['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60662, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 103, flow_bytes_toclient: 164, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 206, flow_bytes_toclient: 330, flow_age: 101, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 152, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 218, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 119, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 169, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 190, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 218, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 179, flow_bytes_toclient: 306, flow_age: 77, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 185, flow_bytes_toclient: 371, flow_age: 185, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 160, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 181, flow_bytes_toclient: 494, flow_age: 192, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 160, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 100, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 232, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 217225, event_type: dns, proto: UDP, dns_type: query, dns_id: 18306, dns_rrname: prod.contextweb.map.fastlylb.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 217243, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18306, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: prod.contextweb.map.fastlylb.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastlylb.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 2, dns_authorities_0_soa_mname: ns1.fastlylb.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2016111400, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 3505426, event_type: dns, proto: UDP, dns_type: query, dns_id: 56267, dns_rrname: sumo.external.zlb.scl3.mozilla.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3505427, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56267, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sumo.external.zlb.scl3.mozilla.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: mozilla.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1340, dns_authorities_0_soa_mname: ns.mozilla.org, dns_authorities_0_soa_rname: sysadmins.mozilla.org, dns_authorities_0_soa_serial: 2017070604, dns_authorities_0_soa_refresh: 180, dns_authorities_0_soa_retry: 180, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 3525324, event_type: dns, proto: UDP, dns_type: query, dns_id: 59860, dns_rrname: apollo-singapore.akamaized.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 3525429, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59860, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: apollo-singapore.akamaized.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: apollo-singapore.akamaized.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 20600, dns_answers_0_rdata: a126.dscg1.akamai.net, dns_answers_1_rrname: a126.dscg1.akamai.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 19, dns_answers_1_rdata: 23.15.4.17, dns_answers_2_rrname: a126.dscg1.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 23.15.4.11, dns_grouped_CNAME_0: a126.dscg1.akamai.net, dns_grouped_A_0: 23.15.4.17, dns_grouped_A_1: 23.15.4.11 ; pcap_cnt: 3798772, event_type: dns, proto: UDP, dns_type: query, dns_id: 17193, dns_rrname: tag.bounceexchange.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3798931, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17193, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tag.bounceexchange.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tag.bounceexchange.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2106, dns_answers_0_rdata: d1bb3j3myu8pmw.cloudfront.net, dns_answers_1_rrname: d1bb3j3myu8pmw.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 8, dns_answers_1_rdata: 52.84.5.22, dns_grouped_A_0: 52.84.5.22, dns_grouped_CNAME_0: d1bb3j3myu8pmw.cloudfront.net ; pcap_cnt: 4478486, event_type: dns, proto: UDP, dns_type: query, dns_id: 9259, dns_rrname: www.bengals.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4478608, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9259, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.bengals.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.bengals.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 40, dns_answers_0_rdata: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrname: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 21295, dns_answers_1_rdata: a945.b.akamai.net, dns_grouped_CNAME_0: prod.clubs.nfl.com.edgesuite.net, dns_grouped_CNAME_1: a945.b.akamai.net, dns_authorities_0_rrname: b.akamai.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1000, dns_authorities_0_soa_mname: n0b.akamai.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499433950, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 4968189, event_type: dns, proto: UDP, dns_type: query, dns_id: 12819, dns_rrname: daisy.ubuntu.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4968190, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12819, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: daisy.ubuntu.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: daisy.ubuntu.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 124, dns_answers_0_rdata: 162.213.33.164, dns_answers_1_rrname: daisy.ubuntu.