['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60731, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 145, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 196, flow_bytes_toclient: 357, flow_age: 57, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 106, flow_bytes_toclient: 159, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 174, flow_bytes_toclient: 362, flow_age: 126, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 103, flow_bytes_toclient: 251, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 188, flow_bytes_toclient: 350, flow_age: 31, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 154, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 144, flow_bytes_toclient: 276, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 102, flow_bytes_toclient: 118, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 189, flow_bytes_toclient: 301, flow_age: 191, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 399, flow_bytes_toclient: 754, flow_age: 271, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 223, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 177, flow_bytes_toclient: 261, flow_age: 178, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 152, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 231, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 157, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 109, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 149, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 81, flow_bytes_toclient: 97, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 184, flow_bytes_toclient: 477, flow_age: 13, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 301, flow_bytes_toclient: 511, flow_age: 346, flow_state: established, flow_reason: timeout ; pcap_cnt: 105732, event_type: dns, proto: UDP, dns_type: query, dns_id: 5353, dns_rrname: ocsp.netsolssl.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 105780, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5353, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.netsolssl.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.netsolssl.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 593, dns_answers_0_rdata: ocsp.comodoca.com, dns_answers_1_rrname: ocsp.comodoca.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 213, dns_answers_1_rdata: 2a02:1788:02fd:0000:0000:0000:b2ff:5301, dns_grouped_CNAME_0: ocsp.comodoca.com, dns_grouped_AAAA_0: 2a02:1788:02fd:0000:0000:0000:b2ff:5301 ; pcap_cnt: 2088205, event_type: dns, proto: UDP, dns_type: query, dns_id: 23506, dns_rrname: _http._tcp.archive.canonical.com, dns_rrtype: SRV, dns_tx_id: 0 ; pcap_cnt: 2088521, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23506, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: _http._tcp.archive.canonical.com, dns_rrtype: SRV, dns_rcode: NOERROR, dns_authorities_0_rrname: canonical.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1701, dns_authorities_0_soa_mname: ns1.canonical.com, dns_authorities_0_soa_rname: hostmaster.canonical.com, dns_authorities_0_soa_serial: 2017070501, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 2289052, event_type: dns, proto: UDP, dns_type: query, dns_id: 24139, dns_rrname: www.atlantafalcons.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 2289396, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24139, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.atlantafalcons.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.atlantafalcons.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 21, dns_answers_0_rdata: www.atlantafalcons.com.edgesuite.net, dns_answers_1_rrname: www.atlantafalcons.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20116, dns_answers_1_rdata: a979.g.akamai.net, dns_answers_2_rrname: a979.g.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 23.15.4.11, dns_answers_3_rrname: a979.g.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 19, dns_answers_3_rdata: 23.15.4.8, dns_grouped_A_0: 23.15.4.11, dns_grouped_A_1: 23.15.4.8, dns_grouped_CNAME_0: www.atlantafalcons.com.edgesuite.net, dns_grouped_CNAME_1: a979.g.akamai.net ; pcap_cnt: 2918450, event_type: dns, proto: UDP, dns_type: query, dns_id: 35049, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2918461, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35049, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 16, dns_answers_1_rdata: 23.50.75.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.50.75.27 ; pcap_cnt: 3028859, event_type: dns, proto: UDP, dns_type: query, dns_id: 46649, dns_rrname: pixel.mathtag.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3028927, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46649, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixel.mathtag.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pixel.mathtag.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: pixel.mathtag.com.edgekey.net, dns_answers_1_rrname: pixel.mathtag.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 7, dns_answers_1_rdata: e6791.b.akamaiedge.net, dns_answers_2_rrname: e6791.b.