['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60871, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 101, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 134, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 154, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 174, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 374, flow_bytes_toclient: 574, flow_age: 301, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 219, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 172, flow_bytes_toclient: 326, flow_age: 82, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 200, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 253, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 169, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 132, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 160, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 108, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 154, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 175, flow_bytes_toclient: 255, flow_age: 156, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 169, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 142, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 2995453, event_type: dns, proto: UDP, dns_type: query, dns_id: 12970, dns_rrname: gum.criteo.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2995461, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12970, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: gum.criteo.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: gum.criteo.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 124, dns_answers_0_rdata: 74.119.118.67, dns_grouped_A_0: 74.119.118.67 ; pcap_cnt: 3589606, event_type: dns, proto: UDP, dns_type: query, dns_id: 60813, dns_rrname: p.rfihub.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3589635, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60813, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: p.rfihub.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: p.rfihub.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 258, dns_answers_0_rdata: a.rfihub.com, dns_answers_1_rrname: a.rfihub.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 2, dns_answers_1_rdata: a-tm.rfihub.com, dns_answers_2_rrname: a-tm.rfihub.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 25, dns_answers_2_rdata: 198.8.70.211, dns_grouped_A_0: 198.8.70.211, dns_grouped_CNAME_0: a.rfihub.com, dns_grouped_CNAME_1: a-tm.rfihub.com ; pcap_cnt: 3908791, event_type: dns, proto: UDP, dns_type: query, dns_id: 27165, dns_rrname: e4937.d.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3908807, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 27165, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e4937.d.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 639, dns_authorities_0_soa_mname: n0d.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499431723, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 4126951, event_type: dns, proto: UDP, dns_type: query, dns_id: 28303, dns_rrname: codeload.github.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4126957, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28303, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: codeload.github.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: github.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 738, dns_authorities_0_soa_mname: ns-1707.awsdns-21.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 4290200, event_type: dns, proto: UDP, dns_type: query, dns_id: 43999, dns_rrname: httpbin.org, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4290398, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43999, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: httpbin.org, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: httpbin.org, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 43, dns_authorities_0_soa_mname: ns1.dnsimple.com, dns_authorities_0_soa_rname: admin.dnsimple.com, dns_authorities_0_soa_serial: 2013021906, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 4293921, event_type: dns, proto: UDP, dns_type: query, dns_id: 47219, dns_rrname: requests-docs-pt.readthedocs.org, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 4294284, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47219, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: requests-docs-pt.readthedocs.org, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: readthedocs.org, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 227, dns_authorities_0_soa_mname: ns.rackspace.com, dns_authorities_0_soa_rname: eric.ericholscher.com, dns_authorities_0_soa_serial: 1498741358, dns_authorities_0_soa_refresh: 21600, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 1814400, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 4345071, event_type: dns, proto: UDP, dns_type: query, dns_id: 41967, dns_rrname: pagead2.googlesyndication.com, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 4345150, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41967, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pagead2.googlesyndication.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pagead2.googlesyndication.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 128, dns_answers_0_rdata: pagead46.l.doubleclick.net, dns_answers_1_rrname: pagead46.l.doubleclick.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 80, dns_answers_1_rdata: 172.217.12.130, dns_grouped_CNAME_0: pagead46.l.doubleclick.net, dns_grouped_A_0: 172.217.12.130 ; pcap_cnt: 4413856, event_type: dns, proto: UDP, dns_type: query, dns_id: 41140, dns_rrname: cdn.optimizely.com, dns_rrtype: A, dns_tx_id: 6 ; pcap_cnt: 4413906, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41140, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.optimizely.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.optimizely.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 19, dns_answers_0_rdata: 23.194.140.85, dns_grouped_A_0: 23.194.140.85 ; pcap_cnt: 4751972, event_type: dns, proto: UDP, dns_type: query, dns_id: 11850, dns_rrname: spotx-match.dotomi.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4752186, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11850, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: spotx-match.dotomi.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: spotx-match.dotomi.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: usadmm.dotomi.com.dotomi.weighted.com.akadns.net, dns_answers_1_rrname: usadmm.dotomi.com.dotomi.weighted.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 73, dns_answers_1_rdata: nsy-iad.dotomi.weighted.com.akadns.net, dns_answers_2_rrname: nsy-iad.dotomi.weighted.com.akadns.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 1, dns_answers_2_rdata: iad07-login.dotomi.com, dns_answers_3_rrname: iad07-login.dotomi.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 134, dns_answers_3_rdata: 67.72.99.140, dns_grouped_CNAME_0: usadmm.dotomi.com.dotomi.weighted.com.akadns.net, dns_grouped_CNAME_1: nsy-iad.dotomi.weighted.com.akadns.net, dns_grouped_CNAME_2: iad07-login.dotomi.com, dns_grouped_A_0: 67.72.99.140 ; pcap_cnt: 5182917, event_type: dns, proto: UDP, dns_type: query, dns_id: 8352, dns_rrname: cdn.adnxs.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5182919, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 8352, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.adnxs.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adnxs.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 15, dns_authorities_0_soa_mname: ns1.gslb.com, dns_authorities_0_soa_rname: support.appnexus.net, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 86400, dns_authorities_0_soa_retry: 30, dns_authorities_0_soa_expire: 86400, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 5218273, event_type: dns, proto: UDP, dns_type: query, dns_id: 11718, dns_rrname: cotads.adscale.de, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5218308, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11718, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cotads.adscale.de, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cotads.adscale.de, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 181, dns_answers_0_rdata: san.adscale.de.edgekey.net, dns_answers_1_rrname: san.adscale.de.