['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60926, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 175, flow_bytes_toclient: 239, flow_age: 158, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 174, flow_bytes_toclient: 266, flow_age: 73, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 152, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 277, flow_bytes_toclient: 418, flow_age: 184, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 171, flow_bytes_toclient: 547, flow_age: 47, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 81, flow_bytes_toclient: 155, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 106, flow_bytes_toclient: 191, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 139, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 111, flow_bytes_toclient: 145, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 100, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 208, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 111, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 164, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 163, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 181, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 135, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 109, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 102, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 105, flow_bytes_toclient: 121, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 99, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 185, flow_bytes_toclient: 279, flow_age: 59, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 144, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 155, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 3126201, event_type: dns, proto: UDP, dns_type: query, dns_id: 60662, dns_rrname: e401.a.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3126209, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60662, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e401.a.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: a.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 999, dns_authorities_0_soa_mname: n0a.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499255887, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 5188701, event_type: dns, proto: UDP, dns_type: query, dns_id: 4922, dns_rrname: e1879.e7.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5188730, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4922, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e1879.e7.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e1879.e7.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 11, dns_answers_0_rdata: 23.66.246.24, dns_grouped_A_0: 23.66.246.24 ; pcap_cnt: 5578879, event_type: dns, proto: UDP, dns_type: query, dns_id: 4079, dns_rrname: tumblr.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5578882, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4079, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tumblr.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tumblr.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 72, dns_answers_0_rdata: 66.6.32.31, dns_answers_1_rrname: tumblr.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 72, dns_answers_1_rdata: 66.6.33.159, dns_answers_2_rrname: tumblr.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 72, dns_answers_2_rdata: 66.6.33.31, dns_grouped_A_0: 66.6.32.31, dns_grouped_A_1: 66.6.33.159, dns_grouped_A_2: 66.6.33.31 ; pcap_cnt: 5950034, event_type: dns, proto: UDP, dns_type: query, dns_id: 10176, dns_rrname: poolct.17173.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5950040, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10176, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: poolct.17173.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: poolct.17173.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 22, dns_answers_0_rdata: 2001:0470:f591:0000:0000:0000:0000:0002, dns_grouped_AAAA_0: 2001:0470:f591:0000:0000:0000:0000:0002 ; pcap_cnt: 5989207, event_type: dns, proto: UDP, dns_type: query, dns_id: 16255, dns_rrname: east.i.simpli.fi, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5989217, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 16255, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: east.i.simpli.fi, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: east.i.simpli.fi, dns_answers_0_rrtype: A, dns_answers_0_ttl: 84, dns_answers_0_rdata: 158.85.41.205, dns_answers_1_rrname: east.i.simpli.fi, dns_answers_1_rrtype: A, dns_answers_1_ttl: 84, dns_answers_1_rdata: 158.85.41.198, dns_answers_2_rrname: east.i.simpli.fi, dns_answers_2_rrtype: A, dns_answers_2_ttl: 84, dns_answers_2_rdata: 158.85.41.218, dns_answers_3_rrname: east.i.simpli.fi, dns_answers_3_rrtype: A, dns_answers_3_ttl: 84, dns_answers_3_rdata: 158.85.41.206, dns_grouped_A_0: 158.85.41.205, dns_grouped_A_1: 158.85.41.198, dns_grouped_A_2: 158.85.41.218, dns_grouped_A_3: 158.85.41.206 ; pcap_cnt: 6834301, event_type: dns, proto: UDP, dns_type: query, dns_id: 59300, dns_rrname: e3972.dscg.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6834333, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59300, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e3972.dscg.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: e3972.dscg.akamaiedge.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 19, dns_answers_0_rdata: 2001:0418:1456:0987:0000:0000:0000:0f84, dns_answers_1_rrname: e3972.dscg.akamaiedge.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 19, dns_answers_1_rdata: 2001:0418:1456:0980:0000:0000:0000:0f84, dns_grouped_AAAA_0: 2001:0418:1456:0987:0000:0000:0000:0f84, dns_grouped_AAAA_1: 2001:0418:1456:0980:0000:0000:0000:0f84 ; pcap_cnt: 8350138, event_type: dns, proto: UDP, dns_type: query, dns_id: 29313, dns_rrname: e8454.