['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 62086, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 223, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 177, flow_bytes_toclient: 239, flow_age: 20, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 195, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 173, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 102, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 150, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 184, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 185, flow_bytes_toclient: 273, flow_age: 165, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 320, flow_age: 2, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 159, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 182, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 154, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 231, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 184, flow_bytes_toclient: 287, flow_age: 67, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 156, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 124, flow_bytes_toclient: 252, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 101, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 3619918, event_type: dns, proto: UDP, dns_type: query, dns_id: 15774, dns_rrname: bids.proper.io, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3620179, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15774, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: bids.proper.io, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: bids.proper.io, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 289, dns_answers_0_rdata: bids-elb-195079410.us-west-2.elb.amazonaws.com, dns_grouped_CNAME_0: bids-elb-195079410.us-west-2.elb.amazonaws.com, dns_authorities_0_rrname: us-west-2.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 29, dns_authorities_0_soa_mname: ns-332.awsdns-41.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 3792675, event_type: dns, proto: UDP, dns_type: query, dns_id: 16495, dns_rrname: www.asriran.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3792685, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16495, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.asriran.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.asriran.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3503, dns_answers_0_rdata: asriran.com, dns_answers_1_rrname: asriran.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 2170, dns_answers_1_rdata: 94.182.146.195, dns_grouped_CNAME_0: asriran.com, dns_grouped_A_0: 94.182.146.195 ; pcap_cnt: 3807813, event_type: dns, proto: UDP, dns_type: query, dns_id: 16324, dns_rrname: a771.dscq.akamai.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 3807823, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16324, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a771.dscq.akamai.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a771.dscq.akamai.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 19, dns_answers_0_rdata: 23.15.4.10, dns_answers_1_rrname: a771.dscq.akamai.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 19, dns_answers_1_rdata: 23.15.4.18, dns_grouped_A_0: 23.15.4.10, dns_grouped_A_1: 23.15.4.18 ; pcap_cnt: 4519598, event_type: dns, proto: UDP, dns_type: query, dns_id: 2259, dns_rrname: static-wildcat.nfl.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4519604, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2259, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static-wildcat.nfl.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: static-wildcat.nfl.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 138, dns_answers_0_rdata: http2.nfl.map.fastly.net, dns_answers_1_rrname: http2.nfl.map.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 5, dns_answers_1_rdata: 151.101.1.63, dns_answers_2_rrname: http2.nfl.map.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 5, dns_answers_2_rdata: 151.101.65.63, dns_answers_3_rrname: http2.nfl.map.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 5, dns_answers_3_rdata: 151.101.129.63, dns_answers_4_rrname: http2.nfl.map.fastly.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 5, dns_answers_4_rdata: 151.101.193.63, dns_grouped_CNAME_0: http2.nfl.map.fastly.net, dns_grouped_A_0: 151.101.1.63, dns_grouped_A_1: 151.101.65.63, dns_grouped_A_2: 151.101.129.63, dns_grouped_A_3: 151.101.193.63 ; pcap_cnt: 4712385, event_type: dns, proto: UDP, dns_type: query, dns_id: 46675, dns_rrname: 201.148.120.74.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 4712393, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46675, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 201.148.120.74.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 148.120.74.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns1.p05.dynect.net, dns_authorities_0_soa_rname: zone-admin.dyndns.com, dns_authorities_0_soa_serial: 12, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 4963543, event_type: dns, proto: UDP, dns_type: query, dns_id: 26673, dns_rrname: connect.ubi.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4963549, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26673, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: connect.ubi.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: connect.ubi.