['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60666, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 121, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 238, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 111, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 104, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 114, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 107, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 130, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 121, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 133, flow_bytes_toclient: 211, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 111, flow_bytes_toclient: 145, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 170, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 122, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 185, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 104, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 102, flow_bytes_toclient: 157, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 145, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 185, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 161, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 206, flow_bytes_toclient: 299, flow_age: 38, flow_state: established, flow_reason: timeout ; pcap_cnt: 58190, event_type: dns, proto: UDP, dns_type: query, dns_id: 3994, dns_rrname: a1089.d.akamai.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 58192, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3994, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a1089.d.akamai.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a1089.d.akamai.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 12, dns_answers_0_rdata: 184.50.238.241, dns_answers_1_rrname: a1089.d.akamai.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 12, dns_answers_1_rdata: 184.50.238.233, dns_grouped_A_0: 184.50.238.241, dns_grouped_A_1: 184.50.238.233 ; pcap_cnt: 3580322, event_type: dns, proto: UDP, dns_type: query, dns_id: 4916, dns_rrname: au.download.windowsupdate.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3580357, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4916, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: au.download.windowsupdate.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: au.download.windowsupdate.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3306, dns_answers_0_rdata: audownload.windowsupdate.nsatc.net, dns_answers_1_rrname: audownload.windowsupdate.nsatc.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 599, dns_answers_1_rdata: au.au-msedge.net, dns_answers_2_rrname: au.au-msedge.net, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 17, dns_answers_2_rdata: au.c-0001.c-msedge.net, dns_answers_3_rrname: au.c-0001.c-msedge.net, dns_answers_3_rrtype: CNAME, dns_answers_3_ttl: 40, dns_answers_3_rdata: c-0001.c-msedge.net, dns_answers_4_rrname: c-0001.c-msedge.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 45, dns_answers_4_rdata: 13.107.4.50, dns_grouped_A_0: 13.107.4.50, dns_grouped_CNAME_0: audownload.windowsupdate.nsatc.net, dns_grouped_CNAME_1: au.au-msedge.net, dns_grouped_CNAME_2: au.c-0001.c-msedge.net, dns_grouped_CNAME_3: c-0001.c-msedge.net ; pcap_cnt: 3727983, event_type: dns, proto: UDP, dns_type: query, dns_id: 48766, dns_rrname: pixel.mediaiqdigital.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3728055, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48766, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixel.mediaiqdigital.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pixel.mediaiqdigital.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 52.2.180.200, dns_grouped_A_0: 52.2.180.200 ; pcap_cnt: 3760059, event_type: dns, proto: UDP, dns_type: query, dns_id: 4971, dns_rrname: dis.us.criteo.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3760072, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4971, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dis.us.criteo.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dis.us.criteo.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 244, dns_answers_0_rdata: 74.119.118.84, dns_grouped_A_0: 74.119.118.84 ; pcap_cnt: 3898950, event_type: dns, proto: UDP, dns_type: query, dns_id: 25771, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3898965, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25771, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: star-mini.c10r.facebook.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: star-mini.c10r.facebook.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 2, dns_answers_0_rdata: 157.240.18.35, dns_grouped_A_0: 157.240.18.35 ; pcap_cnt: 4174455, event_type: dns, proto: UDP, dns_type: query, dns_id: 38263, dns_rrname: static.eu.criteo.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 4174482, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 38263, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static.eu.criteo.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: static.eu.criteo.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 178.250.2.78, dns_grouped_A_0: 178.250.2.78 ; pcap_cnt: 4230915, event_type: dns, proto: UDP, dns_type: query, dns_id: 24703, dns_rrname: www.jword.jp, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 4231087, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24703, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.jword.jp, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: jword.jp, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 44, dns_authorities_0_soa_mname: dns00.jword.jp, dns_authorities_0_soa_rname: root.jword.jp, dns_authorities_0_soa_serial: 2017070301, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 5595242, event_type: dns, proto: UDP, dns_type: query, dns_id: 46725, dns_rrname: a1089.d.akamai.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5595255, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 46725, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: a1089.d.akamai.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: a1089.d.akamai.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 11, dns_answers_0_rdata: 204.237.173.153, dns_answers_1_rrname: a1089.d.akamai.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 11, dns_answers_1_rdata: 204.237.173.131, dns_grouped_A_0: 204.237.173.153, dns_grouped_A_1: 204.237.173.131 ; pcap_cnt: 5663433, event_type: dns, proto: UDP, dns_type: query, dns_id: 28343, dns_rrname: fanboy-web-linkedin-prod-719098781.us-west-2.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 5663483, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28343, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fanboy-web-linkedin-prod-719098781.us-west-2.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-2.