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8350141, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29313, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e8454.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e8454.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 19, dns_answers_0_rdata: 104.88.70.158, dns_grouped_A_0: 104.88.70.158 ; pcap_cnt: 8523922, event_type: dns, proto: UDP, dns_type: query, dns_id: 60761, dns_rrname: a1737.b.akamai.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 8523923, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60761, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a1737.b.akamai.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: b.akamai.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 658, dns_authorities_0_soa_mname: n0b.akamai.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499262571, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 8823466, event_type: dns, proto: UDP, dns_type: query, dns_id: 20328, dns_rrname: periscope.map.fastly.net, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 8823488, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20328, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: periscope.map.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: periscope.map.fastly.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 26, dns_answers_0_rdata: 151.101.0.65, dns_answers_1_rrname: periscope.map.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 26, dns_answers_1_rdata: 151.101.64.65, dns_answers_2_rrname: periscope.map.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 26, dns_answers_2_rdata: 151.101.128.65, dns_answers_3_rrname: periscope.map.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 26, dns_answers_3_rdata: 151.101.192.65, dns_grouped_A_0: 151.101.0.65, dns_grouped_A_1: 151.101.64.65, dns_grouped_A_2: 151.101.128.65, dns_grouped_A_3: 151.101.192.65 ; pcap_cnt: 9587031, event_type: dns, proto: UDP, dns_type: query, dns_id: 64236, dns_rrname: assets.adobedtm.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9587049, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64236, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: assets.adobedtm.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: assets.adobedtm.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 175, dns_answers_0_rdata: san-assets.adobedtm.com.edgekey.net, dns_answers_1_rrname: san-assets.adobedtm.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 445, dns_answers_1_rdata: e5799.g.akamaiedge.net, dns_answers_2_rrname: e5799.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 5, dns_answers_2_rdata: 23.46.61.42, dns_grouped_A_0: 23.46.61.42, dns_grouped_CNAME_0: san-assets.adobedtm.com.edgekey.net, dns_grouped_CNAME_1: e5799.g.akamaiedge.net ; pcap_cnt: 9622971, event_type: dns, proto: UDP, dns_type: query, dns_id: 55024, dns_rrname: v.lkqd.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 9623003, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55024, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: v.lkqd.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: v.lkqd.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3, dns_answers_0_rdata: rs-lb-b.lkqd.net, dns_answers_1_rrname: rs-lb-b.lkqd.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 26, dns_answers_1_rdata: 146.20.133.110, dns_answers_2_rrname: rs-lb-b.lkqd.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 26, dns_answers_2_rdata: 146.20.133.111, dns_answers_3_rrname: rs-lb-b.lkqd.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 26, dns_answers_3_rdata: 146.20.133.107, dns_answers_4_rrname: rs-lb-b.lkqd.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 26, dns_answers_4_rdata: 146.20.133.113, dns_answers_5_rrname: rs-lb-b.lkqd.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 26, dns_answers_5_rdata: 146.20.133.103, dns_answers_6_rrname: rs-lb-b.lkqd.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 26, dns_answers_6_rdata: 146.20.133.98, dns_answers_7_rrname: rs-lb-b.lkqd.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 26, dns_answers_7_rdata: 146.20.133.105, dns_answers_8_rrname: rs-lb-b.lkqd.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 26, dns_answers_8_rdata: 146.20.133.102, dns_answers_9_rrname: rs-lb-b.lkqd.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 26, dns_answers_9_rdata: 146.20.133.112, dns_answers_10_rrname: rs-lb-b.lkqd.net, dns_answers_10_rrtype: A, dns_answers_10_ttl: 26, dns_answers_10_rdata: 146.20.133.109, dns_answers_11_rrname: rs-lb-b.lkqd.net, dns_answers_11_rrtype: A, dns_answers_11_ttl: 26, dns_answers_11_rdata: 146.20.133.100, dns_answers_12_rrname: rs-lb-b.lkqd.net, dns_answers_12_rrtype: A, dns_answers_12_ttl: 26, dns_answers_12_rdata: 146.20.133.101, dns_answers_13_rrname: rs-lb-b.lkqd.net, dns_answers_13_rrtype: A, dns_answers_13_ttl: 26, dns_answers_13_rdata: 146.20.133.104, dns_answers_14_rrname: rs-lb-b.lkqd.net, dns_answers_14_rrtype: A, dns_answers_14_ttl: 26, dns_answers_14_rdata: 146.20.133.108, dns_answers_15_rrname: rs-lb-b.lkqd.net, dns_answers_15_rrtype: A, dns_answers_15_ttl: 26, dns_answers_15_rdata: 146.20.133.106, dns_answers_16_rrname: rs-lb-b.lkqd.net, dns_answers_16_rrtype: A, dns_answers_16_ttl: 26, dns_answers_16_rdata: 146.20.133.99, dns_grouped_CNAME_0: rs-lb-b.lkqd.net, dns_grouped_A_0: 146.20.133.110, dns_grouped_A_1: 146.20.133.111, dns_grouped_A_2: 146.20.133.107, dns_grouped_A_3: 146.20.133.113, dns_grouped_A_4: 146.20.133.103, dns_grouped_A_5: 146.20.133.98, dns_grouped_A_6: 146.20.133.105, dns_grouped_A_7: 146.20.133.102, dns_grouped_A_8: 146.20.133.112, dns_grouped_A_9: 146.20.133.109, dns_grouped_A_10: 146.20.133.100, dns_grouped_A_11: 146.20.133.101, dns_grouped_A_12: 146.20.133.104, dns_grouped_A_13: 146.20.133.108, dns_grouped_A_14: 146.20.133.106, dns_grouped_A_15: 146.20.133.99 ; pcap_cnt: 10198517, event_type: dns, proto: UDP, dns_type: query, dns_id: 38421, dns_rrname: s4r.tut.by, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10198638, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38421, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s4r.tut.by, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s4r.tut.by, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 300, dns_answers_0_rdata: reklama-cluster.g2.tutby.com, dns_answers_1_rrname: reklama-cluster.g2.tutby.