['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 61091, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 183, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 81, flow_bytes_toclient: 275, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 200, flow_bytes_toclient: 353, flow_age: 2, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 361, flow_bytes_toclient: 854, flow_age: 286, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 196, flow_bytes_toclient: 292, flow_age: 77, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 179, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 184, flow_bytes_toclient: 309, flow_age: 27, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 172, flow_bytes_toclient: 316, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 101, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 108, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 246, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 413, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 105, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 103, flow_bytes_toclient: 177, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 227, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 106, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 110, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 2502218, event_type: dns, proto: UDP, dns_type: query, dns_id: 60509, dns_rrname: thatswhatshesaid.jezebel.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2502477, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60509, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: thatswhatshesaid.jezebel.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: thatswhatshesaid.jezebel.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1633, dns_answers_0_rdata: kinja.com, dns_answers_1_rrname: kinja.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 47, dns_answers_1_rdata: 151.101.193.34, dns_answers_2_rrname: kinja.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 47, dns_answers_2_rdata: 151.101.65.34, dns_answers_3_rrname: kinja.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 47, dns_answers_3_rdata: 151.101.129.34, dns_answers_4_rrname: kinja.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 47, dns_answers_4_rdata: 151.101.1.34, dns_grouped_A_0: 151.101.193.34, dns_grouped_A_1: 151.101.65.34, dns_grouped_A_2: 151.101.129.34, dns_grouped_A_3: 151.101.1.34, dns_grouped_CNAME_0: kinja.com ; pcap_cnt: 3523198, event_type: dns, proto: UDP, dns_type: query, dns_id: 53410, dns_rrname: i.w55c.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3523229, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 53410, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: i.w55c.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: i.w55c.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 832, dns_answers_0_rdata: dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 45, dns_answers_1_rdata: 52.204.63.223, dns_answers_2_rrname: dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 45, dns_answers_2_rdata: 52.22.158.228, dns_answers_3_rrname: dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 45, dns_answers_3_rdata: 52.204.149.202, dns_answers_4_rrname: dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 45, dns_answers_4_rdata: 52.200.140.34, dns_answers_5_rrname: dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 45, dns_answers_5_rdata: 52.0.178.86, dns_answers_6_rrname: dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 45, dns_answers_6_rdata: 52.4.195.71, dns_answers_7_rrname: dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 45, dns_answers_7_rdata: 52.4.75.22, dns_answers_8_rrname: dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 45, dns_answers_8_rdata: 52.5.54.187, dns_grouped_A_0: 52.204.63.223, dns_grouped_A_1: 52.22.158.228, dns_grouped_A_2: 52.204.149.202, dns_grouped_A_3: 52.200.140.34, dns_grouped_A_4: 52.0.178.86, dns_grouped_A_5: 52.4.195.71, dns_grouped_A_6: 52.4.75.22, dns_grouped_A_7: 52.5.54.187, dns_grouped_CNAME_0: dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com ; pcap_cnt: 3613456, event_type: dns, proto: UDP, dns_type: query, dns_id: 1812, dns_rrname: d39rqydp4iuyht.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3613695, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1812, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d39rqydp4iuyht.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d39rqydp4iuyht.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 254, dns_authorities_0_soa_mname: ns-1139.awsdns-14.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 3616816, event_type: dns, proto: UDP, dns_type: query, dns_id: 21855, dns_rrname: pagead2.googlesyndication.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 3616896, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21855, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pagead2.googlesyndication.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: pagead2.googlesyndication.