['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60988, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 148, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 276, flow_bytes_toclient: 509, flow_age: 150, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 83, flow_bytes_toclient: 185, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 155, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 107, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 197, flow_bytes_toclient: 343, flow_age: 30, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 86, flow_bytes_toclient: 192, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 120, flow_bytes_toclient: 204, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 176, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 123, flow_bytes_toclient: 251, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 103, flow_bytes_toclient: 270, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 89, flow_bytes_toclient: 117, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 96, flow_bytes_toclient: 152, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 85, flow_bytes_toclient: 155, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 172, flow_bytes_toclient: 312, flow_age: 4, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 152, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 136, flow_bytes_toclient: 217, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 158, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 91, flow_bytes_toclient: 189, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 47500, event_type: dns, proto: UDP, dns_type: query, dns_id: 55406, dns_rrname: 93.216.1.52.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 47519, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 55406, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 93.216.1.52.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 93.216.1.52.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 300, dns_answers_0_rdata: ec2-52-1-216-93.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-52-1-216-93.compute-1.amazonaws.com ; pcap_cnt: 376255, event_type: dns, proto: UDP, dns_type: query, dns_id: 64899, dns_rrname: 44.108.45.169.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 376278, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 64899, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 44.108.45.169.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 44.108.45.169.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 79906, dns_answers_0_rdata: 2c.6c.2da9.ip4.static.sl-reverse.com, dns_grouped_PTR_0: 2c.6c.2da9.ip4.static.sl-reverse.com ; pcap_cnt: 380512, event_type: dns, proto: UDP, dns_type: query, dns_id: 40120, dns_rrname: secure-cdn.mplxtms.com, dns_rrtype: AAAA, dns_tx_id: 2 ; pcap_cnt: 380537, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 40120, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: secure-cdn.mplxtms.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: secure-cdn.mplxtms.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 47, dns_answers_0_rdata: san.valueclick.com.edgekey.net, dns_answers_1_rrname: san.valueclick.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 16173, dns_answers_1_rdata: e544.g.akamaiedge.net, dns_grouped_CNAME_0: san.valueclick.com.edgekey.net, dns_grouped_CNAME_1: e544.g.akamaiedge.net, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 616, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499170201, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 484367, event_type: dns, proto: UDP, dns_type: query, dns_id: 17027, dns_rrname: dpm.lefigaro.fr, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 484398, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 17027, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dpm.lefigaro.fr, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dpm.lefigaro.fr, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 429, dns_answers_0_rdata: figdpm.zebestof.com, dns_answers_1_rrname: figdpm.zebestof.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 113, dns_answers_1_rdata: 195.154.148.3, dns_grouped_CNAME_0: figdpm.zebestof.com, dns_grouped_A_0: 195.154.148.3 ; pcap_cnt: 2461756, event_type: dns, proto: UDP, dns_type: query, dns_id: 61270, dns_rrname: gj.symcd.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2462181, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 61270, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: gj.symcd.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: gj.symcd.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2701, dns_answers_0_rdata: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_1_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 18, dns_answers_1_rdata: e8218.dscb1.akamaiedge.net, dns_answers_2_rrname: e8218.dscb1.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 9, dns_answers_2_rdata: 23.37.43.27, dns_grouped_CNAME_0: ocsp-ds.ws.symantec.com.edgekey.net, dns_grouped_CNAME_1: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.37.43.27 ; pcap_cnt: 5148116, event_type: dns, proto: UDP, dns_type: query, dns_id: 49697, dns_rrname: image4.pubmatic.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5148550, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 49697, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: image4.pubmatic.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: image4.pubmatic.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 22, dns_answers_0_rdata: spug33000c.pubmatic.com, dns_answers_1_rrname: spug33000c.pubmatic.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 152, dns_answers_1_rdata: spug33000.pubmatic.com, dns_answers_2_rrname: spug33000.pubmatic.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 237, dns_answers_2_rdata: 162.248.16.30, dns_grouped_CNAME_0: spug33000c.pubmatic.com, dns_grouped_CNAME_1: spug33000.pubmatic.com, dns_grouped_A_0: 162.248.16.30 ; pcap_cnt: 5729314, event_type: dns, proto: UDP, dns_type: query, dns_id: 48821, dns_rrname: s3-1-w.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5729325, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48821, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: s3-1-w.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: s3-1-w.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 52.216.83.48, dns_grouped_A_0: 52.216.83.48 ; pcap_cnt: 6651554, event_type: dns, proto: UDP, dns_type: query, dns_id: 27986, dns_rrname: 249.192-26.25.128.14.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 6651555, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 27986, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 249.192-26.25.128.14.