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 23, dns_authorities_0_soa_mname: ns-332.awsdns-41.com, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 5698353, event_type: dns, proto: UDP, dns_type: query, dns_id: 61415, dns_rrname: geo.vortex.data.microsoft.com.akadns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5698358, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61415, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: geo.vortex.data.microsoft.com.akadns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: geo.vortex.data.microsoft.com.akadns.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 97, dns_answers_0_rdata: bn2.vortex.data.microsoft.com.akadns.net, dns_answers_1_rrname: bn2.vortex.data.microsoft.com.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 158, dns_answers_1_rdata: 65.55.44.109, dns_grouped_CNAME_0: bn2.vortex.data.microsoft.com.akadns.net, dns_grouped_A_0: 65.55.44.109 ; pcap_cnt: 6169720, event_type: dns, proto: UDP, dns_type: query, dns_id: 4302, dns_rrname: cs.adingo.jp, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6169853, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4302, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cs.adingo.jp, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: cs.adingo.jp, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 704, dns_authorities_0_soa_mname: ns-1848.awsdns-39.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6515511, event_type: dns, proto: UDP, dns_type: query, dns_id: 62953, dns_rrname: atlas.c10r.facebook.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6515522, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62953, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: atlas.c10r.facebook.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: atlas.c10r.facebook.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 7, dns_answers_0_rdata: 2a03:2880:f027:0204:face:b00c:0000:008c, dns_grouped_AAAA_0: 2a03:2880:f027:0204:face:b00c:0000:008c ; pcap_cnt: 6600410, event_type: dns, proto: UDP, dns_type: query, dns_id: 30236, dns_rrname: d1ibts9hn2apvm.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6600462, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 30236, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d1ibts9hn2apvm.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d1ibts9hn2apvm.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 382, dns_authorities_0_soa_mname: ns-1124.awsdns-12.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 6656267, event_type: dns, proto: UDP, dns_type: query, dns_id: 59165, dns_rrname: ckm-m.xp1.ru4.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6656336, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59165, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ckm-m.xp1.ru4.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ckm-m.xp1.ru4.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 167, dns_answers_0_rdata: 199.38.165.28, dns_grouped_A_0: 199.38.165.28 ; pcap_cnt: 7008831, event_type: dns, proto: UDP, dns_type: query, dns_id: 58668, dns_rrname: aax-us-east.amazon-adsystem.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7008879, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58668, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: aax-us-east.amazon-adsystem.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: aax-us-east.amazon-adsystem.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 60, dns_authorities_0_soa_mname: ns-931.amazon.com, dns_authorities_0_soa_rname: root.amazon.com, dns_authorities_0_soa_serial: 1499362602, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 7776000, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 7475183, event_type: dns, proto: UDP, dns_type: query, dns_id: 36636, dns_rrname: script.ioam.de, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7475219, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 36636, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: script.ioam.de, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: ioam.de, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 621, dns_authorities_0_soa_mname: ns.infonline.de, dns_authorities_0_soa_rname: hostmaster.infonline.de, dns_authorities_0_soa_serial: 2017070401, dns_authorities_0_soa_refresh: 14400, dns_authorities_0_soa_retry: 1800, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 7879223, event_type: dns, proto: UDP, dns_type: query, dns_id: 55022, dns_rrname: tn.symcd.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7879540, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55022, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tn.symcd.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tn.symcd.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2952, dns_answers_0_rdata: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_1_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 1, dns_answers_1_rdata: e8218.dscb1.akamaiedge.net, dns_answers_2_rrname: e8218.dscb1.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 23.54.187.27, dns_grouped_CNAME_0: ocsp-ds.ws.symantec.com.edgekey.net, dns_grouped_CNAME_1: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.54.187.27 ; pcap_cnt: 8663854, event_type: dns, proto: UDP, dns_type: query, dns_id: 63463, dns_rrname: p.static.ads-twitter.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8663916, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63463, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: p.static.ads-twitter.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: ads-twitter.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 31, dns_authorities_0_soa_mname: ns1.p34.dynect.net, dns_authorities_0_soa_rname: ops.twitter.com, dns_authorities_0_soa_serial: 303, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 9108617, event_type: dns, proto: UDP, dns_type: query, dns_id: 44131, dns_rrname: node24.cyberbureau-police-go-kr.nciashield.org, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9108658, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 44131, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: node24.cyberbureau-police-go-kr.nciashield.org, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: nciashield.org, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns1.nciashield.org, dns_authorities_0_soa_rname: root.nciashield.org, dns_authorities_0_soa_serial: 2010121402, dns_authorities_0_soa_refresh: 1, dns_authorities_0_soa_retry: 1, dns_authorities_0_soa_expire: 60, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 9123212, event_type: dns, proto: UDP, dns_type: query, dns_id: 61312, dns_rrname: use-tor.adsrvr.org, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 9123241, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61312, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: use-tor.adsrvr.org, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: use-tor.adsrvr.org, dns_answers_0_rrtype: A, dns_answers_0_ttl: 6, dns_answers_0_rdata: 209.15.224.6, dns_answers_1_rrname: use-tor.adsrvr.org, dns_answers_1_rrtype: A, dns_answers_1_ttl: 6, dns_answers_1_rdata: 209.15.224.8, dns_answers_2_rrname: use-tor.adsrvr.org, dns_answers_2_rrtype: A, dns_answers_2_ttl: 6, dns_answers_2_rdata: 209.15.224.11, dns_grouped_A_0: 209.15.224.6, dns_grouped_A_1: 209.15.224.8, dns_grouped_A_2: 209.15.224.11
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.