['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61168, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 195, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 199, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 98, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 175, flow_bytes_toclient: 319, flow_age: 112, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 141, flow_bytes_toclient: 223, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 108, flow_bytes_toclient: 140, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 118, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 145, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 152, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 101, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 135, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 176, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 104, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 178, flow_bytes_toclient: 304, flow_age: 8, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 195, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 217, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 143, flow_bytes_toclient: 200, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 108, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 105, flow_bytes_toclient: 171, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 120, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 137, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 104, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 147, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 206, flow_age: 1, flow_state: established, flow_reason: timeout ; pcap_cnt: 114368, event_type: dns, proto: UDP, dns_type: query, dns_id: 22533, dns_rrname: www.buccaneers.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 114413, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22533, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.buccaneers.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.buccaneers.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 105, dns_answers_0_rdata: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrname: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20811, dns_answers_1_rdata: a945.b.akamai.net, dns_answers_2_rrname: a945.b.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 17, dns_answers_2_rdata: 23.15.4.18, dns_answers_3_rrname: a945.b.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 17, dns_answers_3_rdata: 23.15.4.10, dns_grouped_CNAME_0: prod.clubs.nfl.com.edgesuite.net, dns_grouped_CNAME_1: a945.b.akamai.net, dns_grouped_A_0: 23.15.4.18, dns_grouped_A_1: 23.15.4.10 ; pcap_cnt: 2506676, event_type: dns, proto: UDP, dns_type: query, dns_id: 8064, dns_rrname: cdn.onthe.io, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2507478, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 8064, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.onthe.io, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.onthe.io, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 118, dns_answers_0_rdata: 755003843.r.cdnsun.net, dns_answers_1_rrname: 755003843.r.cdnsun.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 75, dns_answers_1_rdata: 104.200.148.15, dns_answers_2_rrname: 755003843.r.cdnsun.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 75, dns_answers_2_rdata: 50.23.65.35, dns_answers_3_rrname: 755003843.r.cdnsun.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 75, dns_answers_3_rdata: 173.248.177.40, dns_answers_4_rrname: 755003843.r.cdnsun.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 75, dns_answers_4_rdata: 173.248.177.49, dns_answers_5_rrname: 755003843.r.cdnsun.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 75, dns_answers_5_rdata: 104.200.148.52, dns_grouped_CNAME_0: 755003843.r.cdnsun.net, dns_grouped_A_0: 104.200.148.15, dns_grouped_A_1: 50.23.65.35, dns_grouped_A_2: 173.248.177.40, dns_grouped_A_3: 173.248.177.49, dns_grouped_A_4: 104.200.148.52 ; pcap_cnt: 2973147, event_type: dns, proto: UDP, dns_type: query, dns_id: 31546, dns_rrname: nflrush.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2973164, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31546, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: nflrush.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: nflrush.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 249, dns_answers_0_rdata: 216.223.21.166, dns_grouped_A_0: 216.223.21.166 ; pcap_cnt: 3709809, event_type: dns, proto: UDP, dns_type: query, dns_id: 53056, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3709813, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53056, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ping.chartbeat.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 12, dns_answers_0_rdata: 54.235.145.152, dns_answers_1_rrname: ping.chartbeat.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 12, dns_answers_1_rdata: 23.23.139.95, dns_answers_2_rrname: ping.chartbeat.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 12, dns_answers_2_rdata: 54.235.105.11, dns_answers_3_rrname: ping.chartbeat.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 12, dns_answers_3_rdata: 54.235.219.125, dns_answers_4_rrname: ping.chartbeat.