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 192-26.25.128.14.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1498, dns_authorities_0_soa_mname: localhost, dns_authorities_0_soa_rname: root.localhost, dns_authorities_0_soa_serial: 2, dns_authorities_0_soa_refresh: 604800, dns_authorities_0_soa_retry: 86400, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 604800 ; pcap_cnt: 6670840, event_type: dns, proto: UDP, dns_type: query, dns_id: 51566, dns_rrname: pool.tokyo.iponweb.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6670931, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 51566, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pool.tokyo.iponweb.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pool.tokyo.iponweb.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 119, dns_answers_0_rdata: 52.73.123.67, dns_answers_1_rrname: pool.tokyo.iponweb.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 119, dns_answers_1_rdata: 50.19.51.56, dns_answers_2_rrname: pool.tokyo.iponweb.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 119, dns_answers_2_rdata: 52.55.152.195, dns_answers_3_rrname: pool.tokyo.iponweb.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 119, dns_answers_3_rdata: 52.45.217.171, dns_answers_4_rrname: pool.tokyo.iponweb.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 119, dns_answers_4_rdata: 52.73.178.249, dns_answers_5_rrname: pool.tokyo.iponweb.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 119, dns_answers_5_rdata: 52.73.182.32, dns_grouped_A_0: 52.73.123.67, dns_grouped_A_1: 50.19.51.56, dns_grouped_A_2: 52.55.152.195, dns_grouped_A_3: 52.45.217.171, dns_grouped_A_4: 52.73.178.249, dns_grouped_A_5: 52.73.182.32 ; pcap_cnt: 7516210, event_type: dns, proto: UDP, dns_type: query, dns_id: 12786, dns_rrname: www.therams.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 7516225, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 12786, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.therams.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.therams.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 170, dns_answers_0_rdata: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrname: prod.clubs.nfl.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20896, dns_answers_1_rdata: a945.b.akamai.net, dns_answers_2_rrname: a945.b.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 72.246.56.136, dns_answers_3_rrname: a945.b.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 72.246.56.138, dns_grouped_A_0: 72.246.56.136, dns_grouped_A_1: 72.246.56.138, dns_grouped_CNAME_0: prod.clubs.nfl.com.edgesuite.net, dns_grouped_CNAME_1: a945.b.akamai.net ; pcap_cnt: 7975085, event_type: dns, proto: UDP, dns_type: query, dns_id: 63349, dns_rrname: elb-4-1133633768.ap-northeast-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7975086, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 63349, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: elb-4-1133633768.ap-northeast-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: ap-northeast-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns-1683.awsdns-18.co.uk, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 8272206, event_type: dns, proto: UDP, dns_type: query, dns_id: 54916, dns_rrname: pixel.rubiconproject.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8272326, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 54916, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: pixel.rubiconproject.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: pixel.rubiconproject.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 272, dns_answers_0_rdata: pixel.rubiconproject.net.akadns.net, dns_answers_1_rrname: pixel.rubiconproject.net.akadns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 227, dns_answers_1_rdata: 208.185.50.90, dns_answers_2_rrname: pixel.rubiconproject.net.akadns.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 227, dns_answers_2_rdata: 208.185.50.80, dns_grouped_CNAME_0: pixel.rubiconproject.net.akadns.net, dns_grouped_A_0: 208.185.50.90, dns_grouped_A_1: 208.185.50.80 ; pcap_cnt: 8540443, event_type: dns, proto: UDP, dns_type: query, dns_id: 23325, dns_rrname: cookiesyncing-1395500543.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8540746, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23325, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cookiesyncing-1395500543.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cookiesyncing-1395500543.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 12, dns_answers_0_rdata: 107.23.92.200, dns_answers_1_rrname: cookiesyncing-1395500543.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 12, dns_answers_1_rdata: 54.165.178.143, dns_answers_2_rrname: cookiesyncing-1395500543.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 12, dns_answers_2_rdata: 54.236.177.89, dns_answers_3_rrname: cookiesyncing-1395500543.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 12, dns_answers_3_rdata: 34.206.55.242, dns_answers_4_rrname: cookiesyncing-1395500543.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 12, dns_answers_4_rdata: 52.44.11.177, dns_answers_5_rrname: cookiesyncing-1395500543.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 12, dns_answers_5_rdata: 34.203.49.129, dns_answers_6_rrname: cookiesyncing-1395500543.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 12, dns_answers_6_rdata: 34.198.40.12, dns_answers_7_rrname: cookiesyncing-1395500543.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 12, dns_answers_7_rdata: 50.16.22.124, dns_grouped_A_0: 107.23.92.200, dns_grouped_A_1: 54.165.178.143, dns_grouped_A_2: 54.236.177.89, dns_grouped_A_3: 34.206.55.242, dns_grouped_A_4: 52.44.11.177, dns_grouped_A_5: 34.203.49.129, dns_grouped_A_6: 34.198.40.12, dns_grouped_A_7: 50.16.22.124 ; pcap_cnt: 8937480, event_type: dns, proto: UDP, dns_type: query, dns_id: 11610, dns_rrname: tiles-cloudfront.cdn.mozilla.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8937720, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 11610, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tiles-cloudfront.cdn.mozilla.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tiles-cloudfront.cdn.mozilla.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 90, dns_answers_0_rdata: dcky6u1m8u6el.cloudfront.net, dns_answers_1_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.84.145.142, dns_answers_2_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 52.84.145.248, dns_answers_3_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 52.84.145.17, dns_answers_4_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 52.84.145.181, dns_answers_5_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 52.84.145.172, dns_answers_6_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 52.84.145.62, dns_answers_7_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 52.84.145.155, dns_answers_8_rrname: dcky6u1m8u6el.