['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60450, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 152, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 103, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 113, flow_bytes_toclient: 192, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 175, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 158, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 176, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 187, flow_bytes_toclient: 235, flow_age: 142, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 220, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 116, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 150, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 101, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 100, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 149, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 194, flow_bytes_toclient: 292, flow_age: 41, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 123, flow_bytes_toclient: 251, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 165, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 119, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 217, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 0, flow_bytes_toserver: 100, flow_bytes_toclient: 0, flow_age: 0, flow_state: new, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 0, flow_pkts_toclient: 1, flow_bytes_toserver: 0, flow_bytes_toclient: 228, flow_age: 0, flow_state: new, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 247, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 110, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 175, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 107, flow_age: 0, flow_state: established, flow_reason: shutdown ; pcap_cnt: 4365079, event_type: dns, proto: UDP, dns_type: query, dns_id: 23678, dns_rrname: 180.17.100.208.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 4365423, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23678, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 180.17.100.208.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 180.17.100.208.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 76036, dns_answers_0_rdata: ip180.208-100-17.static.steadfastdns.net, dns_grouped_PTR_0: ip180.208-100-17.static.steadfastdns.net ; pcap_cnt: 5901974, event_type: dns, proto: UDP, dns_type: query, dns_id: 63997, dns_rrname: geo-um.btrll.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5901989, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63997, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: geo-um.btrll.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: geo-um.btrll.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 17, dns_answers_0_rdata: 162.208.22.39, dns_grouped_A_0: 162.208.22.39 ; pcap_cnt: 6249873, event_type: dns, proto: UDP, dns_type: query, dns_id: 58509, dns_rrname: sync.search-gtm.spotxchange.com.akadns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6249911, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58509, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sync.search-gtm.spotxchange.com.akadns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sync.search-gtm.spotxchange.com.akadns.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 165, dns_answers_0_rdata: iad02.sync.search.spotxchange.com, dns_answers_1_rrname: iad02.sync.search.spotxchange.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 43, dns_answers_1_rdata: 192.35.249.127, dns_answers_2_rrname: iad02.sync.search.spotxchange.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 43, dns_answers_2_rdata: 192.35.249.120, dns_grouped_A_0: 192.35.249.127, dns_grouped_A_1: 192.35.249.120, dns_grouped_CNAME_0: iad02.sync.search.spotxchange.com ; pcap_cnt: 6458093, event_type: dns, proto: UDP, dns_type: query, dns_id: 47909, dns_rrname: p.typekit.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6458095, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47909, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: p.typekit.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: p.typekit.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 58, dns_answers_0_rdata: p.typekit.net-v2.edgekey.net, dns_answers_1_rrname: p.typekit.net-v2.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20391, dns_answers_1_rdata: e8385.dscg.akamaiedge.net, dns_answers_2_rrname: e8385.dscg.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 10, dns_answers_2_rdata: 23.194.110.133, dns_grouped_A_0: 23.194.110.133, dns_grouped_CNAME_0: p.typekit.net-v2.edgekey.net, dns_grouped_CNAME_1: e8385.dscg.akamaiedge.net ; pcap_cnt: 6660911, event_type: dns, proto: UDP, dns_type: query, dns_id: 25284, dns_rrname: trc.taboola.map.fastly.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6660986, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25284, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: trc.taboola.map.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 16, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 6763956, event_type: dns, proto: UDP, dns_type: query, dns_id: 968, dns_rrname: cdn-sic.33across.