['flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.14, src_port: 61004, dest_ip: 192.168.10.3, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 180, flow_bytes_toclient: 264, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 224, flow_bytes_toclient: 416, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 508, flow_bytes_toclient: 832, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 3745967, event_type: dns, proto: UDP, dns_type: query, dns_id: 261, dns_rrname: securepubads.g.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3745968, event_type: dns, proto: UDP, dns_type: query, dns_id: 261, dns_rrname: securepubads.g.doubleclick.net, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 3745969, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 261, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: securepubads.g.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: securepubads.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 29968, dns_answers_0_rdata: partnerad.l.doubleclick.net, dns_answers_1_rrname: partnerad.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 295, dns_answers_1_rdata: 172.217.2.162, dns_grouped_A_0: 172.217.2.162, dns_grouped_CNAME_0: partnerad.l.doubleclick.net ; pcap_cnt: 3745970, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 261, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: securepubads.g.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: securepubads.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 29968, dns_answers_0_rdata: partnerad.l.doubleclick.net, dns_answers_1_rrname: partnerad.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 295, dns_answers_1_rdata: 172.217.2.162, dns_grouped_CNAME_0: partnerad.l.doubleclick.net, dns_grouped_A_0: 172.217.2.162 ; pcap_cnt: 6078012, event_type: dns, proto: UDP, dns_type: query, dns_id: 18973, dns_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6078013, event_type: dns, proto: UDP, dns_type: query, dns_id: 18973, dns_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 6078016, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18973, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 34.197.153.196, dns_answers_1_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 54.210.92.2, dns_answers_2_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 52.2.30.221, dns_answers_3_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 54.172.28.64, dns_answers_4_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 52.44.236.149, dns_answers_5_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 52.207.199.11, dns_grouped_A_0: 34.197.153.196, dns_grouped_A_1: 54.210.92.2, dns_grouped_A_2: 52.2.30.221, dns_grouped_A_3: 54.172.28.64, dns_grouped_A_4: 52.44.236.149, dns_grouped_A_5: 52.207.199.11 ; pcap_cnt: 6078017, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18973, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 34.197.153.196, dns_answers_1_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 54.210.92.2, dns_answers_2_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 52.2.30.221, dns_answers_3_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 54.172.28.64, dns_answers_4_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 52.44.236.149, dns_answers_5_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 52.207.199.11, dns_grouped_A_0: 34.197.153.196, dns_grouped_A_1: 54.210.92.2, dns_grouped_A_2: 52.2.30.221, dns_grouped_A_3: 54.172.28.64, dns_grouped_A_4: 52.44.236.149, dns_grouped_A_5: 52.207.199.11 ; pcap_cnt: 9448979, event_type: dns, proto: UDP, dns_type: query, dns_id: 20077, dns_rrname: ttd-uswest-insight-adsrvr-org-875663112.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9448980, event_type: dns, proto: UDP, dns_type: query, dns_id: 20077, dns_rrname: ttd-uswest-insight-adsrvr-org-875663112.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 1 ; pcap_cnt: 9449008, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20077, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ttd-uswest-insight-adsrvr-org-875663112.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 13, dns_authorities_0_soa_mname: ns-699.awsdns-23.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 9449010, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20077, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ttd-uswest-insight-adsrvr-org-875663112.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 13, dns_authorities_0_soa_mname: ns-699.awsdns-23.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 9449023, event_type: dns, proto: UDP, dns_type: query, dns_id: 20077, dns_rrname: ttd-uswest-insight-adsrvr-org-875663112.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 4 ; pcap_cnt: 9449024, event_type: dns, proto: UDP, dns_type: query, dns_id: 20077, dns_rrname: ttd-uswest-insight-adsrvr-org-875663112.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 5 ; pcap_cnt: 9449025, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20077, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ttd-uswest-insight-adsrvr-org-875663112.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 13, dns_authorities_0_soa_mname: ns-699.awsdns-23.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 9449026, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20077, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ttd-uswest-insight-adsrvr-org-875663112.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 13, dns_authorities_0_soa_mname: ns-699.awsdns-23.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.