['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61231, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 178, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 148, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 120, flow_bytes_toclient: 202, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 427, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 174, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 268, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 110, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 185, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 164, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 109, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 295, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 194, flow_bytes_toclient: 372, flow_age: 130, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 218, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 189, flow_bytes_toclient: 345, flow_age: 30, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 100, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 216, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 119, flow_bytes_toclient: 247, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 133, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 231, flow_bytes_toclient: 323, flow_age: 13, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 101, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 195, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 170, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 155, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 167, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 399, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 184, flow_bytes_toclient: 368, flow_age: 7, flow_state: established, flow_reason: timeout ; pcap_cnt: 46105, event_type: dns, proto: UDP, dns_type: query, dns_id: 34655, dns_rrname: ad.sxp.smartclip.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 46158, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34655, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad.sxp.smartclip.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: smartclip.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 136, dns_authorities_0_soa_mname: ns-1562.awsdns-03.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 249598, event_type: dns, proto: UDP, dns_type: query, dns_id: 9110, dns_rrname: 82.82.20.52.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 249678, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9110, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 82.82.20.52.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 82.82.20.52.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 299, dns_answers_0_rdata: ec2-52-20-82-82.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-52-20-82-82.compute-1.amazonaws.com ; pcap_cnt: 837709, event_type: dns, proto: UDP, dns_type: query, dns_id: 56594, dns_rrname: pixelwebelb-528669213.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 838069, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56594, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixelwebelb-528669213.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 25, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 2459719, event_type: dns, proto: UDP, dns_type: query, dns_id: 19767, dns_rrname: px.adhigh.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2459978, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19767, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: px.adhigh.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: px.adhigh.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 59, dns_answers_0_rdata: px-us-va.adhigh.net, dns_answers_1_rrname: px-us-va.adhigh.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 51, dns_answers_1_rdata: 66.242.15.235, dns_answers_2_rrname: px-us-va.adhigh.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 51, dns_answers_2_rdata: 66.242.12.10, dns_answers_3_rrname: px-us-va.adhigh.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 51, dns_answers_3_rdata: 66.242.12.14, dns_answers_4_rrname: px-us-va.adhigh.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 51, dns_answers_4_rdata: 66.242.12.42, dns_answers_5_rrname: px-us-va.adhigh.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 51, dns_answers_5_rdata: 66.242.12.46, dns_answers_6_rrname: px-us-va.adhigh.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 51, dns_answers_6_rdata: 66.242.12.50, dns_answers_7_rrname: px-us-va.adhigh.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 51, dns_answers_7_rdata: 66.242.12.54, dns_answers_8_rrname: px-us-va.adhigh.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 51, dns_answers_8_rdata: 66.242.15.121, dns_answers_9_rrname: px-us-va.adhigh.