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.203.90.218, dns_grouped_A_0: 23.203.90.218, dns_grouped_CNAME_0: pixel.mathtag.com.edgekey.net, dns_grouped_CNAME_1: e6791.b.akamaiedge.net ; pcap_cnt: 3070270, event_type: dns, proto: UDP, dns_type: query, dns_id: 51991, dns_rrname: time.quanmin.tv, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 3070777, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51991, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: time.quanmin.tv, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: time.quanmin.tv, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 600, dns_answers_0_rdata: time.quanmin.tv.wsglb0.com, dns_answers_1_rrname: time.quanmin.tv.wsglb0.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 600, dns_answers_1_rdata: opthw.xdwscache.speedcdns.com, dns_answers_2_rrname: opthw.xdwscache.speedcdns.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 203.130.53.126, dns_grouped_CNAME_0: time.quanmin.tv.wsglb0.com, dns_grouped_CNAME_1: opthw.xdwscache.speedcdns.com, dns_grouped_A_0: 203.130.53.126 ; pcap_cnt: 3476280, event_type: dns, proto: UDP, dns_type: query, dns_id: 31559, dns_rrname: bidi-geo.mythings.com.akadns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3476473, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31559, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: bidi-geo.mythings.com.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: bidi-geo.mythings.com.akadns.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 260, dns_answers_0_rdata: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_grouped_CNAME_0: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 24, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 3558552, event_type: dns, proto: UDP, dns_type: query, dns_id: 27786, dns_rrname: sumo.external.zlb.scl3.mozilla.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3558553, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 27786, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sumo.external.zlb.scl3.mozilla.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: mozilla.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 2196, dns_authorities_0_soa_mname: ns.mozilla.org, dns_authorities_0_soa_rname: sysadmins.mozilla.org, dns_authorities_0_soa_serial: 2017070504, dns_authorities_0_soa_refresh: 180, dns_authorities_0_soa_retry: 180, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 3569250, event_type: dns, proto: UDP, dns_type: query, dns_id: 10191, dns_rrname: ss.symcd.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 3569272, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10191, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ss.symcd.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ss.symcd.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1165, dns_answers_0_rdata: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_1_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 0, dns_answers_1_rdata: e8218.dscb1.akamaiedge.net, dns_answers_2_rrname: e8218.dscb1.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 10, dns_answers_2_rdata: 23.60.139.27, dns_grouped_CNAME_0: ocsp-ds.ws.symantec.com.edgekey.net, dns_grouped_CNAME_1: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.60.139.27 ; pcap_cnt: 4165162, event_type: dns, proto: UDP, dns_type: query, dns_id: 56323, dns_rrname: e5879.g.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4165203, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56323, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e5879.g.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 999, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499348467, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 4432022, event_type: dns, proto: UDP, dns_type: query, dns_id: 18952, dns_rrname: d7d3cf2e81d293050033-3dfc0615b0fd7b49143049256703bfce.ssl.cf1.rackcdn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4432271, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18952, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d7d3cf2e81d293050033-3dfc0615b0fd7b49143049256703bfce.ssl.cf1.rackcdn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: d7d3cf2e81d293050033-3dfc0615b0fd7b49143049256703bfce.ssl.cf1.rackcdn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: cf1.rackcdn.com.edgekey.net, dns_answers_1_rrname: cf1.rackcdn.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 21538, dns_answers_1_rdata: e4845.g.akamaiedge.net, dns_grouped_CNAME_0: cf1.rackcdn.com.edgekey.net, dns_grouped_CNAME_1: e4845.g.akamaiedge.net, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 90, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499349145, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 4589742, event_type: dns, proto: UDP, dns_type: query, dns_id: 64608, dns_rrname: safebrowsing.cache.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4589747, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64608, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: safebrowsing.cache.