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 299, dns_answers_0_rdata: pagead46.l.doubleclick.net, dns_answers_1_rrname: pagead46.l.doubleclick.net, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 82, dns_answers_1_rdata: 2607:f8b0:4006:081b:0000:0000:0000:2002, dns_grouped_AAAA_0: 2607:f8b0:4006:081b:0000:0000:0000:2002, dns_grouped_CNAME_0: pagead46.l.doubleclick.net ; pcap_cnt: 4217852, event_type: dns, proto: UDP, dns_type: query, dns_id: 33302, dns_rrname: d36hc0p18k1aoc.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4218629, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33302, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d36hc0p18k1aoc.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d36hc0p18k1aoc.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 792, dns_authorities_0_soa_mname: ns-730.awsdns-27.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 4270694, event_type: dns, proto: UDP, dns_type: query, dns_id: 4698, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 4270695, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4698, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: t.lkqd.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: t.lkqd.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 56, dns_answers_0_rdata: 146.20.128.92, dns_answers_1_rrname: t.lkqd.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 56, dns_answers_1_rdata: 146.20.128.88, dns_answers_2_rrname: t.lkqd.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 56, dns_answers_2_rdata: 146.20.128.87, dns_answers_3_rrname: t.lkqd.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 56, dns_answers_3_rdata: 146.20.128.82, dns_answers_4_rrname: t.lkqd.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 56, dns_answers_4_rdata: 146.20.128.93, dns_answers_5_rrname: t.lkqd.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 56, dns_answers_5_rdata: 146.20.128.84, dns_answers_6_rrname: t.lkqd.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 56, dns_answers_6_rdata: 146.20.128.85, dns_answers_7_rrname: t.lkqd.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 56, dns_answers_7_rdata: 146.20.128.89, dns_answers_8_rrname: t.lkqd.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 56, dns_answers_8_rdata: 146.20.128.90, dns_answers_9_rrname: t.lkqd.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 56, dns_answers_9_rdata: 146.20.128.97, dns_answers_10_rrname: t.lkqd.net, dns_answers_10_rrtype: A, dns_answers_10_ttl: 56, dns_answers_10_rdata: 146.20.128.83, dns_answers_11_rrname: t.lkqd.net, dns_answers_11_rrtype: A, dns_answers_11_ttl: 56, dns_answers_11_rdata: 146.20.128.86, dns_answers_12_rrname: t.lkqd.net, dns_answers_12_rrtype: A, dns_answers_12_ttl: 56, dns_answers_12_rdata: 146.20.128.94, dns_answers_13_rrname: t.lkqd.net, dns_answers_13_rrtype: A, dns_answers_13_ttl: 56, dns_answers_13_rdata: 146.20.128.95, dns_answers_14_rrname: t.lkqd.net, dns_answers_14_rrtype: A, dns_answers_14_ttl: 56, dns_answers_14_rdata: 146.20.128.96, dns_answers_15_rrname: t.lkqd.net, dns_answers_15_rrtype: A, dns_answers_15_ttl: 56, dns_answers_15_rdata: 146.20.128.91, dns_grouped_A_0: 146.20.128.92, dns_grouped_A_1: 146.20.128.88, dns_grouped_A_2: 146.20.128.87, dns_grouped_A_3: 146.20.128.82, dns_grouped_A_4: 146.20.128.93, dns_grouped_A_5: 146.20.128.84, dns_grouped_A_6: 146.20.128.85, dns_grouped_A_7: 146.20.128.89, dns_grouped_A_8: 146.20.128.90, dns_grouped_A_9: 146.20.128.97, dns_grouped_A_10: 146.20.128.83, dns_grouped_A_11: 146.20.128.86, dns_grouped_A_12: 146.20.128.94, dns_grouped_A_13: 146.20.128.95, dns_grouped_A_14: 146.20.128.96, dns_grouped_A_15: 146.20.128.91 ; pcap_cnt: 4344354, event_type: dns, proto: UDP, dns_type: query, dns_id: 28212, dns_rrname: ce2.uicdn.net, dns_rrtype: AAAA, dns_tx_id: 4 ; pcap_cnt: 4344395, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28212, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ce2.uicdn.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: uicdn.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 599, dns_authorities_0_soa_mname: ns-webde.ui-dns.de, dns_authorities_0_soa_rname: dnsadmin.1und1.de, dns_authorities_0_soa_serial: 2005012674, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 4379822, event_type: dns, proto: UDP, dns_type: query, dns_id: 3457, dns_rrname: pixel.adsafeprotected.com, dns_rrtype: AAAA, dns_tx_id: 6 ; pcap_cnt: 4379868, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3457, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixel.adsafeprotected.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: pixel.adsafeprotected.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2285, dns_answers_0_rdata: anycast.pixel.adsafeprotected.com, dns_grouped_CNAME_0: anycast.pixel.adsafeprotected.com, dns_authorities_0_rrname: adsafeprotected.