['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60282, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 202, flow_bytes_toclient: 284, flow_age: 99, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 203, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 188, flow_bytes_toclient: 442, flow_age: 75, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 92, flow_bytes_toclient: 120, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 80, flow_bytes_toclient: 141, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 153, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 194, flow_bytes_toclient: 339, flow_age: 38, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 82, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 169, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 146, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 260, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 139, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 87, flow_bytes_toclient: 103, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 146, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 222, flow_bytes_toclient: 320, flow_age: 172, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 155, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 131, flow_bytes_toclient: 213, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 159, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 120, flow_bytes_toclient: 172, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 182, flow_bytes_toclient: 351, flow_age: 12, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 84, flow_bytes_toclient: 132, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 1378860, event_type: dns, proto: UDP, dns_type: query, dns_id: 1753, dns_rrname: pixel.rubiconproject.net.akadns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 1379004, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 1753, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixel.rubiconproject.net.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 180, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499343196, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 1786389, event_type: dns, proto: UDP, dns_type: query, dns_id: 62528, dns_rrname: www.nflhealthplaybook.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 1786521, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62528, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.nflhealthplaybook.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.nflhealthplaybook.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 97, dns_answers_0_rdata: 204.74.99.100, dns_grouped_A_0: 204.74.99.100 ; pcap_cnt: 2911069, event_type: dns, proto: UDP, dns_type: query, dns_id: 39843, dns_rrname: f2.shared.global.fastly.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2911070, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 39843, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: f2.shared.global.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: f2.shared.global.fastly.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 151.101.210.2, dns_grouped_A_0: 151.101.210.2 ; pcap_cnt: 2971067, event_type: dns, proto: UDP, dns_type: query, dns_id: 13426, dns_rrname: pool.proclivity.iponweb.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2971141, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13426, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pool.proclivity.iponweb.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pool.proclivity.iponweb.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 451, dns_answers_0_rdata: elb-aws-va-proclivity-712001148.us-east-1.elb.amazonaws.com, dns_answers_1_rrname: elb-aws-va-proclivity-712001148.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 53, dns_answers_1_rdata: 34.196.134.13, dns_answers_2_rrname: elb-aws-va-proclivity-712001148.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 53, dns_answers_2_rdata: 52.70.86.177, dns_grouped_A_0: 34.196.134.13, dns_grouped_A_1: 52.70.86.177, dns_grouped_CNAME_0: elb-aws-va-proclivity-712001148.us-east-1.elb.amazonaws.com ; pcap_cnt: 3568648, event_type: dns, proto: UDP, dns_type: query, dns_id: 55880, dns_rrname: ads.stickyadstv.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3568905, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55880, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ads.stickyadstv.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ads.stickyadstv.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 50, dns_answers_0_rdata: ip1.ads.stickyadstv.com.akadns.net, dns_answers_1_rrname: ip1.ads.stickyadstv.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 94, dns_answers_1_rdata: fp4.ads.stickyadstv.com.akadns.net, dns_answers_2_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 94, dns_answers_2_rdata: 149.56.241.129, dns_answers_3_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 94, dns_answers_3_rdata: 158.69.126.233, dns_answers_4_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 94, dns_answers_4_rdata: 149.56.241.122, dns_answers_5_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 94, dns_answers_5_rdata: 167.114.174.35, dns_answers_6_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 94, dns_answers_6_rdata: 149.56.21.97, dns_answers_7_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 94, dns_answers_7_rdata: 192.99.63.75, dns_answers_8_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 94, dns_answers_8_rdata: 158.69.53.127, dns_answers_9_rrname: fp4.ads.stickyadstv.com.akadns.net, dns_answers_9_rrtype: A, dns_answers_9_ttl: 94, dns_answers_9_rdata: 149.56.241.121, dns_grouped_CNAME_0: ip1.ads.stickyadstv.com.akadns.net, dns_grouped_CNAME_1: fp4.ads.stickyadstv.com.akadns.net, dns_grouped_A_0: 149.56.241.129, dns_grouped_A_1: 158.69.126.233, dns_grouped_A_2: 149.56.241.122, dns_grouped_A_3: 167.114.174.35, dns_grouped_A_4: 149.56.21.97, dns_grouped_A_5: 192.99.63.75, dns_grouped_A_6: 158.69.53.127, dns_grouped_A_7: 149.56.241.121 ; pcap_cnt: 3589192, event_type: dns, proto: UDP, dns_type: query, dns_id: 62335, dns_rrname: scripts.host.bannerflow.