['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.3, src_port: 60384, dest_ip: 192.168.10.1, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 100, flow_bytes_toclient: 185, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 131, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 157, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 192, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 95, flow_bytes_toclient: 148, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 98, flow_bytes_toclient: 156, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 3, flow_pkts_toclient: 3, flow_bytes_toserver: 262, flow_bytes_toclient: 439, flow_age: 97, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 194, flow_bytes_toclient: 263, flow_age: 153, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 126, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 186, flow_bytes_toclient: 274, flow_age: 29, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 99, flow_bytes_toclient: 223, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 93, flow_bytes_toclient: 161, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 102, flow_bytes_toclient: 118, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 102, flow_bytes_toclient: 118, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 94, flow_bytes_toclient: 179, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 161, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 90, flow_bytes_toclient: 229, flow_age: 1, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 116, flow_bytes_toclient: 244, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 108, flow_bytes_toclient: 140, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 97, flow_bytes_toclient: 139, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 1, flow_pkts_toclient: 1, flow_bytes_toserver: 88, flow_bytes_toclient: 183, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 27685, event_type: dns, proto: UDP, dns_type: query, dns_id: 23547, dns_rrname: d22bbwxztp2lry.cloudfront.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 27688, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 23547, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d22bbwxztp2lry.cloudfront.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: d22bbwxztp2lry.cloudfront.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 3, dns_authorities_0_soa_mname: ns-1484.awsdns-57.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 2390468, event_type: dns, proto: UDP, dns_type: query, dns_id: 20617, dns_rrname: 121.39.40.192.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 2390683, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 20617, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 121.39.40.192.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 121.39.40.192.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 7199, dns_answers_0_rdata: a159.casalemedia.com, dns_grouped_PTR_0: a159.casalemedia.com ; pcap_cnt: 4012755, event_type: dns, proto: UDP, dns_type: query, dns_id: 21404, dns_rrname: 59.139.86.185.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 4012916, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21404, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 59.139.86.185.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 185.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 2398, dns_authorities_0_soa_mname: pri.authdns.ripe.net, dns_authorities_0_soa_rname: dns.ripe.net, dns_authorities_0_soa_serial: 1499169751, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 864000, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 5608207, event_type: dns, proto: UDP, dns_type: query, dns_id: 4188, dns_rrname: casale-cm.p.veruta.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5608371, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 4188, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: casale-cm.p.veruta.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: casale-cm.p.veruta.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 3599, dns_answers_0_rdata: rtb.p.veruta.com, dns_answers_1_rrname: rtb.p.veruta.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 10799, dns_answers_1_rdata: rtb-geo.p2.veruta.com, dns_answers_2_rrname: rtb-geo.p2.veruta.com, dns_answers_2_rrtype: CNAME, dns_answers_2_ttl: 3599, dns_answers_2_rdata: rtb-east1.p.veruta.com, dns_answers_3_rrname: rtb-east1.p.veruta.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 34, dns_answers_3_rdata: 70.42.146.149, dns_answers_4_rrname: rtb-east1.p.veruta.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 34, dns_answers_4_rdata: 70.42.146.148, dns_grouped_A_0: 70.42.146.149, dns_grouped_A_1: 70.42.146.148, dns_grouped_CNAME_0: rtb.p.veruta.com, dns_grouped_CNAME_1: rtb-geo.p2.veruta.com, dns_grouped_CNAME_2: rtb-east1.p.veruta.com ; pcap_cnt: 6244224, event_type: dns, proto: UDP, dns_type: query, dns_id: 39614, dns_rrname: 84.250.5.52.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 6244497, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 39614, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 84.250.5.52.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 84.250.5.52.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 64, dns_answers_0_rdata: ec2-52-5-250-84.compute-1.amazonaws.com, dns_grouped_PTR_0: ec2-52-5-250-84.compute-1.amazonaws.com ; pcap_cnt: 6543692, event_type: dns, proto: UDP, dns_type: query, dns_id: 56501, dns_rrname: 148.15.173.202.