['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61306, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 196, flow_bytes_toclient: 321, flow_age: 3, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 100, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 135, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 119, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 294, flow_bytes_toclient: 519, flow_age: 126, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 149, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 107, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 180, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 186, flow_bytes_toclient: 416, flow_age: 73, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 108, flow_bytes_toclient: 169, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 345, flow_bytes_toclient: 689, flow_age: 190, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 209, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 107, flow_bytes_toclient: 135, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 105, flow_age: 1, flow_state: established, flow_reason: timeout ; pcap_cnt: 495457, event_type: dns, proto: UDP, dns_type: query, dns_id: 48377, dns_rrname: oasc18b.247realmedia.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 495628, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48377, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: oasc18b.247realmedia.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: 247realmedia.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 118, dns_authorities_0_soa_mname: dns1.p05.nsone.net, dns_authorities_0_soa_rname: hostmaster.nsone.net, dns_authorities_0_soa_serial: 1496966310, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 507362, event_type: dns, proto: UDP, dns_type: query, dns_id: 57885, dns_rrname: integrate.pxoe.wip.247-inc.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 507389, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57885, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: integrate.pxoe.wip.247-inc.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: wip.247-inc.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1338, dns_authorities_0_soa_mname: 66.170.126.8.wip.247-inc.net, dns_authorities_0_soa_rname: hostmaster.66.170.126.8.wip.247-inc.net, dns_authorities_0_soa_serial: 2013084801, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 5583646, event_type: dns, proto: UDP, dns_type: query, dns_id: 42367, dns_rrname: www.google.ca, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5583760, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42367, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.google.ca, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.google.ca, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 172.217.7.227, dns_grouped_A_0: 172.217.7.227 ; pcap_cnt: 5659123, event_type: dns, proto: UDP, dns_type: query, dns_id: 30444, dns_rrname: pipe.orf.at, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5659142, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30444, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pipe.orf.at, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: orf.at, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 28763, dns_authorities_0_soa_mname: ns1.apa.at, dns_authorities_0_soa_rname: netadmin.orf.at, dns_authorities_0_soa_serial: 2017062901, dns_authorities_0_soa_refresh: 14400, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 5799208, event_type: dns, proto: UDP, dns_type: query, dns_id: 24796, dns_rrname: clients.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5799211, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24796, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: clients.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: clients.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 192, dns_answers_0_rdata: 2607:f8b0:4006:0803:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0803:0000:0000:0000:200e ; pcap_cnt: 6354585, event_type: dns, proto: UDP, dns_type: query, dns_id: 49104, dns_rrname: 1.share.photo.xuite.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6354634, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49104, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 1.share.photo.xuite.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: 1.share.photo.xuite.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 119, dns_answers_0_rdata: 0.share.photo.xuite.net, dns_answers_1_rrname: 0.share.photo.xuite.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 210.61.56.24, dns_grouped_CNAME_0: 0.share.photo.xuite.net, dns_grouped_A_0: 210.61.56.24 ; pcap_cnt: 6368229, event_type: dns, proto: UDP, dns_type: query, dns_id: 32673, dns_rrname: anycast.dt.adsafeprotected.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 6368259, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32673, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: anycast.dt.adsafeprotected.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adsafeprotected.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 8, dns_authorities_0_soa_mname: dns1.p05.nsone.net, dns_authorities_0_soa_rname: hostmaster.nsone.net, dns_authorities_0_soa_serial: 1497564449, dns_authorities_0_soa_refresh: 180, dns_authorities_0_soa_retry: 180, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 7200 ; pcap_cnt: 6394530, event_type: dns, proto: UDP, dns_type: query, dns_id: 52652, dns_rrname: dab1nmslvvntp.cloudfront.net, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 6394573, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52652, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dab1nmslvvntp.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dab1nmslvvntp.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 60, dns_answers_0_rdata: 54.192.36.27, dns_answers_1_rrname: dab1nmslvvntp.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 60, dns_answers_1_rdata: 54.192.36.243, dns_answers_2_rrname: dab1nmslvvntp.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 60, dns_answers_2_rdata: 54.192.36.188, dns_answers_3_rrname: dab1nmslvvntp.