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 494, dns_answers_1_rdata: 178.172.160.16, dns_answers_2_rrname: reklama-cluster.g2.tutby.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 494, dns_answers_2_rdata: 178.172.160.17, dns_grouped_A_0: 178.172.160.16, dns_grouped_A_1: 178.172.160.17, dns_grouped_CNAME_0: reklama-cluster.g2.tutby.com ; pcap_cnt: 10230975, event_type: dns, proto: UDP, dns_type: query, dns_id: 42578, dns_rrname: blocklists-settings.prod.mozaws.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10230977, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42578, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: blocklists-settings.prod.mozaws.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: prod.mozaws.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 41, dns_authorities_0_soa_mname: ns-1260.awsdns-29.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 10497817, event_type: dns, proto: UDP, dns_type: query, dns_id: 5033, dns_rrname: googleads.g.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10497876, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5033, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleads.g.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: googleads.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: pagead46.l.doubleclick.net, dns_answers_1_rrname: pagead46.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 267, dns_answers_1_rdata: 172.217.10.66, dns_grouped_CNAME_0: pagead46.l.doubleclick.net, dns_grouped_A_0: 172.217.10.66 ; pcap_cnt: 10607332, event_type: dns, proto: UDP, dns_type: query, dns_id: 29880, dns_rrname: geo.vortex.data.microsoft.com.akadns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10607342, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29880, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: geo.vortex.data.microsoft.com.akadns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: geo.vortex.data.microsoft.com.akadns.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 98, dns_answers_0_rdata: cy2.vortex.data.microsoft.com.akadns.net, dns_answers_1_rrname: cy2.vortex.data.microsoft.com.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 204, dns_answers_1_rdata: 64.4.54.254, dns_grouped_CNAME_0: cy2.vortex.data.microsoft.com.akadns.net, dns_grouped_A_0: 64.4.54.254 ; pcap_cnt: 10720206, event_type: dns, proto: UDP, dns_type: query, dns_id: 35562, dns_rrname: ac.ebis.ne.jp, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10720209, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35562, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ac.ebis.ne.jp, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ac.ebis.ne.jp, dns_answers_0_rrtype: A, dns_answers_0_ttl: 170, dns_answers_0_rdata: 210.188.196.193, dns_grouped_A_0: 210.188.196.193 ; pcap_cnt: 10781598, event_type: dns, proto: UDP, dns_type: query, dns_id: 7542, dns_rrname: detectportal.firefox.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10781601, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7542, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: detectportal.firefox.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: detectportal.firefox.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 107, dns_answers_0_rdata: detectportal.firefox.com.edgesuite.net, dns_answers_1_rrname: detectportal.firefox.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 4354, dns_answers_1_rdata: a1089.d.akamai.net, dns_answers_2_rrname: a1089.d.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.210.202.27, dns_answers_3_rrname: a1089.d.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 23.210.202.42, dns_grouped_CNAME_0: detectportal.firefox.com.edgesuite.net, dns_grouped_CNAME_1: a1089.d.akamai.net, dns_grouped_A_0: 23.210.202.27, dns_grouped_A_1: 23.210.202.42 ; pcap_cnt: 10809653, event_type: dns, proto: UDP, dns_type: query, dns_id: 30126, dns_rrname: e2201.ksd.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10809657, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30126, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e2201.ksd.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e2201.ksd.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 104.88.51.144, dns_grouped_A_0: 104.88.51.144 ; pcap_cnt: 10855865, event_type: dns, proto: UDP, dns_type: query, dns_id: 51700, dns_rrname: stun.services.mozilla.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10855867, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51700, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: stun.services.mozilla.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: stun.services.mozilla.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 19, dns_answers_0_rdata: stun1.webrtc.us-east-1.prod.mozaws.net, dns_answers_1_rrname: stun1.webrtc.us-east-1.prod.mozaws.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 8, dns_answers_1_rdata: 54.172.47.69, dns_grouped_CNAME_0: stun1.webrtc.us-east-1.prod.mozaws.net, dns_grouped_A_0: 54.172.47.69 ; pcap_cnt: 11178106, event_type: dns, proto: UDP, dns_type: query, dns_id: 21921, dns_rrname: ums.adtechus.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11178109, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21921, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ums.adtechus.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adtechus.