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 2422, dns_answers_0_rdata: 216.98.48.226, dns_grouped_A_0: 216.98.48.226 ; pcap_cnt: 5085764, event_type: dns, proto: UDP, dns_type: query, dns_id: 59790, dns_rrname: www1.mpnrs.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5086156, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59790, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www1.mpnrs.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: mpnrs.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1799, dns_authorities_0_soa_mname: ns1.rh-tec.com, dns_authorities_0_soa_rname: admin.mp-newmedia.com, dns_authorities_0_soa_serial: 2017062713, dns_authorities_0_soa_refresh: 40000, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 86400, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 5283447, event_type: dns, proto: UDP, dns_type: query, dns_id: 31320, dns_rrname: impression.mediaiqdigital.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5283482, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31320, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: impression.mediaiqdigital.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: mediaiqdigital.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 126, dns_authorities_0_soa_mname: ns-1658.awsdns-15.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6108926, event_type: dns, proto: UDP, dns_type: query, dns_id: 21554, dns_rrname: e3972.dscg.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6109075, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21554, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e3972.dscg.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: e3972.dscg.akamaiedge.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 19, dns_answers_0_rdata: 2001:0418:1456:0980:0000:0000:0000:0f84, dns_answers_1_rrname: e3972.dscg.akamaiedge.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 19, dns_answers_1_rdata: 2001:0418:1456:0986:0000:0000:0000:0f84, dns_grouped_AAAA_0: 2001:0418:1456:0980:0000:0000:0000:0f84, dns_grouped_AAAA_1: 2001:0418:1456:0986:0000:0000:0000:0f84 ; pcap_cnt: 6191117, event_type: dns, proto: UDP, dns_type: query, dns_id: 27010, dns_rrname: vcore.connatix.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6191120, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 27010, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: vcore.connatix.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: vcore.connatix.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 52.203.225.47, dns_answers_1_rrname: vcore.connatix.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 54.172.218.83, dns_grouped_A_0: 52.203.225.47, dns_grouped_A_1: 54.172.218.83 ; pcap_cnt: 6448538, event_type: dns, proto: UDP, dns_type: query, dns_id: 27599, dns_rrname: i0.sinaimg.cn, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6448757, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 27599, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: i0.sinaimg.cn, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: i0.sinaimg.cn, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 232, dns_answers_0_rdata: www.sinaimg.cn, dns_answers_1_rrname: www.sinaimg.cn, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 592, dns_answers_1_rdata: i3.sina.com.cn, dns_answers_2_rrname: i3.sina.com.cn, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 2888, dns_answers_2_rdata: adiwlbs.gslb.sinaedge.com, dns_answers_3_rrname: adiwlbs.gslb.sinaedge.com, dns_answers_3_rrtype: CNAME, dns_answers_3_ttl: 57, dns_answers_3_rdata: jtpool.grid.sinaedge.com, dns_answers_4_rrname: jtpool.grid.sinaedge.com, dns_answers_4_rrtype: CNAME, dns_answers_4_ttl: 0, dns_answers_4_rdata: sinaimg.cn.edgekey.net, dns_answers_5_rrname: sinaimg.cn.edgekey.net, dns_answers_5_rrtype: CNAME, dns_answers_5_ttl: 1455, dns_answers_5_rdata: e4141.b.akamaiedge.net, dns_grouped_CNAME_0: www.sinaimg.cn, dns_grouped_CNAME_1: i3.sina.com.cn, dns_grouped_CNAME_2: adiwlbs.gslb.sinaedge.com, dns_grouped_CNAME_3: jtpool.grid.sinaedge.com, dns_grouped_CNAME_4: sinaimg.cn.edgekey.net, dns_grouped_CNAME_5: e4141.b.akamaiedge.net, dns_authorities_0_rrname: b.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 166, dns_authorities_0_soa_mname: n0b.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499446330, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 6515831, event_type: dns, proto: UDP, dns_type: query, dns_id: 30499, dns_rrname: secure.commentcamarche.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6515881, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30499, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: secure.commentcamarche.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: commentcamarche.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 600, dns_authorities_0_soa_mname: ns1.benchmark.fr, dns_authorities_0_soa_rname: webmaster.commentcamarche.net, dns_authorities_0_soa_serial: 2017062201, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 6566004, event_type: dns, proto: UDP, dns_type: query, dns_id: 14404, dns_rrname: googleads4.g.doubleclick.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6566173, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14404, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleads4.g.doubleclick.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: googleads4.