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 3589304, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62335, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: scripts.host.bannerflow.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: scripts.host.bannerflow.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 218, dns_answers_0_rdata: scripts.bannerflow.netdna-cdn.com, dns_answers_1_rrname: scripts.bannerflow.netdna-cdn.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 198.232.124.252, dns_grouped_A_0: 198.232.124.252, dns_grouped_CNAME_0: scripts.bannerflow.netdna-cdn.com ; pcap_cnt: 3671456, event_type: dns, proto: UDP, dns_type: query, dns_id: 23142, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3671501, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23142, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: scontent.xx.fbcdn.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: scontent.xx.fbcdn.net, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 40, dns_answers_0_rdata: 2a03:2880:f012:0008:face:b00c:0000:0001, dns_grouped_AAAA_0: 2a03:2880:f012:0008:face:b00c:0000:0001 ; pcap_cnt: 3951215, event_type: dns, proto: UDP, dns_type: query, dns_id: 177, dns_rrname: sv.bab.la, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3951235, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 177, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sv.bab.la, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: bab.la, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1797, dns_authorities_0_soa_mname: tim.ns.cloudflare.com, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2024168364, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 4010626, event_type: dns, proto: UDP, dns_type: query, dns_id: 12691, dns_rrname: sueddeutsche.sportal.de, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4010627, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12691, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sueddeutsche.sportal.de, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: sportal.de, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1799, dns_authorities_0_soa_mname: dns.roka.net, dns_authorities_0_soa_rname: hostmaster.roka.net, dns_authorities_0_soa_serial: 201706162, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 3600000, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 4175654, event_type: dns, proto: UDP, dns_type: query, dns_id: 48389, dns_rrname: versioncheck.prod.mozaws.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4175655, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48389, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: versioncheck.prod.mozaws.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: prod.mozaws.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 226, dns_authorities_0_soa_mname: ns-1260.awsdns-29.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 4179117, event_type: dns, proto: UDP, dns_type: query, dns_id: 36971, dns_rrname: pagead.l.doubleclick.net, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 4179121, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36971, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pagead.l.doubleclick.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: l.doubleclick.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns4.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 161054468, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 4355020, event_type: dns, proto: UDP, dns_type: query, dns_id: 31759, dns_rrname: pixlgif.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4355030, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31759, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixlgif.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pixlgif.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 104.25.104.17, dns_answers_1_rrname: pixlgif.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 104.25.105.17, dns_grouped_A_0: 104.25.104.17, dns_grouped_A_1: 104.25.105.17 ; pcap_cnt: 5116575, event_type: dns, proto: UDP, dns_type: query, dns_id: 23224, dns_rrname: pxl.connexity.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5116715, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23224, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pxl.connexity.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: connexity.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 111, dns_authorities_0_soa_mname: ns-392.awsdns-49.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 5533622, event_type: dns, proto: UDP, dns_type: query, dns_id: 44517, dns_rrname: buy.tinypass.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5533686, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44517, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: buy.tinypass.