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 4654, dns_answers_1_rdata: e9040.g.akamaiedge.net, dns_answers_2_rrname: e9040.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 23.194.141.229, dns_grouped_A_0: 23.194.141.229, dns_grouped_CNAME_0: san.adscale.de.edgekey.net, dns_grouped_CNAME_1: e9040.g.akamaiedge.net ; pcap_cnt: 5543721, event_type: dns, proto: UDP, dns_type: query, dns_id: 62426, dns_rrname: simage2.pubmatic.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5543955, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62426, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: simage2.pubmatic.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: simage2.pubmatic.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 244, dns_answers_0_rdata: pug44000nc.pubmatic.com, dns_answers_1_rrname: pug44000nc.pubmatic.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 72, dns_answers_1_rdata: pug44000n.pubmatic.com, dns_grouped_CNAME_0: pug44000nc.pubmatic.com, dns_grouped_CNAME_1: pug44000n.pubmatic.com, dns_authorities_0_rrname: pubmatic.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 19, dns_authorities_0_soa_mname: ns1.p29.dynect.net, dns_authorities_0_soa_rname: anand.pubmatic.com, dns_authorities_0_soa_serial: 12714, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5635195, event_type: dns, proto: UDP, dns_type: query, dns_id: 26052, dns_rrname: gslb.demdex.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5635263, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26052, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: gslb.demdex.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: gslb.demdex.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 454, dns_answers_0_rdata: edge-usw2.demdex.net, dns_answers_1_rrname: edge-usw2.demdex.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 395, dns_answers_1_rdata: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_grouped_CNAME_0: edge-usw2.demdex.net, dns_grouped_CNAME_1: dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com, dns_authorities_0_rrname: us-west-2.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 44, dns_authorities_0_soa_mname: ns-332.awsdns-41.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5831208, event_type: dns, proto: UDP, dns_type: query, dns_id: 35171, dns_rrname: sync.1rx.io, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5831238, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35171, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sync.1rx.io, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: 1rx.io, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 632, dns_authorities_0_soa_mname: ns-1960.awsdns-53.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6053599, event_type: dns, proto: UDP, dns_type: query, dns_id: 35468, dns_rrname: www.twitter.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6053978, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35468, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.twitter.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.twitter.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 494, dns_answers_0_rdata: twitter.com, dns_answers_1_rrname: twitter.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1175, dns_answers_1_rdata: 104.244.42.129, dns_answers_2_rrname: twitter.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1175, dns_answers_2_rdata: 104.244.42.65, dns_grouped_CNAME_0: twitter.com, dns_grouped_A_0: 104.244.42.129, dns_grouped_A_1: 104.244.42.65 ; pcap_cnt: 6636297, event_type: dns, proto: UDP, dns_type: query, dns_id: 19363, dns_rrname: cm.dsp.linksynergy.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6636329, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19363, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cm.dsp.linksynergy.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cm.dsp.linksynergy.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 106, dns_answers_0_rdata: ec2-107-22-42-44.compute-1.amazonaws.com, dns_answers_1_rrname: ec2-107-22-42-44.compute-1.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 86193, dns_answers_1_rdata: 107.22.42.44, dns_grouped_CNAME_0: ec2-107-22-42-44.compute-1.amazonaws.com, dns_grouped_A_0: 107.22.42.44 ; pcap_cnt: 6921716, event_type: dns, proto: UDP, dns_type: query, dns_id: 21594, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6921783, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21594, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: scontent.xx.fbcdn.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 11, dns_answers_0_rdata: 157.240.18.19, dns_grouped_A_0: 157.240.18.19 ; pcap_cnt: 7241081, event_type: dns, proto: UDP, dns_type: query, dns_id: 4987, dns_rrname: e2066.g.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7241098, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4987, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e2066.g.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 836, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499449952, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 7529201, event_type: dns, proto: UDP, dns_type: query, dns_id: 43709, dns_rrname: www.tns-counter.ru, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7529225, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43709, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.tns-counter.ru, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.tns-counter.ru, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1513, dns_answers_0_rdata: 194.226.130.226, dns_answers_1_rrname: www.tns-counter.ru, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1513, dns_answers_1_rdata: 194.226.130.227, dns_answers_2_rrname: www.tns-counter.ru, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1513, dns_answers_2_rdata: 194.226.130.229, dns_answers_3_rrname: www.tns-counter.ru, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1513, dns_answers_3_rdata: 194.226.130.228, dns_grouped_A_0: 194.226.130.226, dns_grouped_A_1: 194.226.130.227, dns_grouped_A_2: 194.226.130.229, dns_grouped_A_3: 194.226.130.228 ; pcap_cnt: 7573319, event_type: dns, proto: UDP, dns_type: query, dns_id: 26768, dns_rrname: www.mainadv.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 7573376, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26768, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.mainadv.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.mainadv.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 54994, dns_answers_0_rdata: 130.211.36.116, dns_grouped_A_0: 130.211.36.116 ; pcap_cnt: 7927395, event_type: dns, proto: UDP, dns_type: query, dns_id: 46769, dns_rrname: j0.pc20160301.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7927529, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46769, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: j0.pc20160301.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: j0.pc20160301.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 77, dns_answers_0_rdata: cs843.wac.systemcdn.net, dns_grouped_CNAME_0: cs843.wac.systemcdn.net, dns_authorities_0_rrname: wac.systemcdn.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 599, dns_authorities_0_soa_mname: ns1.systemcdn.net, dns_authorities_0_soa_rname: noc.systemcdn.net, dns_authorities_0_soa_serial: 2009090200, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 9497774, event_type: dns, proto: UDP, dns_type: query, dns_id: 1604, dns_rrname: twitter.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9498029, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1604, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: twitter.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: twitter.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 272, dns_authorities_0_soa_mname: ns-881.awsdns-46.net, dns_authorities_0_soa_rname: ops.twitter.com, dns_authorities_0_soa_serial: 2007131073, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.