['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61065, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 303, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 210, flow_bytes_toclient: 332, flow_age: 198, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 122, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 165, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 223, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 120, flow_bytes_toclient: 184, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 104, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 228, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 147, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 211, flow_bytes_toclient: 470, flow_age: 103, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 184, flow_bytes_toclient: 361, flow_age: 32, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 184, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 102, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 175, flow_bytes_toclient: 323, flow_age: 77, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 110, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 144, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 81, flow_bytes_toclient: 162, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 169, flow_bytes_toclient: 466, flow_age: 2, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 108, flow_bytes_toclient: 164, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 187, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 163, flow_age: 0, flow_state: established, flow_reason: shutdown ; pcap_cnt: 3474236, event_type: dns, proto: UDP, dns_type: query, dns_id: 16733, dns_rrname: beacon.krxd.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3474274, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16733, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: beacon.krxd.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: beacon.krxd.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 21, dns_answers_0_rdata: beacon-a.lb.krxd.net, dns_answers_1_rrname: beacon-a.lb.krxd.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 2573, dns_answers_1_rdata: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_2_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 8, dns_answers_2_rdata: 23.21.69.150, dns_answers_3_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 8, dns_answers_3_rdata: 23.23.130.16, dns_answers_4_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 8, dns_answers_4_rdata: 23.21.52.141, dns_answers_5_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 8, dns_answers_5_rdata: 23.21.93.18, dns_answers_6_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 8, dns_answers_6_rdata: 23.21.232.224, dns_answers_7_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 8, dns_answers_7_rdata: 23.21.88.60, dns_answers_8_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 8, dns_answers_8_rdata: 23.23.100.193, dns_answers_9_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 8, dns_answers_9_rdata: 23.21.247.39, dns_grouped_CNAME_0: beacon-a.lb.krxd.net, dns_grouped_CNAME_1: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 23.21.69.150, dns_grouped_A_1: 23.23.130.16, dns_grouped_A_2: 23.21.52.141, dns_grouped_A_3: 23.21.93.18, dns_grouped_A_4: 23.21.232.224, dns_grouped_A_5: 23.21.88.60, dns_grouped_A_6: 23.23.100.193, dns_grouped_A_7: 23.21.247.39 ; pcap_cnt: 3730833, event_type: dns, proto: UDP, dns_type: query, dns_id: 50311, dns_rrname: widget.criteo.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3730911, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50311, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: widget.criteo.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: criteo.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 645, dns_authorities_0_soa_mname: ns1.criteo.com, dns_authorities_0_soa_rname: dns.criteo.com, dns_authorities_0_soa_serial: 2014061906, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 3786664, event_type: dns, proto: UDP, dns_type: query, dns_id: 5096, dns_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 3786665, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5096, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-2.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 45, dns_authorities_0_soa_mname: ns-332.awsdns-41.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 4126934, event_type: dns, proto: UDP, dns_type: query, dns_id: 12339, dns_rrname: codeload.github.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4126941, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12339, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: codeload.github.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: codeload.github.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 37, dns_answers_0_rdata: 192.30.253.120, dns_answers_1_rrname: codeload.github.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 37, dns_answers_1_rdata: 192.30.253.121, dns_grouped_A_0: 192.30.253.120, dns_grouped_A_1: 192.30.253.121 ; pcap_cnt: 4227759, event_type: dns, proto: UDP, dns_type: query, dns_id: 58046, dns_rrname: 6.57.96.199.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 4227772, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58046, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 6.57.96.199.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 57.96.199.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 42, dns_authorities_0_soa_mname: ns1.p34.dynect.net, dns_authorities_0_soa_rname: root.twitter.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 4378424, event_type: dns, proto: UDP, dns_type: query, dns_id: 43856, dns_rrname: px.moatads.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4378435, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43856, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: px.moatads.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: px.moatads.