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 51, dns_answers_9_rdata: 66.242.15.123, dns_answers_10_rrname: px-us-va.adhigh.net, dns_answers_10_rrtype: A, dns_answers_10_ttl: 51, dns_answers_10_rdata: 66.242.15.125, dns_answers_11_rrname: px-us-va.adhigh.net, dns_answers_11_rrtype: A, dns_answers_11_ttl: 51, dns_answers_11_rdata: 66.242.15.127, dns_answers_12_rrname: px-us-va.adhigh.net, dns_answers_12_rrtype: A, dns_answers_12_ttl: 51, dns_answers_12_rdata: 66.242.15.129, dns_answers_13_rrname: px-us-va.adhigh.net, dns_answers_13_rrtype: A, dns_answers_13_ttl: 51, dns_answers_13_rdata: 66.242.15.227, dns_answers_14_rrname: px-us-va.adhigh.net, dns_answers_14_rrtype: A, dns_answers_14_ttl: 51, dns_answers_14_rdata: 66.242.15.229, dns_answers_15_rrname: px-us-va.adhigh.net, dns_answers_15_rrtype: A, dns_answers_15_ttl: 51, dns_answers_15_rdata: 66.242.15.231, dns_answers_16_rrname: px-us-va.adhigh.net, dns_answers_16_rrtype: A, dns_answers_16_ttl: 51, dns_answers_16_rdata: 66.242.15.115, dns_answers_17_rrname: px-us-va.adhigh.net, dns_answers_17_rrtype: A, dns_answers_17_ttl: 51, dns_answers_17_rdata: 66.242.15.117, dns_answers_18_rrname: px-us-va.adhigh.net, dns_answers_18_rrtype: A, dns_answers_18_ttl: 51, dns_answers_18_rdata: 66.242.15.119, dns_answers_19_rrname: px-us-va.adhigh.net, dns_answers_19_rrtype: A, dns_answers_19_ttl: 51, dns_answers_19_rdata: 66.242.15.113, dns_answers_20_rrname: px-us-va.adhigh.net, dns_answers_20_rrtype: A, dns_answers_20_ttl: 51, dns_answers_20_rdata: 66.242.15.233, dns_grouped_CNAME_0: px-us-va.adhigh.net, dns_grouped_A_0: 66.242.15.235, dns_grouped_A_1: 66.242.12.10, dns_grouped_A_2: 66.242.12.14, dns_grouped_A_3: 66.242.12.42, dns_grouped_A_4: 66.242.12.46, dns_grouped_A_5: 66.242.12.50, dns_grouped_A_6: 66.242.12.54, dns_grouped_A_7: 66.242.15.121, dns_grouped_A_8: 66.242.15.123, dns_grouped_A_9: 66.242.15.125, dns_grouped_A_10: 66.242.15.127, dns_grouped_A_11: 66.242.15.129, dns_grouped_A_12: 66.242.15.227, dns_grouped_A_13: 66.242.15.229, dns_grouped_A_14: 66.242.15.231, dns_grouped_A_15: 66.242.15.115, dns_grouped_A_16: 66.242.15.117, dns_grouped_A_17: 66.242.15.119, dns_grouped_A_18: 66.242.15.113, dns_grouped_A_19: 66.242.15.233 ; pcap_cnt: 3892012, event_type: dns, proto: UDP, dns_type: query, dns_id: 51230, dns_rrname: cdn-st1.rtr-vesti.ru, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3894682, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51230, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn-st1.rtr-vesti.ru, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: cdn-st1.rtr-vesti.ru, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 427, dns_answers_0_rdata: www.small.vgtrk.cdnvideo.ru, dns_grouped_CNAME_0: www.small.vgtrk.cdnvideo.ru, dns_authorities_0_rrname: cdnvideo.ru, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 99, dns_authorities_0_soa_mname: ns006.cdnvideo.ru, dns_authorities_0_soa_rname: s.cdnvideo.ru, dns_authorities_0_soa_serial: 1707041441, dns_authorities_0_soa_refresh: 1200, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 100 ; pcap_cnt: 5665481, event_type: dns, proto: UDP, dns_type: query, dns_id: 2882, dns_rrname: litbimg7.rightinthebox.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5665527, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2882, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: litbimg7.rightinthebox.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: litbimg7.rightinthebox.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 77231, dns_answers_0_rdata: d1w5x23eusliay.cloudfront.net, dns_answers_1_rrname: d1w5x23eusliay.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 58, dns_answers_1_rdata: 54.192.36.106, dns_answers_2_rrname: d1w5x23eusliay.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 58, dns_answers_2_rdata: 54.192.36.237, dns_answers_3_rrname: d1w5x23eusliay.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 58, dns_answers_3_rdata: 54.192.36.79, dns_answers_4_rrname: d1w5x23eusliay.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 58, dns_answers_4_rdata: 54.192.36.196, dns_answers_5_rrname: d1w5x23eusliay.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 58, dns_answers_5_rdata: 54.192.36.224, dns_answers_6_rrname: d1w5x23eusliay.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 58, dns_answers_6_rdata: 54.192.36.137, dns_answers_7_rrname: d1w5x23eusliay.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 58, dns_answers_7_rdata: 54.192.36.63, dns_answers_8_rrname: d1w5x23eusliay.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 58, dns_answers_8_rdata: 54.192.36.138, dns_grouped_CNAME_0: d1w5x23eusliay.cloudfront.net, dns_grouped_A_0: 54.192.36.106, dns_grouped_A_1: 54.192.36.237, dns_grouped_A_2: 54.192.36.79, dns_grouped_A_3: 54.192.36.196, dns_grouped_A_4: 54.192.36.224, dns_grouped_A_5: 54.192.36.137, dns_grouped_A_6: 54.192.36.63, dns_grouped_A_7: 54.192.36.138 ; pcap_cnt: 6649043, event_type: dns, proto: UDP, dns_type: query, dns_id: 52300, dns_rrname: e1879.e7.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6649059, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52300, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e1879.e7.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e1879.e7.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 8, dns_answers_0_rdata: 23.1.136.197, dns_grouped_A_0: 23.1.136.197 ; pcap_cnt: 7463378, event_type: dns, proto: UDP, dns_type: query, dns_id: 14048, dns_rrname: d39wwedyif9a4r.