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: safebrowsing.cache.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.11.14, dns_grouped_A_0: 172.217.11.14 ; pcap_cnt: 4668143, event_type: dns, proto: UDP, dns_type: query, dns_id: 32135, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4668213, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32135, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 34, dns_answers_0_rdata: 2a03:2880:f10e:0083:face:b00c:0000:25de, dns_grouped_AAAA_0: 2a03:2880:f10e:0083:face:b00c:0000:25de ; pcap_cnt: 4705772, event_type: dns, proto: UDP, dns_type: query, dns_id: 59948, dns_rrname: prod-profile.pscp.tv, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 4705791, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59948, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: prod-profile.pscp.tv, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: pscp.tv, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 147, dns_authorities_0_soa_mname: ns-615.awsdns-12.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6117600, event_type: dns, proto: UDP, dns_type: query, dns_id: 36734, dns_rrname: match-us-east-1.sharethrough.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6117629, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36734, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: match-us-east-1.sharethrough.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: sharethrough.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 533, dns_authorities_0_soa_mname: ns-364.awsdns-45.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6141507, event_type: dns, proto: UDP, dns_type: query, dns_id: 34638, dns_rrname: a1165.b.akamai.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 6141508, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34638, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a1165.b.akamai.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: b.akamai.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 997, dns_authorities_0_soa_mname: n0b.akamai.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499359282, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 6197509, event_type: dns, proto: UDP, dns_type: query, dns_id: 48480, dns_rrname: ih.adscale.de, dns_rrtype: AAAA, dns_tx_id: 4 ; pcap_cnt: 6197686, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48480, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ih.adscale.de, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ih.adscale.de, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 5, dns_answers_0_rdata: san.adscale.de.edgekey.net, dns_answers_1_rrname: san.adscale.de.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 1092, dns_answers_1_rdata: e9040.g.akamaiedge.net, dns_grouped_CNAME_0: san.adscale.de.edgekey.net, dns_grouped_CNAME_1: e9040.g.akamaiedge.net, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 98, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499358543, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 6199657, event_type: dns, proto: UDP, dns_type: query, dns_id: 38626, dns_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 6 ; pcap_cnt: 6199658, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38626, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: va-p-lbatag-01-678375800.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 22, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6655719, event_type: dns, proto: UDP, dns_type: query, dns_id: 17773, dns_rrname: www.webs.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6655793, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17773, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.webs.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: www.webs.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 299, dns_answers_0_rdata: 2400:cb00:2048:0001:0000:0000:6810:5978, dns_answers_1_rrname: www.webs.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 299, dns_answers_1_rdata: 2400:cb00:2048:0001:0000:0000:6810:5a78, dns_answers_2_rrname: www.webs.com, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 299, dns_answers_2_rdata: 2400:cb00:2048:0001:0000:0000:6810:5778, dns_answers_3_rrname: www.webs.com, dns_answers_3_rrtype: AAAA, dns_answers_3_ttl: 299, dns_answers_3_rdata: 2400:cb00:2048:0001:0000:0000:6810:5878, dns_answers_4_rrname: www.webs.com, dns_answers_4_rrtype: AAAA, dns_answers_4_ttl: 299, dns_answers_4_rdata: 2400:cb00:2048:0001:0000:0000:6810:5b78, dns_grouped_AAAA_0: 2400:cb00:2048:0001:0000:0000:6810:5978, dns_grouped_AAAA_1: 2400:cb00:2048:0001:0000:0000:6810:5a78, dns_grouped_AAAA_2: 2400:cb00:2048:0001:0000:0000:6810:5778, dns_grouped_AAAA_3: 2400:cb00:2048:0001:0000:0000:6810:5878, dns_grouped_AAAA_4: 2400:cb00:2048:0001:0000:0000:6810:5b78 ; pcap_cnt: 6969904, event_type: dns, proto: UDP, dns_type: query, dns_id: 12298, dns_rrname: rtb.com.ru, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6970032, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12298, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rtb.com.ru, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: rtb.com.ru, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1254, dns_answers_0_rdata: 83.222.104.102, dns_grouped_A_0: 83.222.104.102 ; pcap_cnt: 7008625, event_type: dns, proto: UDP, dns_type: query, dns_id: 43358, dns_rrname: atlanticmedia.122.2o7.