['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 62177, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 221, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 122, flow_bytes_toclient: 250, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 154, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 180, flow_bytes_toclient: 311, flow_age: 17, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 223, flow_bytes_toclient: 289, flow_age: 57, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 224, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 107, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 243, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 302, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 177, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 170, flow_bytes_toclient: 376, flow_age: 58, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 199, flow_bytes_toclient: 268, flow_age: 200, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 120, flow_bytes_toclient: 202, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 112, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 249, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 122, flow_bytes_toclient: 154, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 128, flow_bytes_toclient: 210, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 104, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 186, flow_bytes_toclient: 330, flow_age: 13, flow_state: established, flow_reason: timeout ; pcap_cnt: 3629751, event_type: dns, proto: UDP, dns_type: query, dns_id: 39514, dns_rrname: ssl.socdm.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3630182, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 39514, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssl.socdm.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ssl.socdm.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 28, dns_answers_0_rdata: tg2.dr.socdm.com, dns_answers_1_rrname: tg2.dr.socdm.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 359, dns_answers_1_rdata: 202.241.208.52, dns_answers_2_rrname: tg2.dr.socdm.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 359, dns_answers_2_rdata: 202.241.208.53, dns_answers_3_rrname: tg2.dr.socdm.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 359, dns_answers_3_rdata: 202.241.208.54, dns_grouped_CNAME_0: tg2.dr.socdm.com, dns_grouped_A_0: 202.241.208.52, dns_grouped_A_1: 202.241.208.53, dns_grouped_A_2: 202.241.208.54 ; pcap_cnt: 3717935, event_type: dns, proto: UDP, dns_type: query, dns_id: 46337, dns_rrname: a.impactradius-tag.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3717969, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46337, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a.impactradius-tag.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a.impactradius-tag.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 33, dns_answers_0_rdata: 54.192.37.121, dns_answers_1_rrname: a.impactradius-tag.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 33, dns_answers_1_rdata: 54.192.37.189, dns_answers_2_rrname: a.impactradius-tag.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 33, dns_answers_2_rdata: 54.192.37.167, dns_answers_3_rrname: a.impactradius-tag.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 33, dns_answers_3_rdata: 54.192.37.204, dns_answers_4_rrname: a.impactradius-tag.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 33, dns_answers_4_rdata: 54.192.37.141, dns_answers_5_rrname: a.impactradius-tag.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 33, dns_answers_5_rdata: 54.192.37.187, dns_answers_6_rrname: a.impactradius-tag.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 33, dns_answers_6_rdata: 54.192.37.250, dns_answers_7_rrname: a.impactradius-tag.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 33, dns_answers_7_rdata: 54.192.37.120, dns_grouped_A_0: 54.192.37.121, dns_grouped_A_1: 54.192.37.189, dns_grouped_A_2: 54.192.37.167, dns_grouped_A_3: 54.192.37.204, dns_grouped_A_4: 54.192.37.141, dns_grouped_A_5: 54.192.37.187, dns_grouped_A_6: 54.192.37.250, dns_grouped_A_7: 54.192.37.120 ; pcap_cnt: 3791233, event_type: dns, proto: UDP, dns_type: query, dns_id: 30620, dns_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3791236, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30620, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 9, dns_answers_0_rdata: 54.71.146.239, dns_answers_1_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 9, dns_answers_1_rdata: 35.160.70.124, dns_answers_2_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 9, dns_answers_2_rdata: 35.161.35.168, dns_answers_3_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 9, dns_answers_3_rdata: 35.160.180.157, dns_answers_4_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 9, dns_answers_4_rdata: 35.167.226.133, dns_answers_5_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 9, dns_answers_5_rdata: 52.24.219.132, dns_answers_6_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 9, dns_answers_6_rdata: 52.26.112.159, dns_answers_7_rrname: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 9, dns_answers_7_rdata: 35.166.31.108, dns_grouped_A_0: 54.71.146.239, dns_grouped_A_1: 35.160.70.124, dns_grouped_A_2: 35.161.35.168, dns_grouped_A_3: 35.160.180.157, dns_grouped_A_4: 35.167.226.133, dns_grouped_A_5: 52.24.219.132, dns_grouped_A_6: 52.26.112.159, dns_grouped_A_7: 35.166.31.108 ; pcap_cnt: 4092082, event_type: dns, proto: UDP, dns_type: query, dns_id: 18202, dns_rrname: e5799.g.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4092084, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18202, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e5799.g.