['flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.5, src_port: 58922, dest_ip: 192.168.10.3, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 160, flow_bytes_toclient: 192, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 344, flow_bytes_toclient: 984, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 1719933, event_type: dns, proto: UDP, dns_type: query, dns_id: 2322, dns_rrname: clients.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 1719934, event_type: dns, proto: UDP, dns_type: query, dns_id: 2322, dns_rrname: clients.l.google.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 1719938, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2322, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: clients.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: clients.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 173, dns_answers_0_rdata: 172.217.12.142, dns_grouped_A_0: 172.217.12.142 ; pcap_cnt: 1719939, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2322, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: clients.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: clients.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 173, dns_answers_0_rdata: 172.217.12.142, dns_grouped_A_0: 172.217.12.142 ; pcap_cnt: 5769357, event_type: dns, proto: UDP, dns_type: query, dns_id: 50906, dns_rrname: us-east-sync.bidswitch.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5769358, event_type: dns, proto: UDP, dns_type: query, dns_id: 50906, dns_rrname: us-east-sync.bidswitch.net, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 5769366, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50906, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: us-east-sync.bidswitch.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: us-east-sync.bidswitch.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 35.185.39.208, dns_answers_1_rrname: us-east-sync.bidswitch.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 104.196.215.51, dns_answers_2_rrname: us-east-sync.bidswitch.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 104.196.211.144, dns_answers_3_rrname: us-east-sync.bidswitch.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 104.196.190.32, dns_answers_4_rrname: us-east-sync.bidswitch.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 104.196.121.139, dns_answers_5_rrname: us-east-sync.bidswitch.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 35.185.41.131, dns_answers_6_rrname: us-east-sync.bidswitch.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 0, dns_answers_6_rdata: 104.196.142.190, dns_answers_7_rrname: us-east-sync.bidswitch.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 0, dns_answers_7_rdata: 104.196.202.142, dns_answers_8_rrname: us-east-sync.bidswitch.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 0, dns_answers_8_rdata: 104.196.131.150, dns_answers_9_rrname: us-east-sync.bidswitch.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 0, dns_answers_9_rdata: 35.185.50.103, dns_grouped_A_0: 35.185.39.208, dns_grouped_A_1: 104.196.215.51, dns_grouped_A_2: 104.196.211.144, dns_grouped_A_3: 104.196.190.32, dns_grouped_A_4: 104.196.121.139, dns_grouped_A_5: 35.185.41.131, dns_grouped_A_6: 104.196.142.190, dns_grouped_A_7: 104.196.202.142, dns_grouped_A_8: 104.196.131.150, dns_grouped_A_9: 35.185.50.103 ; pcap_cnt: 5769367, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50906, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: us-east-sync.bidswitch.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: us-east-sync.bidswitch.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 35.185.39.208, dns_answers_1_rrname: us-east-sync.bidswitch.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 104.196.215.51, dns_answers_2_rrname: us-east-sync.bidswitch.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 104.196.211.144, dns_answers_3_rrname: us-east-sync.bidswitch.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 104.196.190.32, dns_answers_4_rrname: us-east-sync.bidswitch.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 104.196.121.139, dns_answers_5_rrname: us-east-sync.bidswitch.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 35.185.41.131, dns_answers_6_rrname: us-east-sync.bidswitch.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 0, dns_answers_6_rdata: 104.196.142.190, dns_answers_7_rrname: us-east-sync.bidswitch.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 0, dns_answers_7_rdata: 104.196.202.142, dns_answers_8_rrname: us-east-sync.bidswitch.