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 4, dns_authorities_0_soa_mname: dns1.p05.nsone.net, dns_authorities_0_soa_rname: hostmaster.nsone.net, dns_authorities_0_soa_serial: 1497564449, dns_authorities_0_soa_refresh: 180, dns_authorities_0_soa_retry: 180, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 7200 ; pcap_cnt: 5208115, event_type: dns, proto: UDP, dns_type: query, dns_id: 27745, dns_rrname: delivery.clickonometrics.pl, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5208259, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 27745, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: delivery.clickonometrics.pl, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: clickonometrics.pl, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 648, dns_authorities_0_soa_mname: ns1.nazwa.pl, dns_authorities_0_soa_rname: biuro.nazwa.pl, dns_authorities_0_soa_serial: 2008133200, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 5232996, event_type: dns, proto: UDP, dns_type: query, dns_id: 26630, dns_rrname: wosign-ovca.ocsp-certum.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5234185, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26630, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: wosign-ovca.ocsp-certum.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: wosign-ovca.ocsp-certum.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 59, dns_answers_0_rdata: cmocsp.wosign.com, dns_answers_1_rrname: cmocsp.wosign.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 104.192.110.216, dns_grouped_CNAME_0: cmocsp.wosign.com, dns_grouped_A_0: 104.192.110.216 ; pcap_cnt: 5295287, event_type: dns, proto: UDP, dns_type: query, dns_id: 64493, dns_rrname: trucks.autotrader.co.uk, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5295305, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64493, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: trucks.autotrader.co.uk, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: trucks.autotrader.co.uk, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 15, dns_answers_0_rdata: merlin-cache.autotrader.co.uk, dns_answers_1_rrname: merlin-cache.autotrader.co.uk, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 16, dns_answers_1_rdata: merlin-cache.tradermedia.net, dns_answers_2_rrname: merlin-cache.tradermedia.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 18, dns_answers_2_rdata: 193.243.130.43, dns_grouped_CNAME_0: merlin-cache.autotrader.co.uk, dns_grouped_CNAME_1: merlin-cache.tradermedia.net, dns_grouped_A_0: 193.243.130.43 ; pcap_cnt: 5389076, event_type: dns, proto: UDP, dns_type: query, dns_id: 10565, dns_rrname: static.hotjar.netdna-cdn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5389079, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10565, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static.hotjar.netdna-cdn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: netdna-cdn.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 429, dns_authorities_0_soa_mname: ns-97.awsdns-12.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 5399328, event_type: dns, proto: UDP, dns_type: query, dns_id: 45195, dns_rrname: ssp.adriver.ru, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5399357, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45195, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ssp.adriver.ru, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ssp.adriver.ru, dns_answers_0_rrtype: A, dns_answers_0_ttl: 37, dns_answers_0_rdata: 195.209.111.4, dns_answers_1_rrname: ssp.adriver.ru, dns_answers_1_rrtype: A, dns_answers_1_ttl: 37, dns_answers_1_rdata: 195.209.111.13, dns_answers_2_rrname: ssp.adriver.ru, dns_answers_2_rrtype: A, dns_answers_2_ttl: 37, dns_answers_2_rdata: 195.209.111.7, dns_grouped_A_0: 195.209.111.4, dns_grouped_A_1: 195.209.111.13, dns_grouped_A_2: 195.209.111.7 ; pcap_cnt: 5966043, event_type: dns, proto: UDP, dns_type: query, dns_id: 8258, dns_rrname: e7313.g.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5966044, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 8258, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e7313.g.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 919, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499444653, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 5966367, event_type: dns, proto: UDP, dns_type: query, dns_id: 37258, dns_rrname: c.6sc.co, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 5966573, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 37258, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: c.6sc.co, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: c.6sc.co, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 240, dns_answers_0_rdata: c.6sc.co.edgekey.net, dns_answers_1_rrname: c.6sc.co.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20820, dns_answers_1_rdata: e7313.g.akamaiedge.net, dns_answers_2_rrname: e7313.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 104.76.109.46, dns_grouped_CNAME_0: c.6sc.co.edgekey.net, dns_grouped_CNAME_1: e7313.g.akamaiedge.net, dns_grouped_A_0: 104.76.109.46 ; pcap_cnt: 6228662, event_type: dns, proto: UDP, dns_type: query, dns_id: 42526, dns_rrname: us-u.openx.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6228707, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 42526, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: us-u.openx.