['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 62493, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 247, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 169, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 192, flow_bytes_toclient: 405, flow_age: 184, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 194, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 172, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 165, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 133, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 102, flow_bytes_toclient: 142, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 193, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 150, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 186, flow_bytes_toclient: 400, flow_age: 5, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 166, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 141, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 156, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 123, flow_bytes_toclient: 201, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 155, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 198, flow_bytes_toclient: 341, flow_age: 50, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 80, flow_bytes_toclient: 96, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 152, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 185, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 174, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 228, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 512677, event_type: dns, proto: UDP, dns_type: query, dns_id: 64479, dns_rrname: nesngo.nesn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 513929, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64479, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: nesngo.nesn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: nesngo.nesn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2686, dns_answers_0_rdata: nesngo.nesn.com.cname.web.nesn.com, dns_answers_1_rrname: nesngo.nesn.com.cname.web.nesn.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 599, dns_answers_1_rdata: d3tyxwvcutcmmz.cloudfront.net, dns_grouped_CNAME_0: nesngo.nesn.com.cname.web.nesn.com, dns_grouped_CNAME_1: d3tyxwvcutcmmz.cloudfront.net, dns_authorities_0_rrname: d3tyxwvcutcmmz.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns-592.awsdns-10.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 5187685, event_type: dns, proto: UDP, dns_type: query, dns_id: 17841, dns_rrname: 67.173.229.192.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 5187940, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17841, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 67.173.229.192.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 173.229.192.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 584, dns_authorities_0_soa_mname: ns1.edgecastcdn.net, dns_authorities_0_soa_rname: noc.edgecast.com, dns_authorities_0_soa_serial: 2017031400, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 5754699, event_type: dns, proto: UDP, dns_type: query, dns_id: 61658, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5754825, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61658, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 12, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 19, dns_answers_1_rdata: 23.50.75.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.50.75.27 ; pcap_cnt: 5816606, event_type: dns, proto: UDP, dns_type: query, dns_id: 6404, dns_rrname: x.bidswitch.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5816657, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6404, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: x.bidswitch.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: x.bidswitch.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 104.196.48.127, dns_answers_1_rrname: x.bidswitch.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 35.185.4.36, dns_answers_2_rrname: x.bidswitch.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 104.196.50.110, dns_answers_3_rrname: x.bidswitch.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 35.185.7.51, dns_answers_4_rrname: x.bidswitch.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 104.196.189.120, dns_answers_5_rrname: x.bidswitch.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 104.196.137.206, dns_answers_6_rrname: x.bidswitch.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 104.196.13.90, dns_answers_7_rrname: x.bidswitch.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 35.185.15.58, dns_answers_8_rrname: x.bidswitch.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 104.196.154.29, dns_answers_9_rrname: x.bidswitch.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 1, dns_answers_9_rdata: 104.196.214.123, dns_grouped_A_0: 104.196.48.127, dns_grouped_A_1: 35.185.4.36, dns_grouped_A_2: 104.196.50.110, dns_grouped_A_3: 35.185.7.51, dns_grouped_A_4: 104.196.189.120, dns_grouped_A_5: 104.196.137.206, dns_grouped_A_6: 104.196.13.90, dns_grouped_A_7: 35.185.15.58, dns_grouped_A_8: 104.196.154.29, dns_grouped_A_9: 104.196.214.123 ; pcap_cnt: 6334189, event_type: dns, proto: UDP, dns_type: query, dns_id: 30636, dns_rrname: a.cdn.intentmedia.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6334324, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30636, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a.cdn.intentmedia.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a.cdn.intentmedia.