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 26, dns_answers_0_rdata: wildcard.moatads.com.edgekey.net, dns_answers_1_rrname: wildcard.moatads.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 297, dns_answers_1_rdata: e13136.g.akamaiedge.net, dns_grouped_CNAME_0: wildcard.moatads.com.edgekey.net, dns_grouped_CNAME_1: e13136.g.akamaiedge.net, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 444, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499433155, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 4498885, event_type: dns, proto: UDP, dns_type: query, dns_id: 57916, dns_rrname: nym1-ib.adnxs.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4498891, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57916, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: nym1-ib.adnxs.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adnxs.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 9, dns_authorities_0_soa_mname: ns1.gslb.com, dns_authorities_0_soa_rname: support.appnexus.net, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 30, dns_authorities_0_soa_expire: 86400, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 4637948, event_type: dns, proto: UDP, dns_type: query, dns_id: 65231, dns_rrname: pixelwebelb-528669213.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4637989, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 65231, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixelwebelb-528669213.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pixelwebelb-528669213.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 50.17.190.30, dns_answers_1_rrname: pixelwebelb-528669213.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 23.21.61.177, dns_answers_2_rrname: pixelwebelb-528669213.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 184.73.253.15, dns_answers_3_rrname: pixelwebelb-528669213.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 54.225.133.240, dns_grouped_A_0: 50.17.190.30, dns_grouped_A_1: 23.21.61.177, dns_grouped_A_2: 184.73.253.15, dns_grouped_A_3: 54.225.133.240 ; pcap_cnt: 5054518, event_type: dns, proto: UDP, dns_type: query, dns_id: 32379, dns_rrname: widget.criteo.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5054532, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32379, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: widget.criteo.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: widget.criteo.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 234, dns_answers_0_rdata: 74.119.118.82, dns_grouped_A_0: 74.119.118.82 ; pcap_cnt: 5168246, event_type: dns, proto: UDP, dns_type: query, dns_id: 64700, dns_rrname: d31qbv1cthcecs.cloudfront.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5168270, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64700, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d31qbv1cthcecs.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d31qbv1cthcecs.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 52.84.40.102, dns_answers_1_rrname: d31qbv1cthcecs.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 52.84.40.37, dns_answers_2_rrname: d31qbv1cthcecs.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 52.84.40.211, dns_answers_3_rrname: d31qbv1cthcecs.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 52.84.40.46, dns_answers_4_rrname: d31qbv1cthcecs.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 52.84.40.60, dns_answers_5_rrname: d31qbv1cthcecs.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 52.84.40.62, dns_answers_6_rrname: d31qbv1cthcecs.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 52.84.40.142, dns_answers_7_rrname: d31qbv1cthcecs.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 52.84.40.145, dns_grouped_A_0: 52.84.40.102, dns_grouped_A_1: 52.84.40.37, dns_grouped_A_2: 52.84.40.211, dns_grouped_A_3: 52.84.40.46, dns_grouped_A_4: 52.84.40.60, dns_grouped_A_5: 52.84.40.62, dns_grouped_A_6: 52.84.40.142, dns_grouped_A_7: 52.84.40.145 ; pcap_cnt: 5427205, event_type: dns, proto: UDP, dns_type: query, dns_id: 38625, dns_rrname: cs.adingo.jp, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5427356, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38625, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cs.adingo.jp, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cs.adingo.jp, dns_answers_0_rrtype: A, dns_answers_0_ttl: 56, dns_answers_0_rdata: 52.199.105.238, dns_answers_1_rrname: cs.adingo.jp, dns_answers_1_rrtype: A, dns_answers_1_ttl: 56, dns_answers_1_rdata: 54.249.64.21, dns_answers_2_rrname: cs.adingo.jp, dns_answers_2_rrtype: A, dns_answers_2_ttl: 56, dns_answers_2_rdata: 54.65.100.239, dns_answers_3_rrname: cs.adingo.jp, dns_answers_3_rrtype: A, dns_answers_3_ttl: 56, dns_answers_3_rdata: 54.65.9.222, dns_grouped_A_0: 52.199.105.238, dns_grouped_A_1: 54.249.64.21, dns_grouped_A_2: 54.65.100.239, dns_grouped_A_3: 54.65.9.222 ; pcap_cnt: 5553147, event_type: dns, proto: UDP, dns_type: query, dns_id: 20087, dns_rrname: pagead.l.doubleclick.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5553148, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20087, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pagead.l.doubleclick.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: l.doubleclick.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 599, dns_authorities_0_soa_mname: ns3.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 161179285, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5569396, event_type: dns, proto: UDP, dns_type: query, dns_id: 6543, dns_rrname: telemetry-incoming.r53-2.services.mozilla.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5569398, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6543, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: telemetry-incoming.r53-2.services.mozilla.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: telemetry-incoming.r53-2.services.mozilla.