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 60, dns_answers_3_rdata: 54.192.36.245, dns_answers_4_rrname: dab1nmslvvntp.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 60, dns_answers_4_rdata: 54.192.36.45, dns_answers_5_rrname: dab1nmslvvntp.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 60, dns_answers_5_rdata: 54.192.36.239, dns_answers_6_rrname: dab1nmslvvntp.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 60, dns_answers_6_rdata: 54.192.36.92, dns_answers_7_rrname: dab1nmslvvntp.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 60, dns_answers_7_rdata: 54.192.36.155, dns_grouped_A_0: 54.192.36.27, dns_grouped_A_1: 54.192.36.243, dns_grouped_A_2: 54.192.36.188, dns_grouped_A_3: 54.192.36.245, dns_grouped_A_4: 54.192.36.45, dns_grouped_A_5: 54.192.36.239, dns_grouped_A_6: 54.192.36.92, dns_grouped_A_7: 54.192.36.155 ; pcap_cnt: 6751775, event_type: dns, proto: UDP, dns_type: query, dns_id: 36515, dns_rrname: ssl.p.jwpcdn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6751895, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36515, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssl.p.jwpcdn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ssl.p.jwpcdn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 265, dns_answers_0_rdata: cs28.wpc.betacdn.net, dns_answers_1_rrname: cs28.wpc.betacdn.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 2268, dns_answers_1_rdata: 2606:2800:021f:1f7f:0415:1b92:086a:188c, dns_grouped_CNAME_0: cs28.wpc.betacdn.net, dns_grouped_AAAA_0: 2606:2800:021f:1f7f:0415:1b92:086a:188c ; pcap_cnt: 10289856, event_type: dns, proto: UDP, dns_type: query, dns_id: 56234, dns_rrname: static.eu.criteo.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10289882, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56234, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static.eu.criteo.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: static.eu.criteo.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 196, dns_answers_0_rdata: 178.250.2.78, dns_grouped_A_0: 178.250.2.78 ; pcap_cnt: 10628103, event_type: dns, proto: UDP, dns_type: query, dns_id: 5338, dns_rrname: d5nxst8fruw4z.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10628216, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5338, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d5nxst8fruw4z.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d5nxst8fruw4z.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 417, dns_authorities_0_soa_mname: ns-894.awsdns-47.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 11266571, event_type: dns, proto: UDP, dns_type: query, dns_id: 19574, dns_rrname: normandy.cdn.mozilla.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11266578, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19574, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: normandy.cdn.mozilla.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: normandy.cdn.mozilla.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: normandy-cdn.services.mozilla.com, dns_answers_1_rrname: normandy-cdn.services.mozilla.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 61, dns_answers_1_rdata: normandy-cdn-elb-prod-787321160.us-west-2.elb.amazonaws.com, dns_answers_2_rrname: normandy-cdn-elb-prod-787321160.us-west-2.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 54.71.197.51, dns_answers_3_rrname: normandy-cdn-elb-prod-787321160.us-west-2.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 34.210.245.93, dns_answers_4_rrname: normandy-cdn-elb-prod-787321160.us-west-2.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 52.38.5.243, dns_grouped_CNAME_0: normandy-cdn.services.mozilla.com, dns_grouped_CNAME_1: normandy-cdn-elb-prod-787321160.us-west-2.elb.amazonaws.com, dns_grouped_A_0: 54.71.197.51, dns_grouped_A_1: 34.210.245.93, dns_grouped_A_2: 52.38.5.243 ; pcap_cnt: 11282487, event_type: dns, proto: UDP, dns_type: query, dns_id: 39359, dns_rrname: ib.anycast.adnxs.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 11282550, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 39359, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ib.anycast.adnxs.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adnxs.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 19, dns_authorities_0_soa_mname: ns1.gslb.com, dns_authorities_0_soa_rname: support.appnexus.net, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 30, dns_authorities_0_soa_expire: 86400, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 11587440, event_type: dns, proto: UDP, dns_type: query, dns_id: 56859, dns_rrname: voyages-sncf.com.ssl.d2.sc.omtrdc.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11587441, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56859, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: voyages-sncf.com.ssl.d2.sc.omtrdc.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: omtrdc.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 10, dns_authorities_0_soa_mname: ns1.omtrdc.net, dns_authorities_0_soa_rname: dnsadmin.omniture.com, dns_authorities_0_soa_serial: 2017070500, dns_authorities_0_soa_refresh: 21600, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 12028392, event_type: dns, proto: UDP, dns_type: query, dns_id: 62625, dns_rrname: plus.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 12028462, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62625, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: plus.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: plus.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 137, dns_answers_0_rdata: 2607:f8b0:4006:081b:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:081b:0000:0000:0000:200e ; pcap_cnt: 12527523, event_type: dns, proto: UDP, dns_type: query, dns_id: 12576, dns_rrname: fetlife.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 12527534, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12576, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fetlife.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fetlife.