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 57, dns_answers_0_rdata: intent-media.map.fastly.net, dns_answers_1_rrname: intent-media.map.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 29, dns_answers_1_rdata: 151.101.2.111, dns_answers_2_rrname: intent-media.map.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 29, dns_answers_2_rdata: 151.101.66.111, dns_answers_3_rrname: intent-media.map.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 29, dns_answers_3_rdata: 151.101.130.111, dns_answers_4_rrname: intent-media.map.fastly.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 29, dns_answers_4_rdata: 151.101.194.111, dns_grouped_CNAME_0: intent-media.map.fastly.net, dns_grouped_A_0: 151.101.2.111, dns_grouped_A_1: 151.101.66.111, dns_grouped_A_2: 151.101.130.111, dns_grouped_A_3: 151.101.194.111 ; pcap_cnt: 6519715, event_type: dns, proto: UDP, dns_type: query, dns_id: 32568, dns_rrname: native.sharethrough.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6519725, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32568, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: native.sharethrough.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: sharethrough.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 243, dns_authorities_0_soa_mname: ns-364.awsdns-45.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6746221, event_type: dns, proto: UDP, dns_type: query, dns_id: 18833, dns_rrname: asset.pagefair.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6746243, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18833, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: asset.pagefair.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: asset.pagefair.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: asset-pagefair-com.pagefairlimited.netdna-cdn.com, dns_answers_1_rrname: asset-pagefair-com.pagefairlimited.netdna-cdn.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 7, dns_answers_1_rdata: 23.111.9.30, dns_grouped_A_0: 23.111.9.30, dns_grouped_CNAME_0: asset-pagefair-com.pagefairlimited.netdna-cdn.com ; pcap_cnt: 6842145, event_type: dns, proto: UDP, dns_type: query, dns_id: 2203, dns_rrname: adx.g.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6842222, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2203, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adx.g.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: adx.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: pagead46.l.doubleclick.net, dns_answers_1_rrname: pagead46.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 297, dns_answers_1_rdata: 172.217.10.34, dns_grouped_CNAME_0: pagead46.l.doubleclick.net, dns_grouped_A_0: 172.217.10.34 ; pcap_cnt: 7082288, event_type: dns, proto: UDP, dns_type: query, dns_id: 9522, dns_rrname: safebrowsing.clients.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7082289, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9522, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: safebrowsing.clients.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: safebrowsing.clients.google.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: clients.l.google.com, dns_answers_1_rrname: clients.l.google.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 128, dns_answers_1_rdata: 172.217.3.110, dns_grouped_A_0: 172.217.3.110, dns_grouped_CNAME_0: clients.l.google.com ; pcap_cnt: 7515973, event_type: dns, proto: UDP, dns_type: query, dns_id: 21424, dns_rrname: www.patriots.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7516008, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21424, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.patriots.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.patriots.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 300, dns_answers_0_rdata: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrname: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20897, dns_answers_1_rdata: a945.b.akamai.net, dns_answers_2_rrname: a945.b.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 2, dns_answers_2_rdata: 72.246.56.136, dns_answers_3_rrname: a945.b.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 2, dns_answers_3_rdata: 72.246.56.138, dns_grouped_CNAME_0: prod.clubs.nfl.com.edgesuite.net, dns_grouped_CNAME_1: a945.b.akamai.net, dns_grouped_A_0: 72.246.56.136, dns_grouped_A_1: 72.246.56.138 ; pcap_cnt: 7688898, event_type: dns, proto: UDP, dns_type: query, dns_id: 10567, dns_rrname: 29.242.139.151.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7688931, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10567, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 29.242.139.151.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 139.151.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1203, dns_authorities_0_soa_mname: ns1.hwng.net, dns_authorities_0_soa_rname: noc.hwng.net, dns_authorities_0_soa_serial: 2017051702, dns_authorities_0_soa_refresh: 14400, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 7841230, event_type: dns, proto: UDP, dns_type: query, dns_id: 16703, dns_rrname: 193.22.207.23.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7841358, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16703, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 193.22.207.23.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 193.22.207.23.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 884, dns_answers_0_rdata: a23-207-22-193.deploy.static.akamaitechnologies.com, dns_grouped_PTR_0: a23-207-22-193.deploy.static.akamaitechnologies.com ; pcap_cnt: 7842253, event_type: dns, proto: UDP, dns_type: query, dns_id: 29970, dns_rrname: tapestry.tapad.