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2, dns_answers_0_rdata: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_answers_1_rrname: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 35.165.181.13, dns_answers_2_rrname: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 35.166.101.186, dns_answers_3_rrname: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 50.112.45.104, dns_answers_4_rrname: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 52.26.221.216, dns_answers_5_rrname: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 52.11.31.31, dns_answers_6_rrname: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 52.40.81.184, dns_answers_7_rrname: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 52.26.121.92, dns_answers_8_rrname: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 35.167.220.41, dns_grouped_CNAME_0: pipeline-edge-prod-24-1300278808.us-west-2.elb.amazonaws.com, dns_grouped_A_0: 35.165.181.13, dns_grouped_A_1: 35.166.101.186, dns_grouped_A_2: 50.112.45.104, dns_grouped_A_3: 52.26.221.216, dns_grouped_A_4: 52.11.31.31, dns_grouped_A_5: 52.40.81.184, dns_grouped_A_6: 52.26.121.92, dns_grouped_A_7: 35.167.220.41 ; pcap_cnt: 5847868, event_type: dns, proto: UDP, dns_type: query, dns_id: 11916, dns_rrname: cdn.content.prod.cms.msn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5847882, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11916, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.content.prod.cms.msn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.content.prod.cms.msn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 703, dns_answers_0_rdata: cdn.content.prod.cms.msn.com.edgekey.net, dns_answers_1_rrname: cdn.content.prod.cms.msn.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 6452, dns_answers_1_rdata: e10663.g.akamaiedge.net, dns_answers_2_rrname: e10663.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.194.142.54, dns_grouped_CNAME_0: cdn.content.prod.cms.msn.com.edgekey.net, dns_grouped_CNAME_1: e10663.g.akamaiedge.net, dns_grouped_A_0: 23.194.142.54 ; pcap_cnt: 5856372, event_type: dns, proto: UDP, dns_type: query, dns_id: 50632, dns_rrname: stat.sports.ru, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 5856434, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50632, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: stat.sports.ru, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: stat.sports.ru, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3023, dns_answers_0_rdata: www.sports.ru, dns_grouped_CNAME_0: www.sports.ru, dns_authorities_0_rrname: sports.ru, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 85788, dns_authorities_0_soa_mname: ns3-l2.nic.ru, dns_authorities_0_soa_rname: support.sports.ru, dns_authorities_0_soa_serial: 2011052079, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6254260, event_type: dns, proto: UDP, dns_type: query, dns_id: 1490, dns_rrname: dtm.advertising.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6254292, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1490, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dtm.advertising.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dtm.advertising.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: dtm.advertising.com.edgekey.net, dns_answers_1_rrname: dtm.advertising.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 2065, dns_answers_1_rdata: e9669.g.akamaiedge.net, dns_answers_2_rrname: e9669.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.194.142.5, dns_grouped_CNAME_0: dtm.advertising.com.edgekey.net, dns_grouped_CNAME_1: e9669.g.akamaiedge.net, dns_grouped_A_0: 23.194.142.5 ; pcap_cnt: 6566902, event_type: dns, proto: UDP, dns_type: query, dns_id: 14455, dns_rrname: sync.fout.jp, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6566996, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14455, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sync.fout.jp, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fout.jp, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 436, dns_authorities_0_soa_mname: usw1.akam.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1498449120, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 1800, dns_authorities_0_soa_expire: 3600000, dns_authorities_0_soa_minimum: 900 ; pcap_cnt: 6613162, event_type: dns, proto: UDP, dns_type: query, dns_id: 52321, dns_rrname: avi.itau.com.br, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6613186, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52321, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: avi.itau.com.br, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: avi.itau.com.br, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 200.196.157.197, dns_grouped_A_0: 200.196.157.197 ; pcap_cnt: 6884091, event_type: dns, proto: UDP, dns_type: query, dns_id: 38942, dns_rrname: adform-sync.nuggad.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6884179, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38942, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adform-sync.nuggad.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: adform-sync.nuggad.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 21600, dns_answers_0_rdata: winniex-u-b-ds.nuggad.net, dns_answers_1_rrname: winniex-u-b-ds.nuggad.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 38, dns_answers_1_rdata: winniex-u-ds.nuggad.net, dns_answers_2_rrname: winniex-u-ds.nuggad.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 2462, dns_answers_2_rdata: 80.82.201.86, dns_answers_3_rrname: winniex-u-ds.nuggad.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 2462, dns_answers_3_rdata: 80.82.201.94, dns_grouped_CNAME_0: winniex-u-b-ds.nuggad.net, dns_grouped_CNAME_1: winniex-u-ds.nuggad.net, dns_grouped_A_0: 80.82.201.86, dns_grouped_A_1: 80.82.201.94 ; pcap_cnt: 6891597, event_type: dns, proto: UDP, dns_type: query, dns_id: 5092, dns_rrname: trafmag.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 6891639, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5092, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: trafmag.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: trafmag.