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: us-u.openx.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 288, dns_answers_0_rdata: 173.241.242.143, dns_grouped_A_0: 173.241.242.143 ; pcap_cnt: 6621996, event_type: dns, proto: UDP, dns_type: query, dns_id: 28228, dns_rrname: img-fanatik.mncdn.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6622061, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28228, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: img-fanatik.mncdn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: img-fanatik.mncdn.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 19, dns_answers_0_rdata: 69.4.95.11, dns_grouped_A_0: 69.4.95.11 ; pcap_cnt: 6747703, event_type: dns, proto: UDP, dns_type: query, dns_id: 50626, dns_rrname: x.bidswitch.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6747797, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 50626, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: x.bidswitch.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: x.bidswitch.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 119, dns_answers_0_rdata: 35.185.26.229, dns_answers_1_rrname: x.bidswitch.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 119, dns_answers_1_rdata: 35.190.143.22, dns_answers_2_rrname: x.bidswitch.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 119, dns_answers_2_rdata: 35.185.60.74, dns_answers_3_rrname: x.bidswitch.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 119, dns_answers_3_rdata: 104.196.170.154, dns_answers_4_rrname: x.bidswitch.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 119, dns_answers_4_rdata: 35.185.22.177, dns_answers_5_rrname: x.bidswitch.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 119, dns_answers_5_rdata: 35.185.5.77, dns_answers_6_rrname: x.bidswitch.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 119, dns_answers_6_rdata: 104.196.221.126, dns_answers_7_rrname: x.bidswitch.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 119, dns_answers_7_rdata: 35.185.125.238, dns_answers_8_rrname: x.bidswitch.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 119, dns_answers_8_rdata: 35.185.91.87, dns_answers_9_rrname: x.bidswitch.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 119, dns_answers_9_rdata: 104.196.29.166, dns_grouped_A_0: 35.185.26.229, dns_grouped_A_1: 35.190.143.22, dns_grouped_A_2: 35.185.60.74, dns_grouped_A_3: 104.196.170.154, dns_grouped_A_4: 35.185.22.177, dns_grouped_A_5: 35.185.5.77, dns_grouped_A_6: 104.196.221.126, dns_grouped_A_7: 35.185.125.238, dns_grouped_A_8: 35.185.91.87, dns_grouped_A_9: 104.196.29.166 ; pcap_cnt: 6782837, event_type: dns, proto: UDP, dns_type: query, dns_id: 46032, dns_rrname: userdblb.tubemogul.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6782849, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46032, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: userdblb.tubemogul.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: userdblb.tubemogul.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 143, dns_answers_0_rdata: 107.21.249.100, dns_answers_1_rrname: userdblb.tubemogul.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 143, dns_answers_1_rdata: 54.225.255.135, dns_answers_2_rrname: userdblb.tubemogul.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 143, dns_answers_2_rdata: 184.73.199.81, dns_answers_3_rrname: userdblb.tubemogul.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 143, dns_answers_3_rdata: 184.73.198.237, dns_answers_4_rrname: userdblb.tubemogul.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 143, dns_answers_4_rdata: 184.73.198.200, dns_answers_5_rrname: userdblb.tubemogul.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 143, dns_answers_5_rdata: 107.21.250.221, dns_answers_6_rrname: userdblb.tubemogul.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 143, dns_answers_6_rdata: 107.21.248.242, dns_answers_7_rrname: userdblb.tubemogul.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 143, dns_answers_7_rdata: 54.225.186.185, dns_answers_8_rrname: userdblb.tubemogul.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 143, dns_answers_8_rdata: 184.73.198.136, dns_answers_9_rrname: userdblb.tubemogul.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 143, dns_answers_9_rdata: 54.225.202.195, dns_answers_10_rrname: userdblb.tubemogul.