['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61899, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 81, flow_bytes_toclient: 179, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 182, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 267, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 185, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 270, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 126, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 199, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 102, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 103, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 185, flow_bytes_toclient: 217, flow_age: 108, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 186, flow_bytes_toclient: 263, flow_age: 123, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 170, flow_bytes_toclient: 323, flow_age: 42, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 106, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 81, flow_bytes_toclient: 337, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 126, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 147, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 4425344, event_type: dns, proto: UDP, dns_type: query, dns_id: 60425, dns_rrname: d.turn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4426069, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60425, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d.turn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: d.turn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 32, dns_answers_0_rdata: d.turn.com.akadns.net, dns_grouped_CNAME_0: d.turn.com.akadns.net, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 179, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499256205, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 4866117, event_type: dns, proto: UDP, dns_type: query, dns_id: 43305, dns_rrname: googleads4.g.doubleclick.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4866175, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43305, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: googleads4.g.doubleclick.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: googleads4.g.doubleclick.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: pagead.l.doubleclick.net, dns_grouped_CNAME_0: pagead.l.doubleclick.net, dns_authorities_0_rrname: l.doubleclick.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 599, dns_authorities_0_soa_mname: ns4.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 160928245, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5645200, event_type: dns, proto: UDP, dns_type: query, dns_id: 27647, dns_rrname: aus5.mozilla.org, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5645202, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 27647, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: aus5.mozilla.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: aus5.mozilla.org, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: balrog-aus5.r53-2.services.mozilla.com, dns_answers_1_rrname: balrog-aus5.r53-2.services.mozilla.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 54.149.95.48, dns_answers_2_rrname: balrog-aus5.r53-2.services.mozilla.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 52.24.139.120, dns_answers_3_rrname: balrog-aus5.r53-2.services.mozilla.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 52.43.87.30, dns_answers_4_rrname: balrog-aus5.r53-2.services.mozilla.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 1, dns_answers_4_rdata: 34.211.94.203, dns_answers_5_rrname: balrog-aus5.r53-2.services.mozilla.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 1, dns_answers_5_rdata: 52.43.235.20, dns_answers_6_rrname: balrog-aus5.r53-2.services.mozilla.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 1, dns_answers_6_rdata: 52.35.101.212, dns_answers_7_rrname: balrog-aus5.r53-2.services.mozilla.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 1, dns_answers_7_rdata: 54.69.41.35, dns_answers_8_rrname: balrog-aus5.r53-2.services.mozilla.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 1, dns_answers_8_rdata: 35.163.114.185, dns_grouped_A_0: 54.149.95.48, dns_grouped_A_1: 52.24.139.120, dns_grouped_A_2: 52.43.87.30, dns_grouped_A_3: 34.211.94.203, dns_grouped_A_4: 52.43.235.20, dns_grouped_A_5: 52.35.101.212, dns_grouped_A_6: 54.69.41.35, dns_grouped_A_7: 35.163.114.185, dns_grouped_CNAME_0: balrog-aus5.r53-2.services.mozilla.com ; pcap_cnt: 6053435, event_type: dns, proto: UDP, dns_type: query, dns_id: 5596, dns_rrname: static.gtarcade.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6053510, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5596, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static.gtarcade.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: static.gtarcade.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 599, dns_answers_0_rdata: static.gtarcade.com.edgekey.net, dns_answers_1_rrname: static.gtarcade.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 21599, dns_answers_1_rdata: e11093.a.akamaiedge.net, dns_answers_2_rrname: e11093.a.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 23.208.69.118, dns_grouped_A_0: 23.208.69.118, dns_grouped_CNAME_0: static.gtarcade.com.edgekey.net, dns_grouped_CNAME_1: e11093.a.akamaiedge.net ; pcap_cnt: 6809793, event_type: dns, proto: UDP, dns_type: query, dns_id: 64851, dns_rrname: itunes.apple.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6809799, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64851, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: itunes.apple.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: itunes.apple.