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6764261, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 968, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn-sic.33across.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn-sic.33across.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 35, dns_answers_0_rdata: cdn-sic.33across.com.cdn.cloudflare.net, dns_answers_1_rrname: cdn-sic.33across.com.cdn.cloudflare.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 182, dns_answers_1_rdata: 104.16.38.14, dns_answers_2_rrname: cdn-sic.33across.com.cdn.cloudflare.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 182, dns_answers_2_rdata: 104.16.39.14, dns_grouped_CNAME_0: cdn-sic.33across.com.cdn.cloudflare.net, dns_grouped_A_0: 104.16.38.14, dns_grouped_A_1: 104.16.39.14 ; pcap_cnt: 6901390, event_type: dns, proto: UDP, dns_type: query, dns_id: 49181, dns_rrname: dis.us.criteo.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6901406, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49181, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dis.us.criteo.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dis.us.criteo.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 66, dns_answers_0_rdata: 74.119.118.84, dns_grouped_A_0: 74.119.118.84 ; pcap_cnt: 6944836, event_type: dns, proto: UDP, dns_type: query, dns_id: 49219, dns_rrname: suggest.discovery.envato.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6944844, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49219, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: suggest.discovery.envato.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: suggest.discovery.envato.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 34.192.107.197, dns_answers_1_rrname: suggest.discovery.envato.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.71.109.106, dns_grouped_A_0: 34.192.107.197, dns_grouped_A_1: 52.71.109.106 ; pcap_cnt: 7779860, event_type: dns, proto: UDP, dns_type: query, dns_id: 46143, dns_rrname: cms.c1exchange.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7780063, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46143, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cms.c1exchange.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cms.c1exchange.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1496, dns_answers_0_rdata: cms.sp0tliteads.com, dns_answers_1_rrname: cms.sp0tliteads.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 59, dns_answers_1_rdata: cookiematch-ohio-elb-365224623.us-east-2.elb.amazonaws.com, dns_answers_2_rrname: cookiematch-ohio-elb-365224623.us-east-2.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 12, dns_answers_2_rdata: 52.15.244.174, dns_answers_3_rrname: cookiematch-ohio-elb-365224623.us-east-2.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 12, dns_answers_3_rdata: 52.14.233.112, dns_grouped_CNAME_0: cms.sp0tliteads.com, dns_grouped_CNAME_1: cookiematch-ohio-elb-365224623.us-east-2.elb.amazonaws.com, dns_grouped_A_0: 52.15.244.174, dns_grouped_A_1: 52.14.233.112 ; pcap_cnt: 8014424, event_type: dns, proto: UDP, dns_type: query, dns_id: 5304, dns_rrname: x01.aidata.io, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8014428, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5304, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: x01.aidata.io, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: x01.aidata.io, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 138.201.227.193, dns_answers_1_rrname: x01.aidata.io, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 138.201.227.192, dns_grouped_A_0: 138.201.227.193, dns_grouped_A_1: 138.201.227.192 ; pcap_cnt: 8370486, event_type: dns, proto: UDP, dns_type: query, dns_id: 64249, dns_rrname: pixel.everesttech.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8370520, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64249, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixel.everesttech.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pixel.everesttech.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 71, dns_answers_0_rdata: tp00.everesttech.net.akadns.net, dns_answers_1_rrname: tp00.everesttech.net.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 79, dns_answers_1_rdata: 192.243.250.36, dns_grouped_A_0: 192.243.250.36, dns_grouped_CNAME_0: tp00.everesttech.net.akadns.net ; pcap_cnt: 8429922, event_type: dns, proto: UDP, dns_type: query, dns_id: 64933, dns_rrname: www.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8429923, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64933, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 136, dns_answers_0_rdata: 172.217.3.36, dns_grouped_A_0: 172.217.3.36 ; pcap_cnt: 8554361, event_type: dns, proto: UDP, dns_type: query, dns_id: 46420, dns_rrname: a.ermisvc.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8554370, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46420, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a.ermisvc.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a.ermisvc.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 39, dns_answers_0_rdata: 64.34.226.83, dns_grouped_A_0: 64.34.226.83 ; pcap_cnt: 8801464, event_type: dns, proto: UDP, dns_type: query, dns_id: 65014, dns_rrname: web.crm4d.