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7463380, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14048, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d39wwedyif9a4r.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d39wwedyif9a4r.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 60, dns_authorities_0_soa_mname: ns-1036.awsdns-01.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 7839097, event_type: dns, proto: UDP, dns_type: query, dns_id: 40856, dns_rrname: ocsp.godaddy.com.akadns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7839098, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40856, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.godaddy.com.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 148, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499178815, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 7955313, event_type: dns, proto: UDP, dns_type: query, dns_id: 25373, dns_rrname: dbm.mediaiqdigital.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7955318, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25373, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dbm.mediaiqdigital.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dbm.mediaiqdigital.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 54.175.83.148, dns_grouped_A_0: 54.175.83.148 ; pcap_cnt: 8164021, event_type: dns, proto: UDP, dns_type: query, dns_id: 60126, dns_rrname: api.mixpanel.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8164067, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60126, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: api.mixpanel.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: api.mixpanel.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 665, dns_answers_0_rdata: 169.54.129.32, dns_answers_1_rrname: api.mixpanel.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 665, dns_answers_1_rdata: 169.54.129.41, dns_answers_2_rrname: api.mixpanel.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 665, dns_answers_2_rdata: 169.54.129.10, dns_answers_3_rrname: api.mixpanel.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 665, dns_answers_3_rdata: 169.54.129.34, dns_answers_4_rrname: api.mixpanel.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 665, dns_answers_4_rdata: 169.54.129.22, dns_answers_5_rrname: api.mixpanel.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 665, dns_answers_5_rdata: 169.54.129.9, dns_answers_6_rrname: api.mixpanel.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 665, dns_answers_6_rdata: 169.54.129.5, dns_answers_7_rrname: api.mixpanel.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 665, dns_answers_7_rdata: 169.54.129.31, dns_answers_8_rrname: api.mixpanel.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 665, dns_answers_8_rdata: 169.54.129.2, dns_answers_9_rrname: api.mixpanel.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 665, dns_answers_9_rdata: 169.54.129.23, dns_answers_10_rrname: api.mixpanel.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 665, dns_answers_10_rdata: 169.54.129.20, dns_answers_11_rrname: api.mixpanel.com, dns_answers_11_rrtype: A, dns_answers_11_ttl: 665, dns_answers_11_rdata: 169.54.129.14, dns_answers_12_rrname: api.mixpanel.com, dns_answers_12_rrtype: A, dns_answers_12_ttl: 665, dns_answers_12_rdata: 169.54.129.21, dns_grouped_A_0: 169.54.129.32, dns_grouped_A_1: 169.54.129.41, dns_grouped_A_2: 169.54.129.10, dns_grouped_A_3: 169.54.129.34, dns_grouped_A_4: 169.54.129.22, dns_grouped_A_5: 169.54.129.9, dns_grouped_A_6: 169.54.129.5, dns_grouped_A_7: 169.54.129.31, dns_grouped_A_8: 169.54.129.2, dns_grouped_A_9: 169.54.129.23, dns_grouped_A_10: 169.54.129.20, dns_grouped_A_11: 169.54.129.14, dns_grouped_A_12: 169.54.129.21 ; pcap_cnt: 8219301, event_type: dns, proto: UDP, dns_type: query, dns_id: 64428, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8219308, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64428, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 13, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 19, dns_answers_1_rdata: 2001:0418:143c:018b:0000:0000:0000:201a, dns_answers_2_rrname: e8218.dscb1.akamaiedge.net, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 19, dns_answers_2_rdata: 2001:0418:143c:0180:0000:0000:0000:201a, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_AAAA_0: 2001:0418:143c:018b:0000:0000:0000:201a, dns_grouped_AAAA_1: 2001:0418:143c:0180:0000:0000:0000:201a ; pcap_cnt: 8235602, event_type: dns, proto: UDP, dns_type: query, dns_id: 16350, dns_rrname: api-1.sender.mobi, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 8235603, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16350, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: api-1.sender.mobi, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: sender.mobi, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 317, dns_authorities_0_soa_mname: ns-1486.awsdns-57.