca1b.amazontrust.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.143.110, dns_answers_7_rrname: ocsp.sca1b.amazontrust.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.143.188, dns_grouped_A_0: 52.84.143.148, dns_grouped_A_1: 52.84.143.81, dns_grouped_A_2: 52.84.143.147, dns_grouped_A_3: 52.84.143.13, dns_grouped_A_4: 52.84.143.31, dns_grouped_A_5: 52.84.143.97, dns_grouped_A_6: 52.84.143.110, dns_grouped_A_7: 52.84.143.188 ; pcap_cnt: 7266307, event_type: dns, proto: UDP, dns_type: query, dns_id: 39236, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7266329, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 39236, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 23.50.75.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.50.75.27 ; pcap_cnt: 7294699, event_type: dns, proto: UDP, dns_type: query, dns_id: 63732, dns_rrname: pagead-googlehosted.l.google.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 7294848, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63732, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pagead-googlehosted.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pagead-googlehosted.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 51, dns_answers_0_rdata: 172.217.10.97, dns_grouped_A_0: 172.217.10.97 ; pcap_cnt: 7561657, event_type: dns, proto: UDP, dns_type: query, dns_id: 30215, dns_rrname: ssl.gstatic.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7561660, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30215, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssl.gstatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ssl.gstatic.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 48, dns_answers_0_rdata: 172.217.12.195, dns_grouped_A_0: 172.217.12.195 ; pcap_cnt: 7714185, event_type: dns, proto: UDP, dns_type: query, dns_id: 26828, dns_rrname: 3.16.31.104.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7714186, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26828, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 3.16.31.104.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_authorities_0_rrname: 104.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1287, dns_authorities_0_soa_mname: bob.ns.cloudflare.com, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2024167477, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 7993398, event_type: dns, proto: UDP, dns_type: query, dns_id: 2874, dns_rrname: rs.gwallet.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7993452, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2874, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rs.gwallet.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: gwallet.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1598, dns_authorities_0_soa_mname: pdns1.ultradns.net, dns_authorities_0_soa_rname: it.radiumone.com, dns_authorities_0_soa_serial: 2013053029, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 86400, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8047407, event_type: dns, proto: UDP, dns_type: query, dns_id: 52453, dns_rrname: asimov-win.settings.data.microsoft.com.akadns.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 8047408, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52453, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: asimov-win.settings.data.microsoft.com.akadns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: asimov-win.settings.data.microsoft.com.akadns.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 246, dns_answers_0_rdata: geo.settings.data.microsoft.com.akadns.net, dns_answers_1_rrname: geo.settings.data.microsoft.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 246, dns_answers_1_rdata: bn2.settings.data.microsoft.com.akadns.net, dns_answers_2_rrname: bn2.settings.data.microsoft.com.akadns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 74, dns_answers_2_rdata: 65.55.44.108, dns_grouped_CNAME_0: geo.settings.data.microsoft.com.akadns.net, dns_grouped_CNAME_1: bn2.settings.data.microsoft.com.akadns.net, dns_grouped_A_0: 65.55.44.108 ; pcap_cnt: 8155399, event_type: dns, proto: UDP, dns_type: query, dns_id: 46257, dns_rrname: e10663.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8155401, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46257, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e10663.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e10663.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 4, dns_answers_0_rdata: 184.31.202.183, dns_grouped_A_0: 184.31.202.183 ; pcap_cnt: 8593279, event_type: dns, proto: UDP, dns_type: query, dns_id: 22382, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8593367, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22382, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 59, dns_answers_0_rdata: 2a03:2880:f10e:0083:face:b00c:0000:25de, dns_grouped_AAAA_0: 2a03:2880:f10e:0083:face:b00c:0000:25de ; pcap_cnt: 8602628, event_type: dns, proto: UDP, dns_type: query, dns_id: 61799, dns_rrname: www.blogspot.tw, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 8602630, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61799, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.blogspot.tw, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.blogspot.tw, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3600, dns_answers_0_rdata: blogger.l.google.com, dns_answers_1_rrname: blogger.l.google.