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 12, dns_answers_4_rdata: 54.235.110.123, dns_answers_5_rrname: ping.chartbeat.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 12, dns_answers_5_rdata: 23.21.84.138, dns_answers_6_rrname: ping.chartbeat.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 12, dns_answers_6_rdata: 54.235.146.101, dns_answers_7_rrname: ping.chartbeat.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 12, dns_answers_7_rdata: 54.225.97.8, dns_grouped_A_0: 54.235.145.152, dns_grouped_A_1: 23.23.139.95, dns_grouped_A_2: 54.235.105.11, dns_grouped_A_3: 54.235.219.125, dns_grouped_A_4: 54.235.110.123, dns_grouped_A_5: 23.21.84.138, dns_grouped_A_6: 54.235.146.101, dns_grouped_A_7: 54.225.97.8 ; pcap_cnt: 3727168, event_type: dns, proto: UDP, dns_type: query, dns_id: 33635, dns_rrname: ssl.gstatic.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 3727172, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33635, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssl.gstatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ssl.gstatic.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 272, dns_answers_0_rdata: 172.217.10.99, dns_grouped_A_0: 172.217.10.99 ; pcap_cnt: 3891811, event_type: dns, proto: UDP, dns_type: query, dns_id: 62236, dns_rrname: productio-webserve-1qh3bqaow96ig-474813755.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3891812, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62236, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: productio-webserve-1qh3bqaow96ig-474813755.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 58, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 4190789, event_type: dns, proto: UDP, dns_type: query, dns_id: 5409, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4190850, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5409, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 98.139.225.43, dns_answers_1_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 72.30.3.43, dns_grouped_A_0: 98.139.225.43, dns_grouped_A_1: 72.30.3.43 ; pcap_cnt: 4309979, event_type: dns, proto: UDP, dns_type: query, dns_id: 58716, dns_rrname: a.rfihub.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4310039, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58716, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a.rfihub.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a.rfihub.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: a-tm.rfihub.com, dns_answers_1_rrname: a-tm.rfihub.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 198.8.70.211, dns_grouped_CNAME_0: a-tm.rfihub.com, dns_grouped_A_0: 198.8.70.211 ; pcap_cnt: 4343575, event_type: dns, proto: UDP, dns_type: query, dns_id: 30274, dns_rrname: xianliao.me, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4343576, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30274, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: xianliao.me, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: xianliao.me, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 599, dns_authorities_0_soa_mname: dns9.hichina.com, dns_authorities_0_soa_rname: hostmaster.hichina.com, dns_authorities_0_soa_serial: 2016092514, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 1200, dns_authorities_0_soa_expire: 3600, dns_authorities_0_soa_minimum: 360 ; pcap_cnt: 4476580, event_type: dns, proto: UDP, dns_type: query, dns_id: 5423, dns_rrname: tmk.smartadserver.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4476584, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5423, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tmk.smartadserver.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: smartadserver.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 8180, dns_authorities_0_soa_mname: ns1.mailclub.fr, dns_authorities_0_soa_rname: domaines.mailclub.fr, dns_authorities_0_soa_serial: 2013124722, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 14400, dns_authorities_0_soa_expire: 3600000, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 4573610, event_type: dns, proto: UDP, dns_type: query, dns_id: 30880, dns_rrname: c.coll1onf.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4573613, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30880, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: c.coll1onf.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: c.coll1onf.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 58, dns_answers_0_rdata: 163.172.106.163, dns_grouped_A_0: 163.172.106.163 ; pcap_cnt: 4853910, event_type: dns, proto: UDP, dns_type: query, dns_id: 20210, dns_rrname: ghmpl.hit.gemius.pl, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4853961, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20210, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ghmpl.hit.gemius.pl, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: hit.gemius.pl, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 615, dns_authorities_0_soa_mname: ns1.gemius.pl, dns_authorities_0_soa_rname: root.gemius.pl, dns_authorities_0_soa_serial: 2017070601, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 86400, dns_authorities_0_soa_minimum: 900 ; pcap_cnt: 5556719, event_type: dns, proto: UDP, dns_type: query, dns_id: 57741, dns_rrname: c1.adform.