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 7842311, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29970, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tapestry.tapad.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tapestry.tapad.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 213, dns_answers_0_rdata: tapestry-us-east.tapad.com, dns_answers_1_rrname: tapestry-us-east.tapad.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 82, dns_answers_1_rdata: vhosts-us-east.tapad.com, dns_answers_2_rrname: vhosts-us-east.tapad.com, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 82, dns_answers_2_rdata: vhosts-nj1.tapad.com, dns_answers_3_rrname: vhosts-nj1.tapad.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 140, dns_answers_3_rdata: 198.51.152.183, dns_answers_4_rrname: vhosts-nj1.tapad.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 140, dns_answers_4_rdata: 198.51.152.184, dns_answers_5_rrname: vhosts-nj1.tapad.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 140, dns_answers_5_rdata: 198.51.152.178, dns_answers_6_rrname: vhosts-nj1.tapad.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 140, dns_answers_6_rdata: 198.51.152.179, dns_grouped_A_0: 198.51.152.183, dns_grouped_A_1: 198.51.152.184, dns_grouped_A_2: 198.51.152.178, dns_grouped_A_3: 198.51.152.179, dns_grouped_CNAME_0: tapestry-us-east.tapad.com, dns_grouped_CNAME_1: vhosts-us-east.tapad.com, dns_grouped_CNAME_2: vhosts-nj1.tapad.com ; pcap_cnt: 7938055, event_type: dns, proto: UDP, dns_type: query, dns_id: 28620, dns_rrname: 91.116.187.199.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7938059, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28620, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 91.116.187.199.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 116.187.199.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 941, dns_authorities_0_soa_mname: a1-175.akam.net, dns_authorities_0_soa_rname: hostmaster.asia1.akam.net, dns_authorities_0_soa_serial: 2016111005, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 14400, dns_authorities_0_soa_expire: 3600000, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8312161, event_type: dns, proto: UDP, dns_type: query, dns_id: 2527, dns_rrname: lvlt.vs3.com.fpbns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8312170, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2527, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: lvlt.vs3.com.fpbns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: lvlt.vs3.com.fpbns.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 229, dns_answers_0_rdata: 8.27.240.253, dns_answers_1_rrname: lvlt.vs3.com.fpbns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 229, dns_answers_1_rdata: 8.27.240.125, dns_answers_2_rrname: lvlt.vs3.com.fpbns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 229, dns_answers_2_rdata: 8.27.238.126, dns_grouped_A_0: 8.27.240.253, dns_grouped_A_1: 8.27.240.125, dns_grouped_A_2: 8.27.238.126 ; pcap_cnt: 8539142, event_type: dns, proto: UDP, dns_type: query, dns_id: 34851, dns_rrname: pagead2.googlesyndication.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8539170, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34851, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pagead2.googlesyndication.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pagead2.googlesyndication.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: pagead46.l.doubleclick.net, dns_answers_1_rrname: pagead46.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 294, dns_answers_1_rdata: 172.217.10.130, dns_grouped_CNAME_0: pagead46.l.doubleclick.net, dns_grouped_A_0: 172.217.10.130 ; pcap_cnt: 8885432, event_type: dns, proto: UDP, dns_type: query, dns_id: 9481, dns_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8885469, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9481, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-2.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 30, dns_authorities_0_soa_mname: ns-332.awsdns-41.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 8985185, event_type: dns, proto: UDP, dns_type: query, dns_id: 57637, dns_rrname: e13189.g.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8985199, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57637, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e13189.g.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 530, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499186971, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 9272533, event_type: dns, proto: UDP, dns_type: query, dns_id: 62563, dns_rrname: delivery.swid.switchadhub.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9272575, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62563, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: delivery.swid.switchadhub.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: delivery.swid.switchadhub.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 684, dns_answers_0_rdata: delivery.swid.switchads.com, dns_grouped_CNAME_0: delivery.swid.switchads.com, dns_authorities_0_rrname: switchads.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 353, dns_authorities_0_soa_mname: ns1.swtch.io, dns_authorities_0_soa_rname: webmaster:swtch.io, dns_authorities_0_soa_serial: 2017062301, dns_authorities_0_soa_refresh: 1200, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2400000, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 9300009, event_type: dns, proto: UDP, dns_type: query, dns_id: 22626, dns_rrname: googleads.g.doubleclick.