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 346, dns_authorities_0_soa_mname: ns1.topdns.me, dns_authorities_0_soa_rname: hostmaster.trafmag.com, dns_authorities_0_soa_serial: 1495939957, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 432000, dns_authorities_0_soa_minimum: 38400 ; pcap_cnt: 7115677, event_type: dns, proto: UDP, dns_type: query, dns_id: 60734, dns_rrname: e10663.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7115678, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60734, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e10663.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e10663.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 2, dns_answers_0_rdata: 104.79.149.142, dns_grouped_A_0: 104.79.149.142 ; pcap_cnt: 7731211, event_type: dns, proto: UDP, dns_type: query, dns_id: 49841, dns_rrname: www.adcash.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7731238, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49841, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.adcash.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adcash.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 2053, dns_authorities_0_soa_mname: hank.ns.cloudflare.com, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2024607636, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 7829666, event_type: dns, proto: UDP, dns_type: query, dns_id: 40607, dns_rrname: pippio.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7829694, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40607, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pippio.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: pippio.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 165, dns_authorities_0_soa_mname: ns-537.awsdns-03.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 9372548, event_type: dns, proto: UDP, dns_type: query, dns_id: 6233, dns_rrname: ad.crwdcntrl.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9372861, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6233, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad.crwdcntrl.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ad.crwdcntrl.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 78, dns_answers_0_rdata: td2.crwdcntrl.net, dns_answers_1_rrname: td2.crwdcntrl.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 164, dns_answers_1_rdata: elb-ad-01-659338009.us-east-1.elb.amazonaws.com, dns_answers_2_rrname: elb-ad-01-659338009.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 52.2.187.80, dns_answers_3_rrname: elb-ad-01-659338009.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 52.45.125.171, dns_answers_4_rrname: elb-ad-01-659338009.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 52.22.149.232, dns_answers_5_rrname: elb-ad-01-659338009.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.86.215.195, dns_answers_6_rrname: elb-ad-01-659338009.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 54.210.181.142, dns_answers_7_rrname: elb-ad-01-659338009.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 52.45.121.8, dns_answers_8_rrname: elb-ad-01-659338009.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 52.45.68.166, dns_answers_9_rrname: elb-ad-01-659338009.us-east-1.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 1, dns_answers_9_rdata: 52.44.169.55, dns_grouped_CNAME_0: td2.crwdcntrl.net, dns_grouped_CNAME_1: elb-ad-01-659338009.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 52.2.187.80, dns_grouped_A_1: 52.45.125.171, dns_grouped_A_2: 52.22.149.232, dns_grouped_A_3: 54.86.215.195, dns_grouped_A_4: 54.210.181.142, dns_grouped_A_5: 52.45.121.8, dns_grouped_A_6: 52.45.68.166, dns_grouped_A_7: 52.44.169.55 ; pcap_cnt: 9379105, event_type: dns, proto: UDP, dns_type: query, dns_id: 12766, dns_rrname: ad.lkqd.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 9379116, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12766, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad.lkqd.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ad.lkqd.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 229, dns_answers_0_rdata: cds.n3g2w2j5.hwcdn.net, dns_grouped_CNAME_0: cds.n3g2w2j5.hwcdn.net, dns_authorities_0_rrname: hwcdn.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1408, dns_authorities_0_soa_mname: ns1.hwcdn.net, dns_authorities_0_soa_rname: noc.highwinds.com, dns_authorities_0_soa_serial: 1499454310, dns_authorities_0_soa_refresh: 14400, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 9698203, event_type: dns, proto: UDP, dns_type: query, dns_id: 41902, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9698270, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41902, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 1, dns_answers_0_rdata: 2001:4998:0058:4904:0000:0000:0000:6000, dns_answers_1_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 1, dns_answers_1_rdata: 2001:4998:0058:4904:0000:0000:0000:7000, dns_grouped_AAAA_0: 2001:4998:0058:4904:0000:0000:0000:6000, dns_grouped_AAAA_1: 2001:4998:0058:4904:0000:0000:0000:7000 ; pcap_cnt: 9759982, event_type: dns, proto: UDP, dns_type: query, dns_id: 41963, dns_rrname: d12uj65dsn9ho1.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9759983, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41963, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d12uj65dsn9ho1.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d12uj65dsn9ho1.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 48, dns_authorities_0_soa_mname: ns-1675.awsdns-17.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 9977273, event_type: dns, proto: UDP, dns_type: query, dns_id: 43392, dns_rrname: bsla.eyeblaster.akadns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9977391, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43392, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: bsla.eyeblaster.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 179, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499457570, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.