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 299, dns_authorities_0_soa_mname: pdns160.ultradns.net, dns_authorities_0_soa_rname: datacenter.adtech.de, dns_authorities_0_soa_serial: 2016090734, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2592000, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 11232785, event_type: dns, proto: UDP, dns_type: query, dns_id: 50542, dns_rrname: d33rk8qsdw5nrv.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11232821, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50542, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d33rk8qsdw5nrv.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d33rk8qsdw5nrv.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 719, dns_authorities_0_soa_mname: ns-873.awsdns-45.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 11374183, event_type: dns, proto: UDP, dns_type: query, dns_id: 9652, dns_rrname: 3738527.fls.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11374602, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9652, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 3738527.fls.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: 3738527.fls.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 86399, dns_answers_0_rdata: dart.l.doubleclick.net, dns_answers_1_rrname: dart.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 172.217.10.230, dns_grouped_CNAME_0: dart.l.doubleclick.net, dns_grouped_A_0: 172.217.10.230 ; pcap_cnt: 11487493, event_type: dns, proto: UDP, dns_type: query, dns_id: 33776, dns_rrname: dart.l.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11487495, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33776, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dart.l.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dart.l.doubleclick.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 48, dns_answers_0_rdata: 172.217.12.166, dns_grouped_A_0: 172.217.12.166 ; pcap_cnt: 12385581, event_type: dns, proto: UDP, dns_type: query, dns_id: 33663, dns_rrname: e.deployads.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12385672, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33663, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e.deployads.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e.deployads.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 52.23.133.40, dns_grouped_A_0: 52.23.133.40 ; pcap_cnt: 12734931, event_type: dns, proto: UDP, dns_type: query, dns_id: 6839, dns_rrname: anycast.static.adsafeprotected.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12735046, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6839, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: anycast.static.adsafeprotected.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: anycast.static.adsafeprotected.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 118, dns_answers_0_rdata: 69.172.216.58, dns_grouped_A_0: 69.172.216.58 ; pcap_cnt: 12836443, event_type: dns, proto: UDP, dns_type: query, dns_id: 3386, dns_rrname: bluehost.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12836527, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3386, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: bluehost.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: bluehost.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 169.55.100.47, dns_grouped_A_0: 169.55.100.47 ; pcap_cnt: 12933483, event_type: dns, proto: UDP, dns_type: query, dns_id: 44054, dns_rrname: 6506035.fls.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12933516, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44054, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 6506035.fls.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: 6506035.fls.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 86399, dns_answers_0_rdata: dart.l.doubleclick.net, dns_answers_1_rrname: dart.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 45, dns_answers_1_rdata: 172.217.10.70, dns_grouped_A_0: 172.217.10.70, dns_grouped_CNAME_0: dart.l.doubleclick.net ; pcap_cnt: 12954922, event_type: dns, proto: UDP, dns_type: query, dns_id: 52254, dns_rrname: tg3.dr.socdm.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 12954923, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 52254, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tg3.dr.socdm.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: socdm.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 200, dns_authorities_0_soa_mname: 01.dnsv.jp, dns_authorities_0_soa_rname: hostmaster.dnsv.jp, dns_authorities_0_soa_serial: 1496372885, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 13456683, event_type: dns, proto: UDP, dns_type: query, dns_id: 15311, dns_rrname: www.terra.com.br, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 13456707, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15311, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.terra.com.br, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.terra.com.br, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 286, dns_answers_0_rdata: web-portal-cdn.terra.com.br, dns_answers_1_rrname: web-portal-cdn.terra.com.br, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 44, dns_answers_1_rdata: 2001:12c0:4000:aaaa:0200:0192:0193:0012, dns_grouped_CNAME_0: web-portal-cdn.terra.com.br, dns_grouped_AAAA_0: 2001:12c0:4000:aaaa:0200:0192:0193:0012 ; pcap_cnt: 13764176, event_type: dns, proto: UDP, dns_type: query, dns_id: 19899, dns_rrname: m.anycast.adnxs.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 13764186, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19899, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: m.anycast.adnxs.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adnxs.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 23, dns_authorities_0_soa_mname: ns1.gslb.com, dns_authorities_0_soa_rname: support.appnexus.net, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 30, dns_authorities_0_soa_expire: 86400, dns_authorities_0_soa_minimum: 30
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.