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 9300030, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22626, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleads.g.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: googleads.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: pagead46.l.doubleclick.net, dns_answers_1_rrname: pagead46.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 257, dns_answers_1_rdata: 172.217.12.194, dns_grouped_CNAME_0: pagead46.l.doubleclick.net, dns_grouped_A_0: 172.217.12.194 ; pcap_cnt: 9432230, event_type: dns, proto: UDP, dns_type: query, dns_id: 21990, dns_rrname: adv.wp.pl, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9432244, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21990, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adv.wp.pl, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: adv.wp.pl, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1351, dns_answers_0_rdata: 212.77.100.127, dns_grouped_A_0: 212.77.100.127 ; pcap_cnt: 9544989, event_type: dns, proto: UDP, dns_type: query, dns_id: 55287, dns_rrname: dart.l.doubleclick.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9544990, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55287, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dart.l.doubleclick.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: l.doubleclick.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 599, dns_authorities_0_soa_mname: ns1.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 160883472, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 10242724, event_type: dns, proto: UDP, dns_type: query, dns_id: 51146, dns_rrname: e6913.dscx.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10242785, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51146, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e6913.dscx.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: e6913.dscx.akamaiedge.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 19, dns_answers_0_rdata: 2001:0418:143c:0185:0000:0000:0000:1b01, dns_answers_1_rrname: e6913.dscx.akamaiedge.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 19, dns_answers_1_rdata: 2001:0418:143c:018b:0000:0000:0000:1b01, dns_grouped_AAAA_0: 2001:0418:143c:0185:0000:0000:0000:1b01, dns_grouped_AAAA_1: 2001:0418:143c:018b:0000:0000:0000:1b01 ; pcap_cnt: 10434973, event_type: dns, proto: UDP, dns_type: query, dns_id: 10224, dns_rrname: pi.pardot.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10435073, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10224, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pi.pardot.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: pi.pardot.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 296, dns_answers_0_rdata: pi-phx.pardot.com, dns_answers_1_rrname: pi-phx.pardot.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 21, dns_answers_1_rdata: pi-phx-lb3.pardot.com, dns_grouped_CNAME_0: pi-phx.pardot.com, dns_grouped_CNAME_1: pi-phx-lb3.pardot.com, dns_authorities_0_rrname: pardot.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 312, dns_authorities_0_soa_mname: ns1.salesforce.com, dns_authorities_0_soa_rname: dns.pardot.com, dns_authorities_0_soa_serial: 5372, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 11400385, event_type: dns, proto: UDP, dns_type: query, dns_id: 52484, dns_rrname: goibibo.ibcdn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11400458, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52484, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: goibibo.ibcdn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: goibibo.ibcdn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 70, dns_answers_0_rdata: goibibo.com.edgekey.net, dns_answers_1_rrname: goibibo.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 12290, dns_answers_1_rdata: e6648.b.akamaiedge.net, dns_answers_2_rrname: e6648.b.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 20, dns_answers_2_rdata: 104.88.10.115, dns_grouped_CNAME_0: goibibo.com.edgekey.net, dns_grouped_CNAME_1: e6648.b.akamaiedge.net, dns_grouped_A_0: 104.88.10.115 ; pcap_cnt: 11465433, event_type: dns, proto: UDP, dns_type: query, dns_id: 13901, dns_rrname: cdn.onesignal.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11465523, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13901, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.onesignal.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.onesignal.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2400:cb00:2048:0001:0000:0000:6810:cda5, dns_answers_1_rrname: cdn.onesignal.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 1, dns_answers_1_rdata: 2400:cb00:2048:0001:0000:0000:6810:cca5, dns_answers_2_rrname: cdn.onesignal.com, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 1, dns_answers_2_rdata: 2400:cb00:2048:0001:0000:0000:6810:cfa5, dns_answers_3_rrname: cdn.onesignal.com, dns_answers_3_rrtype: AAAA, dns_answers_3_ttl: 1, dns_answers_3_rdata: 2400:cb00:2048:0001:0000:0000:6810:cea5, dns_answers_4_rrname: cdn.onesignal.com, dns_answers_4_rrtype: AAAA, dns_answers_4_ttl: 1, dns_answers_4_rdata: 2400:cb00:2048:0001:0000:0000:6810:d0a5, dns_grouped_AAAA_0: 2400:cb00:2048:0001:0000:0000:6810:cda5, dns_grouped_AAAA_1: 2400:cb00:2048:0001:0000:0000:6810:cca5, dns_grouped_AAAA_2: 2400:cb00:2048:0001:0000:0000:6810:cfa5, dns_grouped_AAAA_3: 2400:cb00:2048:0001:0000:0000:6810:cea5, dns_grouped_AAAA_4: 2400:cb00:2048:0001:0000:0000:6810:d0a5
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.