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 761, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499432798, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 4370433, event_type: dns, proto: UDP, dns_type: query, dns_id: 38824, dns_rrname: fast.nbcu.demdex.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4370621, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38824, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fast.nbcu.demdex.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: fast.nbcu.demdex.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 244, dns_answers_0_rdata: cdn.demdex.net.edgesuite.net, dns_answers_1_rrname: cdn.demdex.net.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 18844, dns_answers_1_rdata: a311.g.akamai.net, dns_answers_2_rrname: a311.g.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 23.15.4.16, dns_answers_3_rrname: a311.g.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 19, dns_answers_3_rdata: 23.15.4.18, dns_grouped_A_0: 23.15.4.16, dns_grouped_A_1: 23.15.4.18, dns_grouped_CNAME_0: cdn.demdex.net.edgesuite.net, dns_grouped_CNAME_1: a311.g.akamai.net ; pcap_cnt: 4383050, event_type: dns, proto: UDP, dns_type: query, dns_id: 51247, dns_rrname: a1213.g.akamai.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 4383110, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51247, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a1213.g.akamai.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a1213.g.akamai.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 19, dns_answers_0_rdata: 23.15.4.8, dns_answers_1_rrname: a1213.g.akamai.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 19, dns_answers_1_rdata: 23.15.4.9, dns_grouped_A_0: 23.15.4.8, dns_grouped_A_1: 23.15.4.9 ; pcap_cnt: 4480194, event_type: dns, proto: UDP, dns_type: query, dns_id: 35906, dns_rrname: i2-nxmilqwjxpzvjttwcgobixkkvpfcpw.init.cedexis-radar.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4480207, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35906, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: i2-nxmilqwjxpzvjttwcgobixkkvpfcpw.init.cedexis-radar.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: i2-nxmilqwjxpzvjttwcgobixkkvpfcpw.init.cedexis-radar.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 20, dns_answers_0_rdata: 209.177.157.79, dns_grouped_A_0: 209.177.157.79 ; pcap_cnt: 4499327, event_type: dns, proto: UDP, dns_type: query, dns_id: 47015, dns_rrname: 38.66.60.169.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 2 ; pcap_cnt: 4499367, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47015, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 38.66.60.169.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 38.66.60.169.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 74228, dns_answers_0_rdata: 26.42.3ca9.ip4.static.sl-reverse.com, dns_grouped_PTR_0: 26.42.3ca9.ip4.static.sl-reverse.com ; pcap_cnt: 4665130, event_type: dns, proto: UDP, dns_type: query, dns_id: 15121, dns_rrname: www.dallascowboys.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4665188, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15121, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.dallascowboys.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.dallascowboys.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 226, dns_answers_0_rdata: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrname: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20781, dns_answers_1_rdata: a945.b.akamai.net, dns_grouped_CNAME_0: prod.clubs.nfl.com.edgesuite.net, dns_grouped_CNAME_1: a945.b.akamai.net, dns_authorities_0_rrname: b.akamai.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 104, dns_authorities_0_soa_mname: n0b.akamai.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499433569, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 4793674, event_type: dns, proto: UDP, dns_type: query, dns_id: 42249, dns_rrname: cas.ny.us.criteo.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4793701, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42249, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cas.ny.us.criteo.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cas.ny.us.criteo.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1634, dns_answers_0_rdata: 74.119.118.86, dns_grouped_A_0: 74.119.118.86 ; pcap_cnt: 4994908, event_type: dns, proto: UDP, dns_type: query, dns_id: 10499, dns_rrname: idsync.rlcdn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4995047, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10499, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: idsync.rlcdn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: idsync.rlcdn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 57, dns_answers_0_rdata: idsync-ext-tf.rlcdn.com, dns_answers_1_rrname: idsync-ext-tf.rlcdn.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 34.205.110.130, dns_answers_2_rrname: idsync-ext-tf.rlcdn.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.200.243.182, dns_answers_3_rrname: idsync-ext-tf.rlcdn.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.20.2.57, dns_answers_4_rrname: idsync-ext-tf.rlcdn.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 34.225.90.101, dns_answers_5_rrname: idsync-ext-tf.rlcdn.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.0.38.200, dns_answers_6_rrname: idsync-ext-tf.rlcdn.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 50.19.14.217, dns_answers_7_rrname: idsync-ext-tf.rlcdn.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.20.82.82, dns_answers_8_rrname: idsync-ext-tf.rlcdn.