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 180, dns_authorities_0_soa_mname: ns0.dnsmadeeasy.com, dns_authorities_0_soa_rname: dns.dnsmadeeasy.com, dns_authorities_0_soa_serial: 2008011278, dns_authorities_0_soa_refresh: 43200, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 12527655, event_type: dns, proto: UDP, dns_type: query, dns_id: 43612, dns_rrname: f.ssl.fastly.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 12527656, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43612, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: f.ssl.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: f.ssl.fastly.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 151.101.20.64, dns_grouped_A_0: 151.101.20.64 ; pcap_cnt: 12591370, event_type: dns, proto: UDP, dns_type: query, dns_id: 34760, dns_rrname: e2201.ksd.akamaiedge.net, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 12591375, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34760, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e2201.ksd.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e2201.ksd.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 104.88.51.144, dns_grouped_A_0: 104.88.51.144 ; pcap_cnt: 12592629, event_type: dns, proto: UDP, dns_type: query, dns_id: 18284, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_tx_id: 6 ; pcap_cnt: 12592643, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18284, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: t.lkqd.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 146.20.128.177, dns_answers_1_rrname: t.lkqd.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 146.20.128.164, dns_answers_2_rrname: t.lkqd.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 146.20.128.170, dns_answers_3_rrname: t.lkqd.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 146.20.128.176, dns_answers_4_rrname: t.lkqd.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 146.20.128.167, dns_answers_5_rrname: t.lkqd.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 146.20.128.166, dns_answers_6_rrname: t.lkqd.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 146.20.128.162, dns_answers_7_rrname: t.lkqd.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 146.20.128.174, dns_answers_8_rrname: t.lkqd.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 146.20.128.172, dns_answers_9_rrname: t.lkqd.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 1, dns_answers_9_rdata: 146.20.128.168, dns_answers_10_rrname: t.lkqd.net, dns_answers_10_rrtype: A, dns_answers_10_ttl: 1, dns_answers_10_rdata: 146.20.128.171, dns_answers_11_rrname: t.lkqd.net, dns_answers_11_rrtype: A, dns_answers_11_ttl: 1, dns_answers_11_rdata: 146.20.128.169, dns_answers_12_rrname: t.lkqd.net, dns_answers_12_rrtype: A, dns_answers_12_ttl: 1, dns_answers_12_rdata: 146.20.128.173, dns_answers_13_rrname: t.lkqd.net, dns_answers_13_rrtype: A, dns_answers_13_ttl: 1, dns_answers_13_rdata: 146.20.128.163, dns_answers_14_rrname: t.lkqd.net, dns_answers_14_rrtype: A, dns_answers_14_ttl: 1, dns_answers_14_rdata: 146.20.128.175, dns_answers_15_rrname: t.lkqd.net, dns_answers_15_rrtype: A, dns_answers_15_ttl: 1, dns_answers_15_rdata: 146.20.128.165, dns_grouped_A_0: 146.20.128.177, dns_grouped_A_1: 146.20.128.164, dns_grouped_A_2: 146.20.128.170, dns_grouped_A_3: 146.20.128.176, dns_grouped_A_4: 146.20.128.167, dns_grouped_A_5: 146.20.128.166, dns_grouped_A_6: 146.20.128.162, dns_grouped_A_7: 146.20.128.174, dns_grouped_A_8: 146.20.128.172, dns_grouped_A_9: 146.20.128.168, dns_grouped_A_10: 146.20.128.171, dns_grouped_A_11: 146.20.128.169, dns_grouped_A_12: 146.20.128.173, dns_grouped_A_13: 146.20.128.163, dns_grouped_A_14: 146.20.128.175, dns_grouped_A_15: 146.20.128.165 ; pcap_cnt: 13072579, event_type: dns, proto: UDP, dns_type: query, dns_id: 43871, dns_rrname: cw.addthis.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 13072635, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43871, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cw.addthis.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cw.addthis.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: pixel.univide.com, dns_answers_1_rrname: pixel.univide.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 37, dns_answers_1_rdata: 34.203.79.94, dns_answers_2_rrname: pixel.univide.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 37, dns_answers_2_rdata: 54.209.79.201, dns_answers_3_rrname: pixel.univide.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 37, dns_answers_3_rdata: 52.3.112.128, dns_answers_4_rrname: pixel.univide.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 37, dns_answers_4_rdata: 54.175.30.26, dns_answers_5_rrname: pixel.univide.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 37, dns_answers_5_rdata: 52.2.5.150, dns_answers_6_rrname: pixel.univide.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 37, dns_answers_6_rdata: 34.205.1.52, dns_grouped_A_0: 34.203.79.94, dns_grouped_A_1: 54.209.79.201, dns_grouped_A_2: 52.3.112.128, dns_grouped_A_3: 54.175.30.26, dns_grouped_A_4: 52.2.5.150, dns_grouped_A_5: 34.205.1.52, dns_grouped_CNAME_0: pixel.univide.com ; pcap_cnt: 13298072, event_type: dns, proto: UDP, dns_type: query, dns_id: 17527, dns_rrname: googlehosted.l.googleusercontent.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 13298090, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17527, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googlehosted.l.googleusercontent.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: googlehosted.l.googleusercontent.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:0803:0000:0000:0000:2001, dns_grouped_AAAA_0: 2607:f8b0:4006:0803:0000:0000:0000:2001 ; pcap_cnt: 13613671, event_type: dns, proto: UDP, dns_type: query, dns_id: 3785, dns_rrname: adserver.adtech.de, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 13613755, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3785, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adserver.adtech.de, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: adserver.adtech.de, dns_answers_0_rrtype: A, dns_answers_0_ttl: 599, dns_answers_0_rdata: 195.93.42.2, dns_grouped_A_0: 195.93.42.2
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.