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 172.217.3.105, dns_grouped_CNAME_0: blogger.l.google.com, dns_grouped_A_0: 172.217.3.105 ; pcap_cnt: 8612049, event_type: dns, proto: UDP, dns_type: query, dns_id: 40736, dns_rrname: www.blocket.com, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 8612058, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40736, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.blocket.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.blocket.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 300, dns_answers_0_rdata: 185.49.134.10, dns_answers_1_rrname: www.blocket.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 300, dns_answers_1_rdata: 185.49.132.10, dns_grouped_A_0: 185.49.134.10, dns_grouped_A_1: 185.49.132.10 ; pcap_cnt: 9457950, event_type: dns, proto: UDP, dns_type: query, dns_id: 58153, dns_rrname: 37.10.20.104.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 9457951, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58153, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 37.10.20.104.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR ; pcap_cnt: 9987609, event_type: dns, proto: UDP, dns_type: query, dns_id: 54529, dns_rrname: www.vizury.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9987652, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 54529, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.vizury.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.vizury.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 825, dns_answers_0_rdata: 184.173.85.152, dns_answers_1_rrname: www.vizury.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 825, dns_answers_1_rdata: 173.193.166.183, dns_answers_2_rrname: www.vizury.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 825, dns_answers_2_rdata: 23.246.227.68, dns_grouped_A_0: 184.173.85.152, dns_grouped_A_1: 173.193.166.183, dns_grouped_A_2: 23.246.227.68 ; pcap_cnt: 10174532, event_type: dns, proto: UDP, dns_type: query, dns_id: 29337, dns_rrname: global.ssl.fastly.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10174627, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29337, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: global.ssl.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 4, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 10820510, event_type: dns, proto: UDP, dns_type: query, dns_id: 5448, dns_rrname: prod.contextweb.map.fastlylb.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10820547, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5448, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: prod.contextweb.map.fastlylb.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: prod.contextweb.map.fastlylb.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 16, dns_answers_0_rdata: 151.101.0.166, dns_answers_1_rrname: prod.contextweb.map.fastlylb.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 16, dns_answers_1_rdata: 151.101.64.166, dns_answers_2_rrname: prod.contextweb.map.fastlylb.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 16, dns_answers_2_rdata: 151.101.128.166, dns_answers_3_rrname: prod.contextweb.map.fastlylb.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 16, dns_answers_3_rdata: 151.101.192.166, dns_grouped_A_0: 151.101.0.166, dns_grouped_A_1: 151.101.64.166, dns_grouped_A_2: 151.101.128.166, dns_grouped_A_3: 151.101.192.166 ; pcap_cnt: 11138890, event_type: dns, proto: UDP, dns_type: query, dns_id: 63183, dns_rrname: trk.helios.ligatus.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11138956, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63183, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: trk.helios.ligatus.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: helios.ligatus.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 250, dns_authorities_0_soa_mname: ns-cloud-b1.googledomains.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 0, dns_authorities_0_soa_refresh: 21600, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 11294500, event_type: dns, proto: UDP, dns_type: query, dns_id: 42171, dns_rrname: huri.harvard.edu, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11294519, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42171, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: huri.harvard.edu, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: harvard.edu, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 199, dns_authorities_0_soa_mname: int-dns-2.harvard.edu, dns_authorities_0_soa_rname: netmanager.harvard.edu, dns_authorities_0_soa_serial: 2010091032, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 11392620, event_type: dns, proto: UDP, dns_type: query, dns_id: 5598, dns_rrname: www.jetzt.de, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11392640, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5598, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.jetzt.de, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.jetzt.de, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1955, dns_answers_0_rdata: pxc.sueddeutsche.c.footprint.net, dns_answers_1_rrname: pxc.sueddeutsche.c.footprint.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 230, dns_answers_1_rdata: 8.253.104.30, dns_answers_2_rrname: pxc.sueddeutsche.c.footprint.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 230, dns_answers_2_rdata: 8.254.221.190, dns_answers_3_rrname: pxc.sueddeutsche.c.footprint.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 230, dns_answers_3_rdata: 8.253.140.248, dns_grouped_A_0: 8.253.104.30, dns_grouped_A_1: 8.254.221.190, dns_grouped_A_2: 8.253.140.248, dns_grouped_CNAME_0: pxc.sueddeutsche.c.footprint.net
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.