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 59, dns_answers_8_rdata: 34.205.94.213, dns_grouped_CNAME_0: idsync-ext-tf.rlcdn.com, dns_grouped_A_0: 34.205.110.130, dns_grouped_A_1: 52.200.243.182, dns_grouped_A_2: 52.20.2.57, dns_grouped_A_3: 34.225.90.101, dns_grouped_A_4: 52.0.38.200, dns_grouped_A_5: 50.19.14.217, dns_grouped_A_6: 52.20.82.82, dns_grouped_A_7: 34.205.94.213 ; pcap_cnt: 5322690, event_type: dns, proto: UDP, dns_type: query, dns_id: 1367, dns_rrname: googleapis.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5322701, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1367, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleapis.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: googleapis.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 168, dns_answers_0_rdata: 172.217.10.10, dns_answers_1_rrname: googleapis.l.google.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 168, dns_answers_1_rdata: 172.217.10.74, dns_answers_2_rrname: googleapis.l.google.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 168, dns_answers_2_rdata: 172.217.3.106, dns_answers_3_rrname: googleapis.l.google.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 168, dns_answers_3_rdata: 172.217.12.138, dns_answers_4_rrname: googleapis.l.google.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 168, dns_answers_4_rdata: 172.217.6.202, dns_answers_5_rrname: googleapis.l.google.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 168, dns_answers_5_rdata: 172.217.7.10, dns_answers_6_rrname: googleapis.l.google.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 168, dns_answers_6_rdata: 172.217.10.234, dns_answers_7_rrname: googleapis.l.google.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 168, dns_answers_7_rdata: 172.217.11.10, dns_answers_8_rrname: googleapis.l.google.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 168, dns_answers_8_rdata: 172.217.11.42, dns_answers_9_rrname: googleapis.l.google.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 168, dns_answers_9_rdata: 172.217.12.170, dns_answers_10_rrname: googleapis.l.google.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 168, dns_answers_10_rdata: 172.217.12.202, dns_answers_11_rrname: googleapis.l.google.com, dns_answers_11_rrtype: A, dns_answers_11_ttl: 168, dns_answers_11_rdata: 216.58.219.202, dns_answers_12_rrname: googleapis.l.google.com, dns_answers_12_rrtype: A, dns_answers_12_ttl: 168, dns_answers_12_rdata: 172.217.10.42, dns_grouped_A_0: 172.217.10.10, dns_grouped_A_1: 172.217.10.74, dns_grouped_A_2: 172.217.3.106, dns_grouped_A_3: 172.217.12.138, dns_grouped_A_4: 172.217.6.202, dns_grouped_A_5: 172.217.7.10, dns_grouped_A_6: 172.217.10.234, dns_grouped_A_7: 172.217.11.10, dns_grouped_A_8: 172.217.11.42, dns_grouped_A_9: 172.217.12.170, dns_grouped_A_10: 172.217.12.202, dns_grouped_A_11: 216.58.219.202, dns_grouped_A_12: 172.217.10.42 ; pcap_cnt: 5543425, event_type: dns, proto: UDP, dns_type: query, dns_id: 35882, dns_rrname: s.adroll.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5543515, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35882, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s.adroll.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s.adroll.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1439, dns_answers_0_rdata: wildcard.adroll.com.edgekey.net, dns_answers_1_rrname: wildcard.adroll.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 15, dns_answers_1_rdata: e4007.g.akamaiedge.net, dns_answers_2_rrname: e4007.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 104.97.141.192, dns_grouped_CNAME_0: wildcard.adroll.com.edgekey.net, dns_grouped_CNAME_1: e4007.g.akamaiedge.net, dns_grouped_A_0: 104.97.141.192 ; pcap_cnt: 5913200, event_type: dns, proto: UDP, dns_type: query, dns_id: 44172, dns_rrname: abo.zeit.de, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5913406, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44172, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: abo.zeit.de, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: abo.zeit.de, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3306, dns_answers_0_rdata: zeit-live-load-balancer-1860255004.eu-central-1.elb.amazonaws.com, dns_answers_1_rrname: zeit-live-load-balancer-1860255004.eu-central-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.28.39.158, dns_answers_2_rrname: zeit-live-load-balancer-1860255004.eu-central-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.57.205.128, dns_grouped_CNAME_0: zeit-live-load-balancer-1860255004.eu-central-1.elb.amazonaws.com, dns_grouped_A_0: 52.28.39.158, dns_grouped_A_1: 52.57.205.128 ; pcap_cnt: 5919807, event_type: dns, proto: UDP, dns_type: query, dns_id: 32984, dns_rrname: cdn.tt.omtrdc.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5920153, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32984, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.tt.omtrdc.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.tt.omtrdc.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1853, dns_answers_0_rdata: wildcard.tt.omtrdc.net.edgekey.net, dns_answers_1_rrname: wildcard.tt.omtrdc.net.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20544, dns_answers_1_rdata: e10231.g.akamaiedge.net, dns_answers_2_rrname: e10231.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 96.16.161.54, dns_grouped_CNAME_0: wildcard.tt.omtrdc.net.edgekey.net, dns_grouped_CNAME_1: e10231.g.akamaiedge.net, dns_grouped_A_0: 96.16.161.54 ; pcap_cnt: 6231160, event_type: dns, proto: UDP, dns_type: query, dns_id: 5409, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6231167, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5409, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 23.50.75.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.50.75.27 ; pcap_cnt: 6256020, event_type: dns, proto: UDP, dns_type: query, dns_id: 63710, dns_rrname: e9669.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6256022, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63710, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e9669.