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 7008675, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43358, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: atlanticmedia.122.2o7.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: 2o7.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 56, dns_authorities_0_soa_mname: ns1.omtrdc.net, dns_authorities_0_soa_rname: dnsadmin.omniture.com, dns_authorities_0_soa_serial: 2017070501, dns_authorities_0_soa_refresh: 21600, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7489833, event_type: dns, proto: UDP, dns_type: query, dns_id: 44026, dns_rrname: img0.dditscdn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7489898, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44026, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: img0.dditscdn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: dditscdn.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 109, dns_authorities_0_soa_mname: ns1.dditservices.com, dns_authorities_0_soa_rname: hostmaster.dditservices.com, dns_authorities_0_soa_serial: 2017062101, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 7565854, event_type: dns, proto: UDP, dns_type: query, dns_id: 15493, dns_rrname: cmi.netseer.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7565925, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15493, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cmi.netseer.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cmi.netseer.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 84, dns_answers_0_rdata: cm.netseer.com, dns_answers_1_rrname: cm.netseer.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 21, dns_answers_1_rdata: 54.175.224.18, dns_answers_2_rrname: cm.netseer.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 21, dns_answers_2_rdata: 52.1.246.30, dns_answers_3_rrname: cm.netseer.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 21, dns_answers_3_rdata: 54.210.27.11, dns_answers_4_rrname: cm.netseer.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 21, dns_answers_4_rdata: 54.164.54.149, dns_answers_5_rrname: cm.netseer.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 21, dns_answers_5_rdata: 54.164.133.236, dns_answers_6_rrname: cm.netseer.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 21, dns_answers_6_rdata: 52.206.49.191, dns_answers_7_rrname: cm.netseer.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 21, dns_answers_7_rdata: 54.172.55.5, dns_answers_8_rrname: cm.netseer.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 21, dns_answers_8_rdata: 54.236.2.205, dns_grouped_A_0: 54.175.224.18, dns_grouped_A_1: 52.1.246.30, dns_grouped_A_2: 54.210.27.11, dns_grouped_A_3: 54.164.54.149, dns_grouped_A_4: 54.164.133.236, dns_grouped_A_5: 52.206.49.191, dns_grouped_A_6: 54.172.55.5, dns_grouped_A_7: 54.236.2.205, dns_grouped_CNAME_0: cm.netseer.com ; pcap_cnt: 7649583, event_type: dns, proto: UDP, dns_type: query, dns_id: 41167, dns_rrname: cs9.wac.phicdn.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7649634, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41167, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cs9.wac.phicdn.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: wac.phicdn.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 599, dns_authorities_0_soa_mname: ns1.edgecastcdn.net, dns_authorities_0_soa_rname: noc.edgecast.com, dns_authorities_0_soa_serial: 2015012000, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 8299149, event_type: dns, proto: UDP, dns_type: query, dns_id: 11912, dns_rrname: e5763.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8299238, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11912, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e5763.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e5763.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 23.199.21.132, dns_grouped_A_0: 23.199.21.132 ; pcap_cnt: 8491112, event_type: dns, proto: UDP, dns_type: query, dns_id: 58241, dns_rrname: kinoafisha.ua, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8491142, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58241, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: kinoafisha.ua, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: kinoafisha.ua, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 85176, dns_authorities_0_soa_mname: ns1.fwdcdn.net, dns_authorities_0_soa_rname: hostmaster.ukr.net, dns_authorities_0_soa_serial: 2015112500, dns_authorities_0_soa_refresh: 36000, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8556175, event_type: dns, proto: UDP, dns_type: query, dns_id: 53019, dns_rrname: beeline.am, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8556372, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53019, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: beeline.am, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: beeline.am, dns_answers_0_rrtype: A, dns_answers_0_ttl: 86400, dns_answers_0_rdata: 217.118.87.187, dns_grouped_A_0: 217.118.87.187 ; pcap_cnt: 8976459, event_type: dns, proto: UDP, dns_type: query, dns_id: 35132, dns_rrname: www07.clicktale.