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5556777, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57741, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: c1.adform.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: c1.adform.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3329, dns_answers_0_rdata: track.adformnet.akadns.net, dns_answers_1_rrname: track.adformnet.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 329, dns_answers_1_rdata: track-us.adformnet.akadns.net, dns_answers_2_rrname: track-us.adformnet.akadns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 118, dns_answers_2_rdata: 185.167.164.37, dns_answers_3_rrname: track-us.adformnet.akadns.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 118, dns_answers_3_rdata: 185.167.164.39, dns_grouped_CNAME_0: track.adformnet.akadns.net, dns_grouped_CNAME_1: track-us.adformnet.akadns.net, dns_grouped_A_0: 185.167.164.37, dns_grouped_A_1: 185.167.164.39 ; pcap_cnt: 6227005, event_type: dns, proto: UDP, dns_type: query, dns_id: 56677, dns_rrname: static.criteo.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6227039, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56677, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static.criteo.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: static.criteo.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 156, dns_answers_0_rdata: 74.119.117.74, dns_grouped_A_0: 74.119.117.74 ; pcap_cnt: 6500399, event_type: dns, proto: UDP, dns_type: query, dns_id: 40433, dns_rrname: www.easyabo.de, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6500435, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40433, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.easyabo.de, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: easyabo.de, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 870, dns_authorities_0_soa_mname: ns1.your-server.de, dns_authorities_0_soa_rname: postmaster.your-server.de, dns_authorities_0_soa_serial: 2016080300, dns_authorities_0_soa_refresh: 14400, dns_authorities_0_soa_retry: 1800, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6501431, event_type: dns, proto: UDP, dns_type: query, dns_id: 61009, dns_rrname: apps.bdimg.jomodns.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 6501554, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61009, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: apps.bdimg.jomodns.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: jomodns.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 297, dns_authorities_0_soa_mname: ns1.jomodns.com, dns_authorities_0_soa_rname: baidu_dns_master.baidu.com, dns_authorities_0_soa_serial: 1707060040, dns_authorities_0_soa_refresh: 45, dns_authorities_0_soa_retry: 5, dns_authorities_0_soa_expire: 86400, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 6665713, event_type: dns, proto: UDP, dns_type: query, dns_id: 21918, dns_rrname: thumbs.web.sapo.io, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6666468, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21918, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: thumbs.web.sapo.io, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: thumbs.web.sapo.io, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 220, dns_answers_0_rdata: c368686.cdn.sapo.io, dns_answers_1_rrname: c368686.cdn.sapo.io, dns_answers_1_rrtype: A, dns_answers_1_ttl: 19, dns_answers_1_rdata: 213.13.25.46, dns_answers_2_rrname: c368686.cdn.sapo.io, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 213.13.25.43, dns_answers_3_rrname: c368686.cdn.sapo.io, dns_answers_3_rrtype: A, dns_answers_3_ttl: 19, dns_answers_3_rdata: 213.13.25.44, dns_answers_4_rrname: c368686.cdn.sapo.io, dns_answers_4_rrtype: A, dns_answers_4_ttl: 19, dns_answers_4_rdata: 213.13.25.42, dns_answers_5_rrname: c368686.cdn.sapo.io, dns_answers_5_rrtype: A, dns_answers_5_ttl: 19, dns_answers_5_rdata: 213.13.25.16, dns_grouped_CNAME_0: c368686.cdn.sapo.io, dns_grouped_A_0: 213.13.25.46, dns_grouped_A_1: 213.13.25.43, dns_grouped_A_2: 213.13.25.44, dns_grouped_A_3: 213.13.25.42, dns_grouped_A_4: 213.13.25.16 ; pcap_cnt: 7082448, event_type: dns, proto: UDP, dns_type: query, dns_id: 21922, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7082450, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21922, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ping.chartbeat.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.235.110.123, dns_answers_1_rrname: ping.chartbeat.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 23.23.139.95, dns_answers_2_rrname: ping.chartbeat.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 54.235.146.101, dns_answers_3_rrname: ping.chartbeat.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 23.21.84.138, dns_answers_4_rrname: ping.chartbeat.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 54.235.145.152, dns_answers_5_rrname: ping.chartbeat.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.235.219.125, dns_answers_6_rrname: ping.chartbeat.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 54.225.97.8, dns_answers_7_rrname: ping.chartbeat.