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 143, dns_answers_10_rdata: 107.21.249.217, dns_answers_11_rrname: userdblb.tubemogul.com, dns_answers_11_rrtype: A, dns_answers_11_ttl: 143, dns_answers_11_rdata: 107.21.249.145, dns_answers_12_rrname: userdblb.tubemogul.com, dns_answers_12_rrtype: A, dns_answers_12_ttl: 143, dns_answers_12_rdata: 184.73.198.130, dns_answers_13_rrname: userdblb.tubemogul.com, dns_answers_13_rrtype: A, dns_answers_13_ttl: 143, dns_answers_13_rdata: 184.73.196.217, dns_answers_14_rrname: userdblb.tubemogul.com, dns_answers_14_rrtype: A, dns_answers_14_ttl: 143, dns_answers_14_rdata: 107.21.250.154, dns_answers_15_rrname: userdblb.tubemogul.com, dns_answers_15_rrtype: A, dns_answers_15_ttl: 143, dns_answers_15_rdata: 107.21.249.135, dns_answers_16_rrname: userdblb.tubemogul.com, dns_answers_16_rrtype: A, dns_answers_16_ttl: 143, dns_answers_16_rdata: 184.73.199.125, dns_answers_17_rrname: userdblb.tubemogul.com, dns_answers_17_rrtype: A, dns_answers_17_ttl: 143, dns_answers_17_rdata: 184.73.198.9, dns_answers_18_rrname: userdblb.tubemogul.com, dns_answers_18_rrtype: A, dns_answers_18_ttl: 143, dns_answers_18_rdata: 107.21.249.50, dns_answers_19_rrname: userdblb.tubemogul.com, dns_answers_19_rrtype: A, dns_answers_19_ttl: 143, dns_answers_19_rdata: 54.225.147.109, dns_grouped_A_0: 107.21.249.100, dns_grouped_A_1: 54.225.255.135, dns_grouped_A_2: 184.73.199.81, dns_grouped_A_3: 184.73.198.237, dns_grouped_A_4: 184.73.198.200, dns_grouped_A_5: 107.21.250.221, dns_grouped_A_6: 107.21.248.242, dns_grouped_A_7: 54.225.186.185, dns_grouped_A_8: 184.73.198.136, dns_grouped_A_9: 54.225.202.195, dns_grouped_A_10: 107.21.249.217, dns_grouped_A_11: 107.21.249.145, dns_grouped_A_12: 184.73.198.130, dns_grouped_A_13: 184.73.196.217, dns_grouped_A_14: 107.21.250.154, dns_grouped_A_15: 107.21.249.135, dns_grouped_A_16: 184.73.199.125, dns_grouped_A_17: 184.73.198.9, dns_grouped_A_18: 107.21.249.50, dns_grouped_A_19: 54.225.147.109 ; pcap_cnt: 6827608, event_type: dns, proto: UDP, dns_type: query, dns_id: 33726, dns_rrname: ocsp.usertrust.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6827682, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33726, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.usertrust.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.usertrust.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 150, dns_answers_0_rdata: 178.255.83.1, dns_grouped_A_0: 178.255.83.1 ; pcap_cnt: 7542126, event_type: dns, proto: UDP, dns_type: query, dns_id: 2471, dns_rrname: bat-bing-com.a-0001.a-msedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7542166, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 2471, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: bat-bing-com.a-0001.a-msedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: bat-bing-com.a-0001.a-msedge.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: a-0001.a-msedge.net, dns_grouped_CNAME_0: a-0001.a-msedge.net, dns_authorities_0_rrname: a-msedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 37, dns_authorities_0_soa_mname: ns1.a-msedge.net, dns_authorities_0_soa_rname: msnhst.microsoft.com, dns_authorities_0_soa_serial: 2016092901, dns_authorities_0_soa_refresh: 1800, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 240 ; pcap_cnt: 7817527, event_type: dns, proto: UDP, dns_type: query, dns_id: 60219, dns_rrname: dnn506yrbagrg.cloudfront.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7817675, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60219, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dnn506yrbagrg.cloudfront.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dnn506yrbagrg.cloudfront.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 52.84.143.87, dns_answers_1_rrname: dnn506yrbagrg.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.143.74, dns_answers_2_rrname: dnn506yrbagrg.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.143.235, dns_answers_3_rrname: dnn506yrbagrg.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.143.140, dns_answers_4_rrname: dnn506yrbagrg.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.143.103, dns_answers_5_rrname: dnn506yrbagrg.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.143.93, dns_answers_6_rrname: dnn506yrbagrg.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.143.102, dns_answers_7_rrname: dnn506yrbagrg.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.143.141, dns_grouped_A_0: 52.84.143.87, dns_grouped_A_1: 52.84.143.74, dns_grouped_A_2: 52.84.143.235, dns_grouped_A_3: 52.84.143.140, dns_grouped_A_4: 52.84.143.103, dns_grouped_A_5: 52.84.143.93, dns_grouped_A_6: 52.84.143.102, dns_grouped_A_7: 52.84.143.141 ; pcap_cnt: 7988083, event_type: dns, proto: UDP, dns_type: query, dns_id: 44342, dns_rrname: www.tubepatrol.porn, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7988088, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44342, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.tubepatrol.porn, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.tubepatrol.porn, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1199, dns_answers_0_rdata: 46.229.174.117, dns_grouped_A_0: 46.229.174.117 ; pcap_cnt: 8276242, event_type: dns, proto: UDP, dns_type: query, dns_id: 36643, dns_rrname: e13136.g.akamaiedge.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8276243, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36643, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e13136.g.akamaiedge.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: e13136.g.akamaiedge.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 0, dns_answers_0_rdata: 23.211.130.2, dns_grouped_A_0: 23.211.130.2
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.