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 59, dns_answers_8_rdata: 52.84.145.54, dns_grouped_CNAME_0: dcky6u1m8u6el.cloudfront.net, dns_grouped_A_0: 52.84.145.142, dns_grouped_A_1: 52.84.145.248, dns_grouped_A_2: 52.84.145.17, dns_grouped_A_3: 52.84.145.181, dns_grouped_A_4: 52.84.145.172, dns_grouped_A_5: 52.84.145.62, dns_grouped_A_6: 52.84.145.155, dns_grouped_A_7: 52.84.145.54 ; pcap_cnt: 9236610, event_type: dns, proto: UDP, dns_type: query, dns_id: 28325, dns_rrname: ocsp.usertrust.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9236632, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 28325, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.usertrust.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.usertrust.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 143, dns_answers_0_rdata: 2a02:1788:02fd:0000:0000:0000:b2ff:5301, dns_grouped_AAAA_0: 2a02:1788:02fd:0000:0000:0000:b2ff:5301 ; pcap_cnt: 9460937, event_type: dns, proto: UDP, dns_type: query, dns_id: 18499, dns_rrname: us.static.reallifecam.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9460941, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 18499, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: us.static.reallifecam.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: reallifecam.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 143, dns_authorities_0_soa_mname: ns1dns.name.com, dns_authorities_0_soa_rname: support.name.com, dns_authorities_0_soa_serial: 1498694400, dns_authorities_0_soa_refresh: 10800, dns_authorities_0_soa_retry: 3600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 9837625, event_type: dns, proto: UDP, dns_type: query, dns_id: 691, dns_rrname: smtp.gmail.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9837654, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 691, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: smtp.gmail.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: smtp.gmail.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: gmail-smtp-msa.l.google.com, dns_answers_1_rrname: gmail-smtp-msa.l.google.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 299, dns_answers_1_rdata: 173.194.207.108, dns_answers_2_rrname: gmail-smtp-msa.l.google.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 299, dns_answers_2_rdata: 173.194.207.109, dns_grouped_A_0: 173.194.207.108, dns_grouped_A_1: 173.194.207.109, dns_grouped_CNAME_0: gmail-smtp-msa.l.google.com ; pcap_cnt: 10339696, event_type: dns, proto: UDP, dns_type: query, dns_id: 56599, dns_rrname: ads.undertone.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10339886, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56599, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ads.undertone.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ads.undertone.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 149, dns_answers_0_rdata: ads.undertone.com.edgekey.net, dns_answers_1_rrname: ads.undertone.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 21521, dns_answers_1_rdata: e3271.c.akamaiedge.net, dns_answers_2_rrname: e3271.c.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 19, dns_answers_2_rdata: 184.30.45.183, dns_grouped_CNAME_0: ads.undertone.com.edgekey.net, dns_grouped_CNAME_1: e3271.c.akamaiedge.net, dns_grouped_A_0: 184.30.45.183 ; pcap_cnt: 10341956, event_type: dns, proto: UDP, dns_type: query, dns_id: 35913, dns_rrname: px.marchex.io, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 10341987, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 35913, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: px.marchex.io, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: px.marchex.io, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 52.86.59.85, dns_answers_1_rrname: px.marchex.io, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.72.11.222, dns_answers_2_rrname: px.marchex.io, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 34.193.128.53, dns_grouped_A_0: 52.86.59.85, dns_grouped_A_1: 52.72.11.222, dns_grouped_A_2: 34.193.128.53 ; pcap_cnt: 10642043, event_type: dns, proto: UDP, dns_type: query, dns_id: 43440, dns_rrname: 26.208.165.54.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 10642048, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 43440, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 26.208.165.54.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 26.208.165.54.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 46, dns_answers_0_rdata: ec2-54-165-208-26.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-54-165-208-26.compute-1.amazonaws.com ; pcap_cnt: 10850718, event_type: dns, proto: UDP, dns_type: query, dns_id: 22092, dns_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10850779, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22092, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-west-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 34, dns_authorities_0_soa_mname: ns-699.awsdns-23.net, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 11120915, event_type: dns, proto: UDP, dns_type: query, dns_id: 14987, dns_rrname: n.shared.global.fastly.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11121029, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14987, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: n.shared.global.fastly.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: fastly.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 29, dns_authorities_0_soa_mname: ns1.fastly.net, dns_authorities_0_soa_rname: hostmaster.fastly.com, dns_authorities_0_soa_serial: 2017052201, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 30 ; pcap_cnt: 11255716, event_type: dns, proto: UDP, dns_type: query, dns_id: 48535, dns_rrname: platform.twitter.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 11255759, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 48535, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: platform.twitter.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: platform.twitter.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 1, dns_answers_0_rdata: platform-eb.twitter.com, dns_grouped_CNAME_0: platform-eb.twitter.com, dns_authorities_0_rrname: twitter.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1, dns_authorities_0_soa_mname: ns1.p26.dynect.net, dns_authorities_0_soa_rname: zone-admin.dyndns.com, dns_authorities_0_soa_serial: 2007136030, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.