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 124, dns_answers_1_rdata: 162.213.33.133, dns_grouped_A_0: 162.213.33.164, dns_grouped_A_1: 162.213.33.133 ; pcap_cnt: 5171302, event_type: dns, proto: UDP, dns_type: query, dns_id: 9866, dns_rrname: agent.aralego.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5171350, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9866, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: agent.aralego.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: aralego.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 39329, dns_authorities_0_soa_mname: ns-801.awsdns-36.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 5437316, event_type: dns, proto: UDP, dns_type: query, dns_id: 51738, dns_rrname: files1.adme.ru, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5437404, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51738, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: files1.adme.ru, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: files1.adme.ru, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 59, dns_answers_0_rdata: files.adme.ru, dns_grouped_CNAME_0: files.adme.ru, dns_authorities_0_rrname: adme.ru, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 783, dns_authorities_0_soa_mname: ns-1033.awsdns-01.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 5604808, event_type: dns, proto: UDP, dns_type: query, dns_id: 28, dns_rrname: maxcdn.bootstrapcdn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5604882, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: maxcdn.bootstrapcdn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: maxcdn.bootstrapcdn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 27, dns_answers_0_rdata: bootstrapcdn.jdorfman.netdna-cdn.com, dns_grouped_CNAME_0: bootstrapcdn.jdorfman.netdna-cdn.com, dns_authorities_0_rrname: netdna-cdn.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 433, dns_authorities_0_soa_mname: ns-97.awsdns-12.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6091275, event_type: dns, proto: UDP, dns_type: query, dns_id: 14218, dns_rrname: beacon.walmart.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6091483, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14218, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: beacon.walmart.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: beacon.walmart.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 201, dns_answers_0_rdata: beacon.walmart.com.akadns.net, dns_answers_1_rrname: beacon.walmart.com.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 253, dns_answers_1_rdata: 161.170.236.122, dns_grouped_CNAME_0: beacon.walmart.com.akadns.net, dns_grouped_A_0: 161.170.236.122 ; pcap_cnt: 6158047, event_type: dns, proto: UDP, dns_type: query, dns_id: 2445, dns_rrname: recruit.112.2o7.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 6158247, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2445, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: recruit.112.2o7.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: 2o7.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns1.omtrdc.net, dns_authorities_0_soa_rname: dnsadmin.omniture.com, dns_authorities_0_soa_serial: 2017070600, dns_authorities_0_soa_refresh: 21600, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6244185, event_type: dns, proto: UDP, dns_type: query, dns_id: 38444, dns_rrname: pipboy.btrll.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6244194, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38444, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pipboy.btrll.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pipboy.btrll.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 148, dns_answers_0_rdata: df9h93b4xzaww.cloudfront.net, dns_answers_1_rrname: df9h93b4xzaww.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 52.84.26.175, dns_answers_2_rrname: df9h93b4xzaww.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 52.84.26.84, dns_answers_3_rrname: df9h93b4xzaww.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 52.84.26.49, dns_answers_4_rrname: df9h93b4xzaww.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 52.84.26.227, dns_answers_5_rrname: df9h93b4xzaww.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 52.84.26.78, dns_answers_6_rrname: df9h93b4xzaww.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 52.84.26.248, dns_answers_7_rrname: df9h93b4xzaww.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 52.84.26.56, dns_answers_8_rrname: df9h93b4xzaww.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 52.84.26.15, dns_grouped_A_0: 52.84.26.175, dns_grouped_A_1: 52.84.26.84, dns_grouped_A_2: 52.84.26.49, dns_grouped_A_3: 52.84.26.227, dns_grouped_A_4: 52.84.26.78, dns_grouped_A_5: 52.84.26.248, dns_grouped_A_6: 52.84.26.56, dns_grouped_A_7: 52.84.26.15, dns_grouped_CNAME_0: df9h93b4xzaww.cloudfront.net ; pcap_cnt: 6281766, event_type: dns, proto: UDP, dns_type: query, dns_id: 21458, dns_rrname: partnerad.l.doubleclick.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6281836, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21458, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: partnerad.l.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: partnerad.l.doubleclick.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 289, dns_answers_0_rdata: 172.217.6.226, dns_grouped_A_0: 172.217.6.226 ; pcap_cnt: 6383816, event_type: dns, proto: UDP, dns_type: query, dns_id: 57556, dns_rrname: img.digiket.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6383830, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57556, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: img.digiket.