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: tinypass.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1797, dns_authorities_0_soa_mname: emma.ns.cloudflare.com, dns_authorities_0_soa_rname: dns.cloudflare.com, dns_authorities_0_soa_serial: 2024810464, dns_authorities_0_soa_refresh: 10000, dns_authorities_0_soa_retry: 2400, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 5584126, event_type: dns, proto: UDP, dns_type: query, dns_id: 20805, dns_rrname: vap.lijit.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5584226, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20805, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: vap.lijit.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: vap.lijit.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 88, dns_answers_0_rdata: 169.55.70.153, dns_answers_1_rrname: vap.lijit.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 88, dns_answers_1_rdata: 169.45.121.189, dns_answers_2_rrname: vap.lijit.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 88, dns_answers_2_rdata: 169.55.70.149, dns_answers_3_rrname: vap.lijit.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 88, dns_answers_3_rdata: 67.217.177.126, dns_answers_4_rrname: vap.lijit.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 88, dns_answers_4_rdata: 67.217.177.94, dns_answers_5_rrname: vap.lijit.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 88, dns_answers_5_rdata: 169.55.70.195, dns_answers_6_rrname: vap.lijit.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 88, dns_answers_6_rdata: 169.55.70.227, dns_answers_7_rrname: vap.lijit.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 88, dns_answers_7_rdata: 169.45.121.172, dns_answers_8_rrname: vap.lijit.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 88, dns_answers_8_rdata: 169.55.165.137, dns_answers_9_rrname: vap.lijit.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 88, dns_answers_9_rdata: 169.55.70.244, dns_answers_10_rrname: vap.lijit.com, dns_answers_10_rrtype: A, dns_answers_10_ttl: 88, dns_answers_10_rdata: 169.55.165.141, dns_grouped_A_0: 169.55.70.153, dns_grouped_A_1: 169.45.121.189, dns_grouped_A_2: 169.55.70.149, dns_grouped_A_3: 67.217.177.126, dns_grouped_A_4: 67.217.177.94, dns_grouped_A_5: 169.55.70.195, dns_grouped_A_6: 169.55.70.227, dns_grouped_A_7: 169.45.121.172, dns_grouped_A_8: 169.55.165.137, dns_grouped_A_9: 169.55.70.244, dns_grouped_A_10: 169.55.165.141 ; pcap_cnt: 5657818, event_type: dns, proto: UDP, dns_type: query, dns_id: 45174, dns_rrname: banescousa.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5657819, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 45174, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: banescousa.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: banescousa.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 299, dns_authorities_0_soa_mname: dns0.easydns.com, dns_authorities_0_soa_rname: zone.easydns.com, dns_authorities_0_soa_serial: 1495563163, dns_authorities_0_soa_refresh: 43200, dns_authorities_0_soa_retry: 10800, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 5788087, event_type: dns, proto: UDP, dns_type: query, dns_id: 47232, dns_rrname: dns.msftncsi.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5788088, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47232, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dns.msftncsi.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dns.msftncsi.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 131.107.255.255, dns_grouped_A_0: 131.107.255.255 ; pcap_cnt: 5860584, event_type: dns, proto: UDP, dns_type: query, dns_id: 13847, dns_rrname: adventori.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5860596, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13847, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: adventori.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: adventori.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1106, dns_authorities_0_soa_mname: a.dns.gandi.net, dns_authorities_0_soa_rname: hostmaster.gandi.net, dns_authorities_0_soa_serial: 1497950649, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 10800 ; pcap_cnt: 7159984, event_type: dns, proto: UDP, dns_type: query, dns_id: 21524, dns_rrname: www.gstatic.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7160052, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21524, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.gstatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.gstatic.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.11.3, dns_grouped_A_0: 172.217.11.3 ; pcap_cnt: 7278986, event_type: dns, proto: UDP, dns_type: query, dns_id: 46258, dns_rrname: cookiesync-mynativeplatform-347915877.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 7279050, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46258, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cookiesync-mynativeplatform-347915877.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 55, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7455632, event_type: dns, proto: UDP, dns_type: query, dns_id: 43603, dns_rrname: g.global-ssl.fastly.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7455637, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43603, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: g.global-ssl.