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8976533, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35132, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www07.clicktale.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: clicktale.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 179, dns_authorities_0_soa_mname: ns0.dnsmadeeasy.com, dns_authorities_0_soa_rname: dns.dnsmadeeasy.com, dns_authorities_0_soa_serial: 2008012805, dns_authorities_0_soa_refresh: 43200, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 8981376, event_type: dns, proto: UDP, dns_type: query, dns_id: 42118, dns_rrname: deutschebahn.demdex.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 8981400, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42118, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: deutschebahn.demdex.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: deutschebahn.demdex.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: gslb.demdex.net, dns_answers_1_rrname: gslb.demdex.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 402, dns_answers_1_rdata: edge-va6.demdex.net, dns_answers_2_rrname: edge-va6.demdex.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 507, dns_answers_2_rdata: dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com, dns_answers_3_rrname: dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 8, dns_answers_3_rdata: 54.174.165.213, dns_answers_4_rrname: dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 8, dns_answers_4_rdata: 54.164.45.172, dns_answers_5_rrname: dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 8, dns_answers_5_rdata: 34.202.180.186, dns_answers_6_rrname: dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 8, dns_answers_6_rdata: 52.71.86.199, dns_answers_7_rrname: dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 8, dns_answers_7_rdata: 52.72.159.231, dns_answers_8_rrname: dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 8, dns_answers_8_rdata: 52.70.125.189, dns_answers_9_rrname: dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 8, dns_answers_9_rdata: 52.203.95.194, dns_answers_10_rrname: dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 8, dns_answers_10_rdata: 52.86.189.192, dns_grouped_CNAME_0: gslb.demdex.net, dns_grouped_CNAME_1: edge-va6.demdex.net, dns_grouped_CNAME_2: dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 54.174.165.213, dns_grouped_A_1: 54.164.45.172, dns_grouped_A_2: 34.202.180.186, dns_grouped_A_3: 52.71.86.199, dns_grouped_A_4: 52.72.159.231, dns_grouped_A_5: 52.70.125.189, dns_grouped_A_6: 52.203.95.194, dns_grouped_A_7: 52.86.189.192 ; pcap_cnt: 9120443, event_type: dns, proto: UDP, dns_type: query, dns_id: 61921, dns_rrname: pixel.rubiconproject.net.akadns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9120473, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61921, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixel.rubiconproject.net.akadns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pixel.rubiconproject.net.akadns.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 108, dns_answers_0_rdata: 8.43.72.98, dns_answers_1_rrname: pixel.rubiconproject.net.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 108, dns_answers_1_rdata: 8.43.72.21, dns_answers_2_rrname: pixel.rubiconproject.net.akadns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 108, dns_answers_2_rdata: 8.43.72.97, dns_grouped_A_0: 8.43.72.98, dns_grouped_A_1: 8.43.72.21, dns_grouped_A_2: 8.43.72.97 ; pcap_cnt: 9151570, event_type: dns, proto: UDP, dns_type: query, dns_id: 29083, dns_rrname: pixel-origin.mathtag.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 9151580, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 29083, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixel-origin.mathtag.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: mathtag.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 26, dns_authorities_0_soa_mname: ns1.p06.dynect.net, dns_authorities_0_soa_rname: technology.mediamath.com, dns_authorities_0_soa_serial: 422550, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 9193546, event_type: dns, proto: UDP, dns_type: query, dns_id: 1238, dns_rrname: d12uj65dsn9ho1.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 4 ; pcap_cnt: 9193585, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1238, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d12uj65dsn9ho1.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d12uj65dsn9ho1.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 31, dns_authorities_0_soa_mname: ns-1675.awsdns-17.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.