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: digiket.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 2, dns_authorities_0_soa_mname: ns.dlmate.com, dns_authorities_0_soa_rname: webmaster.sea-links.ne.jp, dns_authorities_0_soa_serial: 2011022201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 1800, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 6677543, event_type: dns, proto: UDP, dns_type: query, dns_id: 18373, dns_rrname: analytics.voyages-sncf.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6678054, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18373, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: analytics.voyages-sncf.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: analytics.voyages-sncf.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3600, dns_answers_0_rdata: analytics.voyages-sncf.com.edgesuite.net.vsct.fr, dns_answers_1_rrname: analytics.voyages-sncf.com.edgesuite.net.vsct.fr, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 600, dns_answers_1_rdata: netstorage.cdn.cdn-vsct.fr, dns_answers_2_rrname: netstorage.cdn.cdn-vsct.fr, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 5.135.98.39, dns_answers_3_rrname: netstorage.cdn.cdn-vsct.fr, dns_answers_3_rrtype: A, dns_answers_3_ttl: 19, dns_answers_3_rdata: 164.132.124.128, dns_grouped_A_0: 5.135.98.39, dns_grouped_A_1: 164.132.124.128, dns_grouped_CNAME_0: analytics.voyages-sncf.com.edgesuite.net.vsct.fr, dns_grouped_CNAME_1: netstorage.cdn.cdn-vsct.fr ; pcap_cnt: 6726147, event_type: dns, proto: UDP, dns_type: query, dns_id: 47325, dns_rrname: t.mookie1.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6726203, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47325, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: t.mookie1.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: t.mookie1.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 257, dns_answers_0_rdata: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 44, dns_answers_1_rdata: 52.200.94.240, dns_answers_2_rrname: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 44, dns_answers_2_rdata: 34.204.222.123, dns_answers_3_rrname: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 44, dns_answers_3_rdata: 52.202.238.206, dns_answers_4_rrname: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 44, dns_answers_4_rdata: 34.226.59.187, dns_answers_5_rrname: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 44, dns_answers_5_rdata: 34.206.244.230, dns_answers_6_rrname: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 44, dns_answers_6_rdata: 50.16.19.35, dns_answers_7_rrname: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 44, dns_answers_7_rdata: 107.23.49.153, dns_answers_8_rrname: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 44, dns_answers_8_rdata: 34.206.167.59, dns_grouped_CNAME_0: xs2-1096111735.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 52.200.94.240, dns_grouped_A_1: 34.204.222.123, dns_grouped_A_2: 52.202.238.206, dns_grouped_A_3: 34.226.59.187, dns_grouped_A_4: 34.206.244.230, dns_grouped_A_5: 50.16.19.35, dns_grouped_A_6: 107.23.49.153, dns_grouped_A_7: 34.206.167.59 ; pcap_cnt: 7345575, event_type: dns, proto: UDP, dns_type: query, dns_id: 64501, dns_rrname: prod.appnexus.map.fastly.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7345616, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64501, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: prod.appnexus.map.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 6, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 7548428, event_type: dns, proto: UDP, dns_type: query, dns_id: 58916, dns_rrname: e8218.dscb1.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7548507, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58916, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e8218.dscb1.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: e8218.dscb1.akamaiedge.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2600:1408:e000:019a:0000:0000:0000:201a, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 1, dns_answers_1_rdata: 2600:1408:e000:0182:0000:0000:0000:201a, dns_grouped_AAAA_0: 2600:1408:e000:019a:0000:0000:0000:201a, dns_grouped_AAAA_1: 2600:1408:e000:0182:0000:0000:0000:201a ; pcap_cnt: 9877695, event_type: dns, proto: UDP, dns_type: query, dns_id: 7119, dns_rrname: www.google.ca, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9877696, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7119, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.google.ca, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.google.ca, dns_answers_0_rrtype: A, dns_answers_0_ttl: 198, dns_answers_0_rdata: 172.217.3.99, dns_grouped_A_0: 172.217.3.99 ; pcap_cnt: 9935856, event_type: dns, proto: UDP, dns_type: query, dns_id: 26603, dns_rrname: tap-s.rubiconproject.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9935865, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26603, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tap-s.rubiconproject.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: tap-s.rubiconproject.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 307, dns_answers_0_rdata: tap-s-2076851614.us-east-1.elb.amazonaws.com, dns_grouped_CNAME_0: tap-s-2076851614.us-east-1.elb.amazonaws.com, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 17, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.