['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60394, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 181, flow_bytes_toclient: 254, flow_age: 197, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 168, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 187, flow_bytes_toclient: 317, flow_age: 3, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 181, flow_bytes_toclient: 354, flow_age: 130, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 115, flow_bytes_toclient: 167, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 158, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 102, flow_bytes_toclient: 130, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 231, flow_bytes_toclient: 387, flow_age: 26, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 156, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 106, flow_bytes_toclient: 187, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 79, flow_bytes_toclient: 170, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 133, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 145, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 104, flow_bytes_toclient: 132, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 115, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 168, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 171, flow_bytes_toclient: 278, flow_age: 35, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 217, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 152, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 350117, event_type: dns, proto: UDP, dns_type: query, dns_id: 44532, dns_rrname: s372.meetrics.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 350228, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44532, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s372.meetrics.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: meetrics.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 563, dns_authorities_0_soa_mname: meetrics.net, dns_authorities_0_soa_rname: dns-admin.meetrics.de, dns_authorities_0_soa_serial: 2990736819, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 3600, dns_authorities_0_soa_minimum: 2419200 ; pcap_cnt: 488261, event_type: dns, proto: UDP, dns_type: query, dns_id: 29793, dns_rrname: e5486.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 488268, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29793, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e5486.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e5486.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 19, dns_answers_0_rdata: 23.217.25.139, dns_grouped_A_0: 23.217.25.139 ; pcap_cnt: 5591643, event_type: dns, proto: UDP, dns_type: query, dns_id: 24315, dns_rrname: cdn.onesignal.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5591691, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24315, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.onesignal.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.onesignal.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 104.16.207.165, dns_answers_1_rrname: cdn.onesignal.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 104.16.208.165, dns_answers_2_rrname: cdn.onesignal.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 299, dns_answers_2_rdata: 104.16.205.165, dns_answers_3_rrname: cdn.onesignal.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 299, dns_answers_3_rdata: 104.16.204.165, dns_answers_4_rrname: cdn.onesignal.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 299, dns_answers_4_rdata: 104.16.206.165, dns_grouped_A_0: 104.16.207.165, dns_grouped_A_1: 104.16.208.165, dns_grouped_A_2: 104.16.205.165, dns_grouped_A_3: 104.16.204.165, dns_grouped_A_4: 104.16.206.165 ; pcap_cnt: 5718216, event_type: dns, proto: UDP, dns_type: query, dns_id: 2392, dns_rrname: vhosts-nj1.tapad.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5718248, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2392, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: vhosts-nj1.tapad.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: tapad.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 14, dns_authorities_0_soa_mname: ns-4.awsdns-00.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 5722361, event_type: dns, proto: UDP, dns_type: query, dns_id: 57921, dns_rrname: 85.169.55.52.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 2 ; pcap_cnt: 5722459, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 57921, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 85.169.55.52.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 85.169.55.52.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 31, dns_answers_0_rdata: ec2-52-55-169-85.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-52-55-169-85.compute-1.amazonaws.com ; pcap_cnt: 6609664, event_type: dns, proto: UDP, dns_type: query, dns_id: 17372, dns_rrname: c.go-mpulse.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6609673, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17372, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: c.go-mpulse.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: c.go-mpulse.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 592, dns_answers_0_rdata: c.go-mpulse.net.cdn.cloudflare.net, dns_grouped_CNAME_0: c.go-mpulse.net.cdn.cloudflare.net, dns_authorities_0_rrname: cloudflare.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 999, dns_authorities_0_soa_mname: ns1.cloudflare.net, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2025061052, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 6645762, event_type: dns, proto: UDP, dns_type: query, dns_id: 37523, dns_rrname: 6.57.96.199.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 2 ; pcap_cnt: 6645763, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37523, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 6.57.96.199.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 57.96.199.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 24, dns_authorities_0_soa_mname: ns1.p34.dynect.net, dns_authorities_0_soa_rname: root.twitter.