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8653007, event_type: dns, proto: UDP, dns_type: query, dns_id: 52422, dns_rrname: maxcdn.bootstrapcdn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8653032, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52422, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: maxcdn.bootstrapcdn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: maxcdn.bootstrapcdn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 72, dns_answers_0_rdata: bootstrapcdn.jdorfman.netdna-cdn.com, dns_grouped_CNAME_0: bootstrapcdn.jdorfman.netdna-cdn.com, dns_authorities_0_rrname: netdna-cdn.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 167, dns_authorities_0_soa_mname: ns-97.awsdns-12.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8977316, event_type: dns, proto: UDP, dns_type: query, dns_id: 36411, dns_rrname: www.googleadservices.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8977488, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36411, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.googleadservices.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.googleadservices.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: pagead.l.doubleclick.net, dns_grouped_CNAME_0: pagead.l.doubleclick.net, dns_authorities_0_rrname: l.doubleclick.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 566, dns_authorities_0_soa_mname: ns4.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 160883472, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 8983572, event_type: dns, proto: UDP, dns_type: query, dns_id: 57363, dns_rrname: guardian.map.fastly.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 8983592, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57363, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: guardian.map.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 3, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 9121078, event_type: dns, proto: UDP, dns_type: query, dns_id: 220, dns_rrname: www.agwww.timewarnercable.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9121080, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 220, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.agwww.timewarnercable.com, dns_rrtype: AAAA, dns_rcode: NOERROR ; pcap_cnt: 9189382, event_type: dns, proto: UDP, dns_type: query, dns_id: 11599, dns_rrname: shavar.services.mozilla.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9189386, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11599, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: shavar.services.mozilla.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: shavar.services.mozilla.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 38, dns_answers_0_rdata: shavar.prod.mozaws.net, dns_grouped_CNAME_0: shavar.prod.mozaws.net, dns_authorities_0_rrname: prod.mozaws.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 8, dns_authorities_0_soa_mname: ns-1260.awsdns-29.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 9252893, event_type: dns, proto: UDP, dns_type: query, dns_id: 4651, dns_rrname: log-zone-c-251829089.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9252920, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4651, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: log-zone-c-251829089.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: log-zone-c-251829089.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 52.45.129.84, dns_answers_1_rrname: log-zone-c-251829089.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 52.1.165.28, dns_answers_2_rrname: log-zone-c-251829089.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 52.45.159.13, dns_answers_3_rrname: log-zone-c-251829089.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 52.55.64.138, dns_answers_4_rrname: log-zone-c-251829089.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 52.6.99.186, dns_answers_5_rrname: log-zone-c-251829089.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 52.71.43.244, dns_answers_6_rrname: log-zone-c-251829089.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 52.2.161.246, dns_answers_7_rrname: log-zone-c-251829089.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 52.2.56.199, dns_grouped_A_0: 52.45.129.84, dns_grouped_A_1: 52.1.165.28, dns_grouped_A_2: 52.45.159.13, dns_grouped_A_3: 52.55.64.138, dns_grouped_A_4: 52.6.99.186, dns_grouped_A_5: 52.71.43.244, dns_grouped_A_6: 52.2.161.246, dns_grouped_A_7: 52.2.56.199 ; pcap_cnt: 9386204, event_type: dns, proto: UDP, dns_type: query, dns_id: 35337, dns_rrname: 51.3.30.72.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 9386217, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35337, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 51.3.30.72.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 51.3.30.72.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 1413, dns_answers_0_rdata: fe3.cbs.vip.bf1.yahoo.com, dns_grouped_PTR_0: fe3.cbs.vip.bf1.yahoo.com ; pcap_cnt: 9543205, event_type: dns, proto: UDP, dns_type: query, dns_id: 39572, dns_rrname: partnerad.l.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9543257, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 39572, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: partnerad.l.