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1132, dns_answers_0_rdata: itunes-cdn.itunes-apple.com.akadns.net, dns_answers_1_rrname: itunes-cdn.itunes-apple.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 2638, dns_answers_1_rdata: itunes.apple.com.edgekey.net, dns_answers_2_rrname: itunes.apple.com.edgekey.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 191, dns_answers_2_rdata: e673.e9.akamaiedge.net, dns_grouped_CNAME_0: itunes-cdn.itunes-apple.com.akadns.net, dns_grouped_CNAME_1: itunes.apple.com.edgekey.net, dns_grouped_CNAME_2: e673.e9.akamaiedge.net, dns_authorities_0_rrname: e9.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 815, dns_authorities_0_soa_mname: n0e9.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499261884, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 9111263, event_type: dns, proto: UDP, dns_type: query, dns_id: 5689, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9111282, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5689, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 8, dns_answers_0_rdata: 2a03:2880:f127:0083:face:b00c:0000:25de, dns_grouped_AAAA_0: 2a03:2880:f127:0083:face:b00c:0000:25de ; pcap_cnt: 10283831, event_type: dns, proto: UDP, dns_type: query, dns_id: 43806, dns_rrname: moat.pxl.ace.advertising.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10283896, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43806, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: moat.pxl.ace.advertising.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: moat.pxl.ace.advertising.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 233, dns_answers_0_rdata: pxl.ace.advertising.com, dns_answers_1_rrname: pxl.ace.advertising.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 279, dns_answers_1_rdata: pxl.ace.advertising.com.adcom.akadns.net, dns_answers_2_rrname: pxl.ace.advertising.com.adcom.akadns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 26, dns_answers_2_rdata: 152.163.13.4, dns_answers_3_rrname: pxl.ace.advertising.com.adcom.akadns.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 26, dns_answers_3_rdata: 149.174.66.131, dns_grouped_A_0: 152.163.13.4, dns_grouped_A_1: 149.174.66.131, dns_grouped_CNAME_0: pxl.ace.advertising.com, dns_grouped_CNAME_1: pxl.ace.advertising.com.adcom.akadns.net ; pcap_cnt: 10438625, event_type: dns, proto: UDP, dns_type: query, dns_id: 17647, dns_rrname: www.gstatic.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10438665, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17647, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.gstatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.gstatic.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 172.217.6.227, dns_grouped_A_0: 172.217.6.227 ; pcap_cnt: 10722697, event_type: dns, proto: UDP, dns_type: query, dns_id: 14638, dns_rrname: www.suruga-ya.jp, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10722756, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14638, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.suruga-ya.jp, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.suruga-ya.jp, dns_answers_0_rrtype: A, dns_answers_0_ttl: 324, dns_answers_0_rdata: 46.51.247.29, dns_grouped_A_0: 46.51.247.29 ; pcap_cnt: 11104373, event_type: dns, proto: UDP, dns_type: query, dns_id: 4082, dns_rrname: aax-us-east.amazon-adsystem.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11104399, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4082, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: aax-us-east.amazon-adsystem.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: aax-us-east.amazon-adsystem.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 52.94.232.33, dns_grouped_A_0: 52.94.232.33 ; pcap_cnt: 11134521, event_type: dns, proto: UDP, dns_type: query, dns_id: 20794, dns_rrname: www.tibet.cn, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 11134576, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20794, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.tibet.cn, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.tibet.cn, dns_answers_0_rrtype: A, dns_answers_0_ttl: 60, dns_answers_0_rdata: 47.52.115.245, dns_grouped_A_0: 47.52.115.245 ; pcap_cnt: 11379079, event_type: dns, proto: UDP, dns_type: query, dns_id: 59437, dns_rrname: global.prod.fastly.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11379191, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59437, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: global.prod.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 6, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 11401623, event_type: dns, proto: UDP, dns_type: query, dns_id: 8316, dns_rrname: e6170.b.akamaiedge.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 11401634, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 8316, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e6170.b.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e6170.b.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 104.88.58.222, dns_grouped_A_0: 104.88.58.222 ; pcap_cnt: 11552567, event_type: dns, proto: UDP, dns_type: query, dns_id: 18854, dns_rrname: static.criteo.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11552569, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18854, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static.criteo.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: criteo.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 434, dns_authorities_0_soa_mname: ns1.criteo.com, dns_authorities_0_soa_rname: dns.criteo.com, dns_authorities_0_soa_serial: 2014061915, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 11565312, event_type: dns, proto: UDP, dns_type: query, dns_id: 5702, dns_rrname: ad.turn.