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8801510, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 65014, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: web.crm4d.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: crm4d.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 33, dns_authorities_0_soa_mname: dns200.anycast.me, dns_authorities_0_soa_rname: tech.ovh.net, dns_authorities_0_soa_serial: 2017062601, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 3600000, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 8910453, event_type: dns, proto: UDP, dns_type: query, dns_id: 36125, dns_rrname: us-pxl.trafficstars.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8910461, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36125, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: us-pxl.trafficstars.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: trafficstars.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1098, dns_authorities_0_soa_mname: clay.ns.cloudflare.com, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2025076173, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 9172912, event_type: dns, proto: UDP, dns_type: query, dns_id: 5362, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9172924, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5362, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 31.13.71.36, dns_grouped_A_0: 31.13.71.36 ; pcap_cnt: 9180560, event_type: dns, proto: UDP, dns_type: query, dns_id: 13178, dns_rrname: latency-pixel.ic-live.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 9180616, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13178, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: latency-pixel.ic-live.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: ic-live.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 533, dns_authorities_0_soa_mname: ns-1485.awsdns-57.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 9487036, event_type: dns, proto: UDP, dns_type: query, dns_id: 23643, dns_rrname: adservervpcelb-399368545.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9487037, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23643, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adservervpcelb-399368545.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: adservervpcelb-399368545.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 41, dns_answers_0_rdata: 52.1.47.94, dns_answers_1_rrname: adservervpcelb-399368545.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 41, dns_answers_1_rdata: 34.198.62.87, dns_answers_2_rrname: adservervpcelb-399368545.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 41, dns_answers_2_rdata: 52.72.193.206, dns_answers_3_rrname: adservervpcelb-399368545.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 41, dns_answers_3_rdata: 54.175.84.210, dns_answers_4_rrname: adservervpcelb-399368545.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 41, dns_answers_4_rdata: 54.236.250.246, dns_answers_5_rrname: adservervpcelb-399368545.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 41, dns_answers_5_rdata: 54.86.16.198, dns_answers_6_rrname: adservervpcelb-399368545.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 41, dns_answers_6_rdata: 54.165.106.138, dns_answers_7_rrname: adservervpcelb-399368545.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 41, dns_answers_7_rdata: 34.206.22.51, dns_grouped_A_0: 52.1.47.94, dns_grouped_A_1: 34.198.62.87, dns_grouped_A_2: 52.72.193.206, dns_grouped_A_3: 54.175.84.210, dns_grouped_A_4: 54.236.250.246, dns_grouped_A_5: 54.86.16.198, dns_grouped_A_6: 54.165.106.138, dns_grouped_A_7: 34.206.22.51 ; pcap_cnt: 9737020, event_type: dns, proto: UDP, dns_type: query, dns_id: 32542, dns_rrname: dmp.truoptik.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9737064, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32542, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dmp.truoptik.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dmp.truoptik.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 206, dns_answers_0_rdata: lb1-dmp-nyc1-do.truoptik.com, dns_answers_1_rrname: lb1-dmp-nyc1-do.truoptik.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 30, dns_answers_1_rdata: 198.211.102.46, dns_answers_2_rrname: lb1-dmp-nyc1-do.truoptik.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 30, dns_answers_2_rdata: 198.211.102.20, dns_answers_3_rrname: lb1-dmp-nyc1-do.truoptik.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 30, dns_answers_3_rdata: 198.211.102.79, dns_grouped_CNAME_0: lb1-dmp-nyc1-do.truoptik.com, dns_grouped_A_0: 198.211.102.46, dns_grouped_A_1: 198.211.102.20, dns_grouped_A_2: 198.211.102.79 ; pcap_cnt: 9921358, event_type: dns, proto: UDP, dns_type: query, dns_id: 64935, dns_rrname: slb-content.adfox.ru, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9921487, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64935, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: slb-content.adfox.ru, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: slb-content.adfox.ru, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 300, dns_answers_0_rdata: 2a02:06b8:0000:0000:0000:0000:0000:0092, dns_grouped_AAAA_0: 2a02:06b8:0000:0000:0000:0000:0000:0092 ; pcap_cnt: 10071952, event_type: dns, proto: UDP, dns_type: query, dns_id: 15566, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10071957, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15566, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ping.chartbeat.