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e9669.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 23.195.254.8, dns_grouped_A_0: 23.195.254.8 ; pcap_cnt: 6482832, event_type: dns, proto: UDP, dns_type: query, dns_id: 45344, dns_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6482856, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45344, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: beacon-a-v2-214652506.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 52, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6565552, event_type: dns, proto: UDP, dns_type: query, dns_id: 29271, dns_rrname: b92.yahoo.co.jp, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6565844, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29271, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: b92.yahoo.co.jp, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: b92.yahoo.co.jp, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 756, dns_answers_0_rdata: edge.g.yimg.jp, dns_grouped_CNAME_0: edge.g.yimg.jp ; pcap_cnt: 6643333, event_type: dns, proto: UDP, dns_type: query, dns_id: 18560, dns_rrname: r.disneystore.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6643423, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18560, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: r.disneystore.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: r.disneystore.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 200, dns_answers_0_rdata: r.disney.com, dns_answers_1_rrname: r.disney.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 107, dns_answers_1_rdata: matterhornsecure.edgekey.net, dns_answers_2_rrname: matterhornsecure.edgekey.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 20848, dns_answers_2_rdata: e13055.e12.akamaiedge.net, dns_grouped_CNAME_0: r.disney.com, dns_grouped_CNAME_1: matterhornsecure.edgekey.net, dns_grouped_CNAME_2: e13055.e12.akamaiedge.net, dns_authorities_0_rrname: e12.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 678, dns_authorities_0_soa_mname: n0e12.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499447813, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 6701197, event_type: dns, proto: UDP, dns_type: query, dns_id: 6687, dns_rrname: dimml-baltar-2-35009531.eu-west-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6701229, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6687, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dimml-baltar-2-35009531.eu-west-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dimml-baltar-2-35009531.eu-west-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 54.154.31.94, dns_answers_1_rrname: dimml-baltar-2-35009531.eu-west-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 52.208.157.126, dns_grouped_A_0: 54.154.31.94, dns_grouped_A_1: 52.208.157.126 ; pcap_cnt: 7429326, event_type: dns, proto: UDP, dns_type: query, dns_id: 16023, dns_rrname: elb-aws-va-adnetik-1093829825.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7429356, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16023, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: elb-aws-va-adnetik-1093829825.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 46, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7959518, event_type: dns, proto: UDP, dns_type: query, dns_id: 105, dns_rrname: ocsp.comodoca.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7959528, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 105, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.comodoca.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.comodoca.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 202, dns_answers_0_rdata: 178.255.83.1, dns_grouped_A_0: 178.255.83.1 ; pcap_cnt: 9409800, event_type: dns, proto: UDP, dns_type: query, dns_id: 58326, dns_rrname: pix-geo.revsci.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9409828, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58326, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pix-geo.revsci.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pix-geo.revsci.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 5, dns_answers_0_rdata: 38.72.130.155, dns_grouped_A_0: 38.72.130.155 ; pcap_cnt: 9436287, event_type: dns, proto: UDP, dns_type: query, dns_id: 18189, dns_rrname: ocsp.sca1b.amazontrust.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 9436346, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18189, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.sca1b.amazontrust.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.sca1b.amazontrust.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 52.84.143.97, dns_answers_1_rrname: ocsp.sca1b.amazontrust.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.143.31, dns_answers_2_rrname: ocsp.sca1b.amazontrust.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.143.148, dns_answers_3_rrname: ocsp.sca1b.amazontrust.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.143.81, dns_answers_4_rrname: ocsp.sca1b.amazontrust.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.143.147, dns_answers_5_rrname: ocsp.sca1b.amazontrust.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.143.188, dns_answers_6_rrname: ocsp.sca1b.amazontrust.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.143.13, dns_answers_7_rrname: ocsp.sca1b.amazontrust.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.143.110, dns_grouped_A_0: 52.84.143.97, dns_grouped_A_1: 52.84.143.31, dns_grouped_A_2: 52.84.143.148, dns_grouped_A_3: 52.84.143.81, dns_grouped_A_4: 52.84.143.147, dns_grouped_A_5: 52.84.143.188, dns_grouped_A_6: 52.84.143.13, dns_grouped_A_7: 52.84.143.110
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.