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: partnerad.l.doubleclick.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 222, dns_answers_0_rdata: 172.217.3.98, dns_grouped_A_0: 172.217.3.98 ; pcap_cnt: 9771112, event_type: dns, proto: UDP, dns_type: query, dns_id: 50132, dns_rrname: play.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9771144, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50132, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: play.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: play.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:0810:0000:0000:0000:200e, dns_grouped_AAAA_0: 2607:f8b0:4006:0810:0000:0000:0000:200e ; pcap_cnt: 9777205, event_type: dns, proto: UDP, dns_type: query, dns_id: 28787, dns_rrname: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.c.3.0.0.0.0.0.0.0.0.c.6.9.c.5.5.1.d.ip6.arpa, dns_rrtype: PTR, dns_tx_id: 2 ; pcap_cnt: 9777225, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28787, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.c.3.0.0.0.0.0.0.0.0.c.6.9.c.5.5.1.d.ip6.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: ip6.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 2288, dns_authorities_0_soa_mname: b.ip6-servers.arpa, dns_authorities_0_soa_rname: nstld.iana.org, dns_authorities_0_soa_serial: 2017042716, dns_authorities_0_soa_refresh: 1800, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 9842132, event_type: dns, proto: UDP, dns_type: query, dns_id: 14395, dns_rrname: www.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9842138, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14395, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 172.217.5.228, dns_grouped_A_0: 172.217.5.228 ; pcap_cnt: 10337513, event_type: dns, proto: UDP, dns_type: query, dns_id: 23608, dns_rrname: pixel.advertising.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10337547, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23608, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixel.advertising.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: pixel.advertising.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 254, dns_answers_0_rdata: dmppixel.egslb.aol.com, dns_grouped_CNAME_0: dmppixel.egslb.aol.com, dns_authorities_0_rrname: egslb.aol.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 51, dns_authorities_0_soa_mname: nsm-mtc-gslb.lb.aol.com, dns_authorities_0_soa_rname: hostmaster.aol.net, dns_authorities_0_soa_serial: 2016102701, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 3, dns_authorities_0_soa_expire: 3600, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 10500494, event_type: dns, proto: UDP, dns_type: query, dns_id: 63792, dns_rrname: credentials.api.onliner.by, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10500560, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63792, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: credentials.api.onliner.by, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: onliner.by, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 2272, dns_authorities_0_soa_mname: ns1.dnspark.com, dns_authorities_0_soa_rname: hostmaster.dnspark.net, dns_authorities_0_soa_serial: 1492514008, dns_authorities_0_soa_refresh: 14400, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 10673830, event_type: dns, proto: UDP, dns_type: query, dns_id: 48850, dns_rrname: 2.2.101.151.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 10673864, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48850, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 2.2.101.151.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 151.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 358, dns_authorities_0_soa_mname: pri.authdns.ripe.net, dns_authorities_0_soa_rname: dns.ripe.net, dns_authorities_0_soa_serial: 1499183514, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 864000, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 10896353, event_type: dns, proto: UDP, dns_type: query, dns_id: 45154, dns_rrname: 230.113.199.52.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 10896618, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45154, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 230.113.199.52.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 230.113.199.52.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 299, dns_answers_0_rdata: ec2-52-199-113-230.ap-northeast-1.compute.amazonaws.com, dns_grouped_PTR_0: ec2-52-199-113-230.ap-northeast-1.compute.amazonaws.com ; pcap_cnt: 10941414, event_type: dns, proto: UDP, dns_type: query, dns_id: 1985, dns_rrname: stags.bluekai.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10941458, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1985, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: stags.bluekai.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: stags.bluekai.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 8, dns_answers_0_rdata: tags.phx.bluekai.com, dns_answers_1_rrname: tags.phx.bluekai.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 11, dns_answers_1_rdata: 129.146.13.99, dns_answers_2_rrname: tags.phx.bluekai.