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 23.21.78.116, dns_answers_1_rrname: ping.chartbeat.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 23.23.220.195, dns_answers_2_rrname: ping.chartbeat.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.21.89.124, dns_answers_3_rrname: ping.chartbeat.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 23.21.83.14, dns_answers_4_rrname: ping.chartbeat.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 23.23.118.160, dns_answers_5_rrname: ping.chartbeat.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 23.23.137.182, dns_answers_6_rrname: ping.chartbeat.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 23.23.140.176, dns_answers_7_rrname: ping.chartbeat.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 23.23.236.244, dns_grouped_A_0: 23.21.78.116, dns_grouped_A_1: 23.23.220.195, dns_grouped_A_2: 23.21.89.124, dns_grouped_A_3: 23.21.83.14, dns_grouped_A_4: 23.23.118.160, dns_grouped_A_5: 23.23.137.182, dns_grouped_A_6: 23.23.140.176, dns_grouped_A_7: 23.23.236.244 ; pcap_cnt: 10235860, event_type: dns, proto: UDP, dns_type: query, dns_id: 25440, dns_rrname: d10lpsik1i8c69.cloudfront.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10235861, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25440, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d10lpsik1i8c69.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d10lpsik1i8c69.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.192.36.150, dns_answers_1_rrname: d10lpsik1i8c69.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 54.192.36.196, dns_answers_2_rrname: d10lpsik1i8c69.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 54.192.36.85, dns_answers_3_rrname: d10lpsik1i8c69.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 54.192.36.63, dns_answers_4_rrname: d10lpsik1i8c69.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 54.192.36.38, dns_answers_5_rrname: d10lpsik1i8c69.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 54.192.36.88, dns_answers_6_rrname: d10lpsik1i8c69.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 54.192.36.112, dns_answers_7_rrname: d10lpsik1i8c69.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 54.192.36.102, dns_grouped_A_0: 54.192.36.150, dns_grouped_A_1: 54.192.36.196, dns_grouped_A_2: 54.192.36.85, dns_grouped_A_3: 54.192.36.63, dns_grouped_A_4: 54.192.36.38, dns_grouped_A_5: 54.192.36.88, dns_grouped_A_6: 54.192.36.112, dns_grouped_A_7: 54.192.36.102 ; pcap_cnt: 10738521, event_type: dns, proto: UDP, dns_type: query, dns_id: 63481, dns_rrname: px.ladsp.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10738599, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63481, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: px.ladsp.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: px.ladsp.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 60, dns_answers_0_rdata: pixelserver-ssl-201701-vpc-857929099.ap-northeast-1.elb.amazonaws.com, dns_grouped_CNAME_0: pixelserver-ssl-201701-vpc-857929099.ap-northeast-1.elb.amazonaws.com, dns_authorities_0_rrname: ap-northeast-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 12, dns_authorities_0_soa_mname: ns-1683.awsdns-18.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 10882314, event_type: dns, proto: UDP, dns_type: query, dns_id: 59292, dns_rrname: e11100.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10882321, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59292, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e11100.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e11100.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 23.194.142.69, dns_grouped_A_0: 23.194.142.69 ; pcap_cnt: 11077117, event_type: dns, proto: UDP, dns_type: query, dns_id: 18222, dns_rrname: stock.nate.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11077164, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18222, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: stock.nate.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: stock.nate.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 599, dns_answers_0_rdata: stock.cp.skcomms.co.kr, dns_grouped_CNAME_0: stock.cp.skcomms.co.kr, dns_authorities_0_rrname: skcomms.co.kr, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1558, dns_authorities_0_soa_mname: ns1.natecorp.com, dns_authorities_0_soa_rname: root.ns1.natecorp.com, dns_authorities_0_soa_serial: 2017070300, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 1800, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 11682907, event_type: dns, proto: UDP, dns_type: query, dns_id: 24450, dns_rrname: clients.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11682909, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24450, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: clients.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: clients.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.7.14, dns_grouped_A_0: 172.217.7.14
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.