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6806976, event_type: dns, proto: UDP, dns_type: query, dns_id: 37099, dns_rrname: v10-win.vortex.data.microsoft.com.akadns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6806990, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37099, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: v10-win.vortex.data.microsoft.com.akadns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: v10-win.vortex.data.microsoft.com.akadns.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 226, dns_answers_0_rdata: geo.vortex.data.microsoft.com.akadns.net, dns_answers_1_rrname: geo.vortex.data.microsoft.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 260, dns_answers_1_rdata: cy2.vortex.data.microsoft.com.akadns.net, dns_answers_2_rrname: cy2.vortex.data.microsoft.com.akadns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 216, dns_answers_2_rdata: 64.4.54.254, dns_grouped_CNAME_0: geo.vortex.data.microsoft.com.akadns.net, dns_grouped_CNAME_1: cy2.vortex.data.microsoft.com.akadns.net, dns_grouped_A_0: 64.4.54.254 ; pcap_cnt: 6855542, event_type: dns, proto: UDP, dns_type: query, dns_id: 18120, dns_rrname: stats.l.doubleclick.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6855548, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18120, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: stats.l.doubleclick.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: stats.l.doubleclick.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 74.125.29.154, dns_answers_1_rrname: stats.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 74.125.29.156, dns_answers_2_rrname: stats.l.doubleclick.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 299, dns_answers_2_rdata: 74.125.29.155, dns_answers_3_rrname: stats.l.doubleclick.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 299, dns_answers_3_rdata: 74.125.29.157, dns_grouped_A_0: 74.125.29.154, dns_grouped_A_1: 74.125.29.156, dns_grouped_A_2: 74.125.29.155, dns_grouped_A_3: 74.125.29.157 ; pcap_cnt: 6997398, event_type: dns, proto: UDP, dns_type: query, dns_id: 45846, dns_rrname: pop-idb2-alpha.www.linkedin.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6997409, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45846, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pop-idb2-alpha.www.linkedin.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: pop-idb2-alpha.www.linkedin.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 2550, dns_answers_0_rdata: 2620:0109:c007:0102:0000:0000:5be1:f881, dns_grouped_AAAA_0: 2620:0109:c007:0102:0000:0000:5be1:f881 ; pcap_cnt: 7499709, event_type: dns, proto: UDP, dns_type: query, dns_id: 45236, dns_rrname: 0.e.0.0.0.0.1.0.d.8.3.b.0.7.c.a.0.c.2.0.5.f.8.2.d.6.d.1.d.7.a.4.ip6.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7499751, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45236, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 0.e.0.0.0.0.1.0.d.8.3.b.0.7.c.a.0.c.2.0.5.f.8.2.d.6.d.1.d.7.a.4.ip6.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: ip6.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 2685, dns_authorities_0_soa_mname: b.ip6-servers.arpa, dns_authorities_0_soa_rname: nstld.iana.org, dns_authorities_0_soa_serial: 2017042716, dns_authorities_0_soa_refresh: 1800, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 7505619, event_type: dns, proto: UDP, dns_type: query, dns_id: 54868, dns_rrname: pixel.mathtag.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 7505639, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 54868, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixel.mathtag.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pixel.mathtag.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: pixel.mathtag.com.edgekey.net, dns_answers_1_rrname: pixel.mathtag.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 4599, dns_answers_1_rdata: e6791.b.akamaiedge.net, dns_answers_2_rrname: e6791.b.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.208.101.109, dns_grouped_CNAME_0: pixel.mathtag.com.edgekey.net, dns_grouped_CNAME_1: e6791.b.akamaiedge.net, dns_grouped_A_0: 23.208.101.109 ; pcap_cnt: 7647387, event_type: dns, proto: UDP, dns_type: query, dns_id: 17121, dns_rrname: pagead2.googlesyndication.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7647388, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17121, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pagead2.googlesyndication.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pagead2.googlesyndication.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 246, dns_answers_0_rdata: pagead46.l.doubleclick.net, dns_answers_1_rrname: pagead46.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 181, dns_answers_1_rdata: 172.217.7.2, dns_grouped_CNAME_0: pagead46.l.doubleclick.net, dns_grouped_A_0: 172.217.7.2 ; pcap_cnt: 7923942, event_type: dns, proto: UDP, dns_type: query, dns_id: 23224, dns_rrname: srv-2017-07-04-14.pixel.parsely.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7923943, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23224, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: srv-2017-07-04-14.pixel.parsely.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: parsely.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 717, dns_authorities_0_soa_mname: ns-973.awsdns-57.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 8533042, event_type: dns, proto: UDP, dns_type: query, dns_id: 29980, dns_rrname: s.ntv.io, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8533166, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29980, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s.ntv.io, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s.ntv.io, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 152, dns_answers_0_rdata: wildcard.ntv.io.edgekey.net, dns_answers_1_rrname: wildcard.ntv.io.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 4981, dns_answers_1_rdata: e10230.g.akamaiedge.net, dns_answers_2_rrname: e10230.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 7, dns_answers_2_rdata: 2.23.106.109, dns_grouped_A_0: 2.23.106.109, dns_grouped_CNAME_0: wildcard.ntv.io.edgekey.net, dns_grouped_CNAME_1: e10230.g.akamaiedge.net ; pcap_cnt: 8591275, event_type: dns, proto: UDP, dns_type: query, dns_id: 19150, dns_rrname: www.apache.org, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8591276, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19150, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.apache.