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 11565340, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5702, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad.turn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ad.turn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: ad.turn.com.akadns.net, dns_grouped_CNAME_0: ad.turn.com.akadns.net, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 180, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499274179, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 11725953, event_type: dns, proto: UDP, dns_type: query, dns_id: 21208, dns_rrname: dart.l.doubleclick.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11725955, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21208, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dart.l.doubleclick.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: l.doubleclick.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 424, dns_authorities_0_soa_mname: ns2.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 160945289, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 11792469, event_type: dns, proto: UDP, dns_type: query, dns_id: 22955, dns_rrname: www.mangareader.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11792472, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22955, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.mangareader.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.mangareader.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 241, dns_answers_0_rdata: 185.85.189.58, dns_grouped_A_0: 185.85.189.58 ; pcap_cnt: 12587841, event_type: dns, proto: UDP, dns_type: query, dns_id: 63040, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12587842, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63040, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: t.lkqd.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 146.20.132.141, dns_answers_1_rrname: t.lkqd.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 146.20.132.133, dns_answers_2_rrname: t.lkqd.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 146.20.132.145, dns_answers_3_rrname: t.lkqd.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 146.20.132.138, dns_answers_4_rrname: t.lkqd.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 146.20.132.142, dns_answers_5_rrname: t.lkqd.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 146.20.132.136, dns_answers_6_rrname: t.lkqd.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 0, dns_answers_6_rdata: 146.20.132.139, dns_answers_7_rrname: t.lkqd.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 0, dns_answers_7_rdata: 146.20.132.135, dns_answers_8_rrname: t.lkqd.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 0, dns_answers_8_rdata: 146.20.132.130, dns_answers_9_rrname: t.lkqd.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 0, dns_answers_9_rdata: 146.20.132.137, dns_answers_10_rrname: t.lkqd.net, dns_answers_10_rrtype: A, dns_answers_10_ttl: 0, dns_answers_10_rdata: 146.20.132.134, dns_answers_11_rrname: t.lkqd.net, dns_answers_11_rrtype: A, dns_answers_11_ttl: 0, dns_answers_11_rdata: 146.20.132.144, dns_answers_12_rrname: t.lkqd.net, dns_answers_12_rrtype: A, dns_answers_12_ttl: 0, dns_answers_12_rdata: 146.20.132.140, dns_answers_13_rrname: t.lkqd.net, dns_answers_13_rrtype: A, dns_answers_13_ttl: 0, dns_answers_13_rdata: 146.20.132.131, dns_answers_14_rrname: t.lkqd.net, dns_answers_14_rrtype: A, dns_answers_14_ttl: 0, dns_answers_14_rdata: 146.20.132.132, dns_answers_15_rrname: t.lkqd.net, dns_answers_15_rrtype: A, dns_answers_15_ttl: 0, dns_answers_15_rdata: 146.20.132.143, dns_grouped_A_0: 146.20.132.141, dns_grouped_A_1: 146.20.132.133, dns_grouped_A_2: 146.20.132.145, dns_grouped_A_3: 146.20.132.138, dns_grouped_A_4: 146.20.132.142, dns_grouped_A_5: 146.20.132.136, dns_grouped_A_6: 146.20.132.139, dns_grouped_A_7: 146.20.132.135, dns_grouped_A_8: 146.20.132.130, dns_grouped_A_9: 146.20.132.137, dns_grouped_A_10: 146.20.132.134, dns_grouped_A_11: 146.20.132.144, dns_grouped_A_12: 146.20.132.140, dns_grouped_A_13: 146.20.132.131, dns_grouped_A_14: 146.20.132.132, dns_grouped_A_15: 146.20.132.143 ; pcap_cnt: 12928376, event_type: dns, proto: UDP, dns_type: query, dns_id: 19991, dns_rrname: ocsp.godaddy.com.akadns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 12928400, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19991, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.godaddy.com.akadns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.godaddy.com.akadns.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 50.63.243.230, dns_grouped_A_0: 50.63.243.230 ; pcap_cnt: 12968076, event_type: dns, proto: UDP, dns_type: query, dns_id: 14968, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 12968203, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14968, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 8, dns_answers_0_rdata: 2a03:2880:f10e:0083:face:b00c:0000:25de, dns_grouped_AAAA_0: 2a03:2880:f10e:0083:face:b00c:0000:25de ; pcap_cnt: 13133475, event_type: dns, proto: UDP, dns_type: query, dns_id: 57538, dns_rrname: den.search.spotxchange.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 13133476, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57538, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: den.search.spotxchange.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: spotxchange.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 77, dns_authorities_0_soa_mname: ns.spotxchange.com, dns_authorities_0_soa_rname: hostmaster.spotxchange.com, dns_authorities_0_soa_serial: 2017060206, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 300, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 300
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.