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 0, dns_answers_8_rdata: 104.196.131.150, dns_answers_9_rrname: us-east-sync.bidswitch.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 0, dns_answers_9_rdata: 35.185.50.103, dns_grouped_A_0: 35.185.39.208, dns_grouped_A_1: 104.196.215.51, dns_grouped_A_2: 104.196.211.144, dns_grouped_A_3: 104.196.190.32, dns_grouped_A_4: 104.196.121.139, dns_grouped_A_5: 35.185.41.131, dns_grouped_A_6: 104.196.142.190, dns_grouped_A_7: 104.196.202.142, dns_grouped_A_8: 104.196.131.150, dns_grouped_A_9: 35.185.50.103 ; pcap_cnt: 5769368, event_type: dns, proto: UDP, dns_type: query, dns_id: 50906, dns_rrname: us-east-sync.bidswitch.net, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 5769369, event_type: dns, proto: UDP, dns_type: query, dns_id: 50906, dns_rrname: us-east-sync.bidswitch.net, dns_rrtype: A, dns_tx_id: 5 ; pcap_cnt: 5769370, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50906, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: us-east-sync.bidswitch.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: us-east-sync.bidswitch.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 104.196.215.51, dns_answers_1_rrname: us-east-sync.bidswitch.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 104.196.211.144, dns_answers_2_rrname: us-east-sync.bidswitch.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 104.196.190.32, dns_answers_3_rrname: us-east-sync.bidswitch.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 104.196.121.139, dns_answers_4_rrname: us-east-sync.bidswitch.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 35.185.41.131, dns_answers_5_rrname: us-east-sync.bidswitch.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 104.196.142.190, dns_answers_6_rrname: us-east-sync.bidswitch.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 0, dns_answers_6_rdata: 104.196.202.142, dns_answers_7_rrname: us-east-sync.bidswitch.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 0, dns_answers_7_rdata: 104.196.131.150, dns_answers_8_rrname: us-east-sync.bidswitch.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 0, dns_answers_8_rdata: 35.185.50.103, dns_answers_9_rrname: us-east-sync.bidswitch.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 0, dns_answers_9_rdata: 35.185.39.208, dns_grouped_A_0: 104.196.215.51, dns_grouped_A_1: 104.196.211.144, dns_grouped_A_2: 104.196.190.32, dns_grouped_A_3: 104.196.121.139, dns_grouped_A_4: 35.185.41.131, dns_grouped_A_5: 104.196.142.190, dns_grouped_A_6: 104.196.202.142, dns_grouped_A_7: 104.196.131.150, dns_grouped_A_8: 35.185.50.103, dns_grouped_A_9: 35.185.39.208 ; pcap_cnt: 5769371, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50906, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: us-east-sync.bidswitch.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: us-east-sync.bidswitch.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 104.196.215.51, dns_answers_1_rrname: us-east-sync.bidswitch.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 104.196.211.144, dns_answers_2_rrname: us-east-sync.bidswitch.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 104.196.190.32, dns_answers_3_rrname: us-east-sync.bidswitch.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 104.196.121.139, dns_answers_4_rrname: us-east-sync.bidswitch.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 35.185.41.131, dns_answers_5_rrname: us-east-sync.bidswitch.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 104.196.142.190, dns_answers_6_rrname: us-east-sync.bidswitch.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 0, dns_answers_6_rdata: 104.196.202.142, dns_answers_7_rrname: us-east-sync.bidswitch.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 0, dns_answers_7_rdata: 104.196.131.150, dns_answers_8_rrname: us-east-sync.bidswitch.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 0, dns_answers_8_rdata: 35.185.50.103, dns_answers_9_rrname: us-east-sync.bidswitch.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 0, dns_answers_9_rdata: 35.185.39.208, dns_grouped_A_0: 104.196.215.51, dns_grouped_A_1: 104.196.211.144, dns_grouped_A_2: 104.196.190.32, dns_grouped_A_3: 104.196.121.139, dns_grouped_A_4: 35.185.41.131, dns_grouped_A_5: 104.196.142.190, dns_grouped_A_6: 104.196.202.142, dns_grouped_A_7: 104.196.131.150, dns_grouped_A_8: 35.185.50.103, dns_grouped_A_9: 35.185.39.208
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.