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: pagead.l.doubleclick.net, dns_grouped_CNAME_0: pagead.l.doubleclick.net, dns_authorities_0_rrname: l.doubleclick.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 599, dns_authorities_0_soa_mname: ns3.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 161179285, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6644634, event_type: dns, proto: UDP, dns_type: query, dns_id: 26273, dns_rrname: e9690.b.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6644635, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26273, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e9690.b.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: b.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 257, dns_authorities_0_soa_mname: n0b.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499447394, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 6931462, event_type: dns, proto: UDP, dns_type: query, dns_id: 46042, dns_rrname: steps.citi.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6931669, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46042, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: steps.citi.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: steps.citi.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2819, dns_answers_0_rdata: steps-citi-com-1688935196.us-east-1.elb.amazonaws.com, dns_grouped_CNAME_0: steps-citi-com-1688935196.us-east-1.elb.amazonaws.com, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7117334, event_type: dns, proto: UDP, dns_type: query, dns_id: 15961, dns_rrname: e2008.x.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7117335, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15961, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e2008.x.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: x.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 865, dns_authorities_0_soa_mname: n0x.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499449856, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 7137070, event_type: dns, proto: UDP, dns_type: query, dns_id: 23546, dns_rrname: platform.twitter.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 7137110, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23546, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: platform.twitter.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: platform.twitter.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2, dns_answers_0_rdata: platform-eb.twitter.com, dns_answers_1_rrname: platform-eb.twitter.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 73, dns_answers_1_rdata: 199.96.57.6, dns_grouped_CNAME_0: platform-eb.twitter.com, dns_grouped_A_0: 199.96.57.6 ; pcap_cnt: 7583007, event_type: dns, proto: UDP, dns_type: query, dns_id: 33060, dns_rrname: e1879.e7.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7583016, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33060, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e1879.e7.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: e7.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 229, dns_authorities_0_soa_mname: n0e7.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499450383, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 8001721, event_type: dns, proto: UDP, dns_type: query, dns_id: 1086, dns_rrname: jsonp-us-east-1-773824149.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8001724, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1086, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: jsonp-us-east-1-773824149.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: jsonp-us-east-1-773824149.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 7, dns_answers_0_rdata: 52.202.77.112, dns_answers_1_rrname: jsonp-us-east-1-773824149.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 7, dns_answers_1_rdata: 34.200.205.45, dns_answers_2_rrname: jsonp-us-east-1-773824149.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 7, dns_answers_2_rdata: 34.200.171.129, dns_answers_3_rrname: jsonp-us-east-1-773824149.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 7, dns_answers_3_rdata: 52.203.5.139, dns_answers_4_rrname: jsonp-us-east-1-773824149.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 7, dns_answers_4_rdata: 34.198.227.60, dns_answers_5_rrname: jsonp-us-east-1-773824149.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 7, dns_answers_5_rdata: 52.203.242.54, dns_answers_6_rrname: jsonp-us-east-1-773824149.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 7, dns_answers_6_rdata: 52.203.32.111, dns_answers_7_rrname: jsonp-us-east-1-773824149.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 7, dns_answers_7_rdata: 52.20.12.16, dns_grouped_A_0: 52.202.77.112, dns_grouped_A_1: 34.200.205.45, dns_grouped_A_2: 34.200.171.129, dns_grouped_A_3: 52.203.5.139, dns_grouped_A_4: 34.198.227.60, dns_grouped_A_5: 52.203.242.54, dns_grouped_A_6: 52.203.32.111, dns_grouped_A_7: 52.20.12.16 ; pcap_cnt: 9709637, event_type: dns, proto: UDP, dns_type: query, dns_id: 9656, dns_rrname: www.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9709645, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9656, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 133, dns_answers_0_rdata: 216.58.217.164, dns_grouped_A_0: 216.58.217.164
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.