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 11, dns_answers_2_rdata: 129.146.14.97, dns_answers_3_rrname: tags.phx.bluekai.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 11, dns_answers_3_rdata: 129.146.14.96, dns_answers_4_rrname: tags.phx.bluekai.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 11, dns_answers_4_rdata: 129.146.13.98, dns_answers_5_rrname: tags.phx.bluekai.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 11, dns_answers_5_rdata: 129.146.14.99, dns_answers_6_rrname: tags.phx.bluekai.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 11, dns_answers_6_rdata: 129.146.12.98, dns_answers_7_rrname: tags.phx.bluekai.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 11, dns_answers_7_rdata: 129.146.13.100, dns_answers_8_rrname: tags.phx.bluekai.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 11, dns_answers_8_rdata: 129.146.13.101, dns_answers_9_rrname: tags.phx.bluekai.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 11, dns_answers_9_rdata: 129.146.12.100, dns_answers_10_rrname: tags.phx.bluekai.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 11, dns_answers_10_rdata: 129.146.13.97, dns_answers_11_rrname: tags.phx.bluekai.com, dns_answers_11_rrtype: A, dns_answers_11_ttl: 11, dns_answers_11_rdata: 129.146.12.97, dns_answers_12_rrname: tags.phx.bluekai.com, dns_answers_12_rrtype: A, dns_answers_12_ttl: 11, dns_answers_12_rdata: 129.146.12.96, dns_answers_13_rrname: tags.phx.bluekai.com, dns_answers_13_rrtype: A, dns_answers_13_ttl: 11, dns_answers_13_rdata: 129.146.14.100, dns_answers_14_rrname: tags.phx.bluekai.com, dns_answers_14_rrtype: A, dns_answers_14_ttl: 11, dns_answers_14_rdata: 129.146.14.101, dns_answers_15_rrname: tags.phx.bluekai.com, dns_answers_15_rrtype: A, dns_answers_15_ttl: 11, dns_answers_15_rdata: 129.146.13.96, dns_answers_16_rrname: tags.phx.bluekai.com, dns_answers_16_rrtype: A, dns_answers_16_ttl: 11, dns_answers_16_rdata: 129.146.12.101, dns_answers_17_rrname: tags.phx.bluekai.com, dns_answers_17_rrtype: A, dns_answers_17_ttl: 11, dns_answers_17_rdata: 129.146.14.98, dns_answers_18_rrname: tags.phx.bluekai.com, dns_answers_18_rrtype: A, dns_answers_18_ttl: 11, dns_answers_18_rdata: 129.146.12.99, dns_grouped_A_0: 129.146.13.99, dns_grouped_A_1: 129.146.14.97, dns_grouped_A_2: 129.146.14.96, dns_grouped_A_3: 129.146.13.98, dns_grouped_A_4: 129.146.14.99, dns_grouped_A_5: 129.146.12.98, dns_grouped_A_6: 129.146.13.100, dns_grouped_A_7: 129.146.13.101, dns_grouped_A_8: 129.146.12.100, dns_grouped_A_9: 129.146.13.97, dns_grouped_A_10: 129.146.12.97, dns_grouped_A_11: 129.146.12.96, dns_grouped_A_12: 129.146.14.100, dns_grouped_A_13: 129.146.14.101, dns_grouped_A_14: 129.146.13.96, dns_grouped_A_15: 129.146.12.101, dns_grouped_A_16: 129.146.14.98, dns_grouped_A_17: 129.146.12.99, dns_grouped_CNAME_0: tags.phx.bluekai.com ; pcap_cnt: 11159738, event_type: dns, proto: UDP, dns_type: query, dns_id: 5565, dns_rrname: livechat.navyfederal.org, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11159754, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5565, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: livechat.navyfederal.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: livechat.navyfederal.org, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 29, dns_answers_0_rdata: navyfederal.liveperson.net, dns_answers_1_rrname: navyfederal.liveperson.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 288, dns_answers_1_rdata: 162.252.74.14, dns_grouped_CNAME_0: navyfederal.liveperson.net, dns_grouped_A_0: 162.252.74.14 ; pcap_cnt: 11161141, event_type: dns, proto: UDP, dns_type: query, dns_id: 9245, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 11161143, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9245, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ping.chartbeat.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 12, dns_answers_0_rdata: 23.23.236.244, dns_answers_1_rrname: ping.chartbeat.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 12, dns_answers_1_rdata: 50.19.216.194, dns_answers_2_rrname: ping.chartbeat.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 12, dns_answers_2_rdata: 23.23.140.176, dns_answers_3_rrname: ping.chartbeat.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 12, dns_answers_3_rdata: 23.23.99.12, dns_answers_4_rrname: ping.chartbeat.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 12, dns_answers_4_rdata: 50.17.209.234, dns_answers_5_rrname: ping.chartbeat.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 12, dns_answers_5_rdata: 54.225.100.50, dns_answers_6_rrname: ping.chartbeat.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 12, dns_answers_6_rdata: 50.19.232.30, dns_answers_7_rrname: ping.chartbeat.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 12, dns_answers_7_rdata: 23.23.220.195, dns_grouped_A_0: 23.23.236.244, dns_grouped_A_1: 50.19.216.194, dns_grouped_A_2: 23.23.140.176, dns_grouped_A_3: 23.23.99.12, dns_grouped_A_4: 50.17.209.234, dns_grouped_A_5: 54.225.100.50, dns_grouped_A_6: 50.19.232.30, dns_grouped_A_7: 23.23.220.195
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.