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 54.235.105.11, dns_grouped_A_0: 54.235.110.123, dns_grouped_A_1: 23.23.139.95, dns_grouped_A_2: 54.235.146.101, dns_grouped_A_3: 23.21.84.138, dns_grouped_A_4: 54.235.145.152, dns_grouped_A_5: 54.235.219.125, dns_grouped_A_6: 54.225.97.8, dns_grouped_A_7: 54.235.105.11 ; pcap_cnt: 7323211, event_type: dns, proto: UDP, dns_type: query, dns_id: 18785, dns_rrname: p4-gmwnuzn6xifum-jur34xlbeglp2mv6-378407-s1-v6exp3-v4.metric.gstatic.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7323223, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18785, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: p4-gmwnuzn6xifum-jur34xlbeglp2mv6-378407-s1-v6exp3-v4.metric.gstatic.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: gstatic.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 569, dns_authorities_0_soa_mname: ns3.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 161069820, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7859908, event_type: dns, proto: UDP, dns_type: query, dns_id: 53666, dns_rrname: toolbar.rakuten.co.jp, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7859941, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53666, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: toolbar.rakuten.co.jp, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: toolbar.rakuten.co.jp, dns_answers_0_rrtype: A, dns_answers_0_ttl: 300, dns_answers_0_rdata: 133.237.16.7, dns_grouped_A_0: 133.237.16.7 ; pcap_cnt: 8120990, event_type: dns, proto: UDP, dns_type: query, dns_id: 52381, dns_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8120991, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52381, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 179, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499365760, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 8272510, event_type: dns, proto: UDP, dns_type: query, dns_id: 3450, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8272524, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3450, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: scontent.xx.fbcdn.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 59, dns_answers_0_rdata: 2a03:2880:f00e:0013:face:b00c:0000:0003, dns_grouped_AAAA_0: 2a03:2880:f00e:0013:face:b00c:0000:0003 ; pcap_cnt: 8640063, event_type: dns, proto: UDP, dns_type: query, dns_id: 36030, dns_rrname: use-tor.adsrvr.org, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8640113, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36030, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: use-tor.adsrvr.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: use-tor.adsrvr.org, dns_answers_0_rrtype: A, dns_answers_0_ttl: 30, dns_answers_0_rdata: 209.15.224.6, dns_answers_1_rrname: use-tor.adsrvr.org, dns_answers_1_rrtype: A, dns_answers_1_ttl: 30, dns_answers_1_rdata: 209.15.224.8, dns_answers_2_rrname: use-tor.adsrvr.org, dns_answers_2_rrtype: A, dns_answers_2_ttl: 30, dns_answers_2_rdata: 209.15.224.11, dns_grouped_A_0: 209.15.224.6, dns_grouped_A_1: 209.15.224.8, dns_grouped_A_2: 209.15.224.11 ; pcap_cnt: 8776699, event_type: dns, proto: UDP, dns_type: query, dns_id: 29144, dns_rrname: dis.eu.criteo.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8776707, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29144, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dis.eu.criteo.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dis.eu.criteo.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 252, dns_answers_0_rdata: 178.250.2.77, dns_grouped_A_0: 178.250.2.77 ; pcap_cnt: 8994689, event_type: dns, proto: UDP, dns_type: query, dns_id: 57272, dns_rrname: ad.lkqd.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8994705, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57272, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad.lkqd.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ad.lkqd.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 57, dns_answers_0_rdata: cds.n3g2w2j5.hwcdn.net, dns_answers_1_rrname: cds.n3g2w2j5.hwcdn.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 58, dns_answers_1_rdata: 205.185.216.42, dns_answers_2_rrname: cds.n3g2w2j5.hwcdn.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 58, dns_answers_2_rdata: 205.185.216.10, dns_grouped_A_0: 205.185.216.42, dns_grouped_A_1: 205.185.216.10, dns_grouped_CNAME_0: cds.n3g2w2j5.hwcdn.net ; pcap_cnt: 9122355, event_type: dns, proto: UDP, dns_type: query, dns_id: 37026, dns_rrname: v4.moatads.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9122363, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37026, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: v4.moatads.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: v4.moatads.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 248, dns_answers_0_rdata: pixel.moatads.com, dns_answers_1_rrname: pixel.moatads.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 187, dns_answers_1_rdata: pool4.moatads.com, dns_grouped_CNAME_0: pixel.moatads.com, dns_grouped_CNAME_1: pool4.moatads.com, dns_authorities_0_rrname: moatads.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 248, dns_authorities_0_soa_mname: ns-617.awsdns-13.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.