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.apache.org, dns_answers_0_rrtype: A, dns_answers_0_ttl: 333, dns_answers_0_rdata: 62.210.60.236, dns_answers_1_rrname: www.apache.org, dns_answers_1_rrtype: A, dns_answers_1_ttl: 333, dns_answers_1_rdata: 88.198.26.2, dns_answers_2_rrname: www.apache.org, dns_answers_2_rrtype: A, dns_answers_2_ttl: 333, dns_answers_2_rdata: 140.211.11.105, dns_grouped_A_0: 62.210.60.236, dns_grouped_A_1: 88.198.26.2, dns_grouped_A_2: 140.211.11.105 ; pcap_cnt: 8894808, event_type: dns, proto: UDP, dns_type: query, dns_id: 35280, dns_rrname: portal.o2online.de, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8894825, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35280, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: portal.o2online.de, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: o2online.de, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 93, dns_authorities_0_soa_mname: ns1.o2online.de, dns_authorities_0_soa_rname: domain-de.o2.com, dns_authorities_0_soa_serial: 2017070303, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 9422951, event_type: dns, proto: UDP, dns_type: query, dns_id: 36854, dns_rrname: www-googletagmanager.l.google.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9422977, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36854, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www-googletagmanager.l.google.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www-googletagmanager.l.google.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2607:f8b0:4006:0819:0000:0000:0000:2008, dns_grouped_AAAA_0: 2607:f8b0:4006:0819:0000:0000:0000:2008 ; pcap_cnt: 10045676, event_type: dns, proto: UDP, dns_type: query, dns_id: 19880, dns_rrname: dw6gonse2zdus.cloudfront.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10045687, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19880, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dw6gonse2zdus.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dw6gonse2zdus.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 26, dns_answers_0_rdata: 52.84.62.165, dns_grouped_A_0: 52.84.62.165 ; pcap_cnt: 10340110, event_type: dns, proto: UDP, dns_type: query, dns_id: 65519, dns_rrname: apolloprogram.io, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10340114, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 65519, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: apolloprogram.io, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: apolloprogram.io, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 561, dns_authorities_0_soa_mname: ns-407.awsdns-50.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 10554127, event_type: dns, proto: UDP, dns_type: query, dns_id: 6066, dns_rrname: pix.us.criteo.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10554142, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6066, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pix.us.criteo.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: criteo.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 3057, dns_authorities_0_soa_mname: ns1.criteo.com, dns_authorities_0_soa_rname: dns.criteo.com, dns_authorities_0_soa_serial: 2014061915, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 10566711, event_type: dns, proto: UDP, dns_type: query, dns_id: 37076, dns_rrname: s.aolcdn.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 10566769, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37076, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s.aolcdn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s.aolcdn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 23, dns_answers_0_rdata: cs629.wpc.lambdacdn.net, dns_answers_1_rrname: cs629.wpc.lambdacdn.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 2363, dns_answers_1_rdata: 192.229.211.36, dns_grouped_A_0: 192.229.211.36, dns_grouped_CNAME_0: cs629.wpc.lambdacdn.net ; pcap_cnt: 10590015, event_type: dns, proto: UDP, dns_type: query, dns_id: 59132, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10590020, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59132, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ping.chartbeat.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ping.chartbeat.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 48, dns_answers_0_rdata: 107.22.248.251, dns_answers_1_rrname: ping.chartbeat.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 48, dns_answers_1_rdata: 184.73.214.150, dns_answers_2_rrname: ping.chartbeat.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 48, dns_answers_2_rdata: 23.21.240.237, dns_answers_3_rrname: ping.chartbeat.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 48, dns_answers_3_rdata: 50.19.219.11, dns_answers_4_rrname: ping.chartbeat.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 48, dns_answers_4_rdata: 50.17.216.242, dns_answers_5_rrname: ping.chartbeat.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 48, dns_answers_5_rdata: 54.225.135.201, dns_answers_6_rrname: ping.chartbeat.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 48, dns_answers_6_rdata: 54.225.163.178, dns_answers_7_rrname: ping.chartbeat.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 48, dns_answers_7_rdata: 54.243.118.244, dns_grouped_A_0: 107.22.248.251, dns_grouped_A_1: 184.73.214.150, dns_grouped_A_2: 23.21.240.237, dns_grouped_A_3: 50.19.219.11, dns_grouped_A_4: 50.17.216.242, dns_grouped_A_5: 54.225.135.201, dns_grouped_A_6: 54.225.163.178, dns_grouped_A_7: 54.243.118.244 ; pcap_cnt: 11035981, event_type: dns, proto: UDP, dns_type: query, dns_id: 38116, dns_rrname: 157.51.225.34.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 11035982, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38116, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 157.51.225.34.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 157.51.225.34.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 20, dns_answers_0_rdata: ec2-34-225-51-157.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-34-225-51-157.compute-1.amazonaws.com
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.