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 5, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 7911825, event_type: dns, proto: UDP, dns_type: query, dns_id: 5175, dns_rrname: f36c22de6f3f4b0a9533d8026be70535-741b2a0bd043.cdn.forter.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7912157, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 5175, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: f36c22de6f3f4b0a9533d8026be70535-741b2a0bd043.cdn.forter.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: forter.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 406, dns_authorities_0_soa_mname: ns-1534.awsdns-63.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8102661, event_type: dns, proto: UDP, dns_type: query, dns_id: 13159, dns_rrname: ad.turn.com.akadns.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8102706, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13159, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ad.turn.com.akadns.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: akadns.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 180, dns_authorities_0_soa_mname: internal.akadns.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499365738, dns_authorities_0_soa_refresh: 90000, dns_authorities_0_soa_retry: 90000, dns_authorities_0_soa_expire: 90000, dns_authorities_0_soa_minimum: 180 ; pcap_cnt: 8468298, event_type: dns, proto: UDP, dns_type: query, dns_id: 41791, dns_rrname: asimov-win.settings.data.microsoft.com.akadns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8468309, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 41791, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: asimov-win.settings.data.microsoft.com.akadns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: asimov-win.settings.data.microsoft.com.akadns.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 205, dns_answers_0_rdata: geo.settings.data.microsoft.com.akadns.net, dns_answers_1_rrname: geo.settings.data.microsoft.com.akadns.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 187, dns_answers_1_rdata: bn2.settings.data.microsoft.com.akadns.net, dns_answers_2_rrname: bn2.settings.data.microsoft.com.akadns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 241, dns_answers_2_rdata: 40.70.221.249, dns_grouped_CNAME_0: geo.settings.data.microsoft.com.akadns.net, dns_grouped_CNAME_1: bn2.settings.data.microsoft.com.akadns.net, dns_grouped_A_0: 40.70.221.249 ; pcap_cnt: 9105251, event_type: dns, proto: UDP, dns_type: query, dns_id: 58868, dns_rrname: ib.anycast.adnxs.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9105298, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58868, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ib.anycast.adnxs.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ib.anycast.adnxs.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 25, dns_answers_0_rdata: 68.67.178.176, dns_answers_1_rrname: ib.anycast.adnxs.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 25, dns_answers_1_rdata: 68.67.178.111, dns_answers_2_rrname: ib.anycast.adnxs.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 25, dns_answers_2_rdata: 68.67.178.243, dns_answers_3_rrname: ib.anycast.adnxs.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 25, dns_answers_3_rdata: 68.67.178.138, dns_answers_4_rrname: ib.anycast.adnxs.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 25, dns_answers_4_rdata: 68.67.178.252, dns_answers_5_rrname: ib.anycast.adnxs.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 25, dns_answers_5_rdata: 68.67.178.132, dns_answers_6_rrname: ib.anycast.adnxs.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 25, dns_answers_6_rdata: 68.67.180.12, dns_answers_7_rrname: ib.anycast.adnxs.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 25, dns_answers_7_rdata: 68.67.178.109, dns_grouped_A_0: 68.67.178.176, dns_grouped_A_1: 68.67.178.111, dns_grouped_A_2: 68.67.178.243, dns_grouped_A_3: 68.67.178.138, dns_grouped_A_4: 68.67.178.252, dns_grouped_A_5: 68.67.178.132, dns_grouped_A_6: 68.67.180.12, dns_grouped_A_7: 68.67.178.109 ; pcap_cnt: 9108332, event_type: dns, proto: UDP, dns_type: query, dns_id: 24445, dns_rrname: mobile.interpark.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 9108367, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24445, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: mobile.interpark.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: interpark.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 293, dns_authorities_0_soa_mname: interpark.com, dns_authorities_0_soa_rname: root.interpark.com, dns_authorities_0_soa_serial: 2017070601, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 300 ; pcap_cnt: 9195914, event_type: dns, proto: UDP, dns_type: query, dns_id: 23666, dns_rrname: p.univide.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9196068, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23666, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: p.univide.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: p.univide.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 54.83.127.186, dns_answers_1_rrname: p.univide.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.86.123.247, dns_answers_2_rrname: p.univide.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 107.21.60.192, dns_grouped_A_0: 54.83.127.186, dns_grouped_A_1: 52.86.123.247, dns_grouped_A_2: 107.21.60.192
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.