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 6543756, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56501, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 148.15.173.202.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 15.173.202.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 599, dns_authorities_0_soa_mname: ns0.knet.cn, dns_authorities_0_soa_rname: sunguonian.knet.cn, dns_authorities_0_soa_serial: 2016092000, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 2419200, dns_authorities_0_soa_minimum: 600 ; pcap_cnt: 6617385, event_type: dns, proto: UDP, dns_type: query, dns_id: 14574, dns_rrname: partnerad.l.doubleclick.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 6617387, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 14574, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: partnerad.l.doubleclick.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: l.doubleclick.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 476, dns_authorities_0_soa_mname: ns3.google.com, dns_authorities_0_soa_rname: dns-admin.google.com, dns_authorities_0_soa_serial: 160865928, dns_authorities_0_soa_refresh: 900, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 6651615, event_type: dns, proto: UDP, dns_type: query, dns_id: 6545, dns_rrname: js.fout.jp, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6651649, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6545, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: js.fout.jp, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: js.fout.jp, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 255, dns_answers_0_rdata: js.fout.jp.edgekey.net, dns_answers_1_rrname: js.fout.jp.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 20019, dns_answers_1_rdata: e5850.g.akamaiedge.net, dns_answers_2_rrname: e5850.g.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 18, dns_answers_2_rdata: 104.88.109.36, dns_grouped_CNAME_0: js.fout.jp.edgekey.net, dns_grouped_CNAME_1: e5850.g.akamaiedge.net, dns_grouped_A_0: 104.88.109.36 ; pcap_cnt: 6652347, event_type: dns, proto: UDP, dns_type: query, dns_id: 3842, dns_rrname: dnd.d2cdm.jp, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 6652462, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 3842, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: dnd.d2cdm.jp, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: dnd.d2cdm.jp, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 13.113.197.64, dns_answers_1_rrname: dnd.d2cdm.jp, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 52.68.75.183, dns_grouped_A_0: 13.113.197.64, dns_grouped_A_1: 52.68.75.183 ; pcap_cnt: 6892971, event_type: dns, proto: UDP, dns_type: query, dns_id: 65224, dns_rrname: stun.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6893026, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 65224, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: stun.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: stun.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 173.194.207.127, dns_grouped_A_0: 173.194.207.127 ; pcap_cnt: 6919243, event_type: dns, proto: UDP, dns_type: query, dns_id: 47101, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6919594, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47101, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp-ds.ws.symantec.com.edgekey.net, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 6, dns_answers_0_rdata: e8218.dscb1.akamaiedge.net, dns_answers_1_rrname: e8218.dscb1.akamaiedge.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 19, dns_answers_1_rdata: 23.50.75.27, dns_grouped_CNAME_0: e8218.dscb1.akamaiedge.net, dns_grouped_A_0: 23.50.75.27 ; pcap_cnt: 7509349, event_type: dns, proto: UDP, dns_type: query, dns_id: 13234, dns_rrname: 23.194.116.50.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 7509366, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 13234, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 23.194.116.50.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 23.194.116.50.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 1, dns_answers_0_rdata: d-atl1.turn.com, dns_grouped_PTR_0: d-atl1.turn.com ; pcap_cnt: 7727140, event_type: dns, proto: UDP, dns_type: query, dns_id: 33620, dns_rrname: ocsp.comodoca.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7727156, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 33620, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ocsp.comodoca.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: ocsp.comodoca.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 140, dns_answers_0_rdata: 2a02:1788:02fd:0000:0000:0000:b2ff:5301, dns_grouped_AAAA_0: 2a02:1788:02fd:0000:0000:0000:b2ff:5301 ; pcap_cnt: 7743149, event_type: dns, proto: UDP, dns_type: query, dns_id: 60853, dns_rrname: 156.149.42.188.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 2 ; pcap_cnt: 7743163, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 60853, dns_flags: 8183, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 156.149.42.188.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NXDOMAIN, dns_authorities_0_rrname: 188.in-addr.arpa, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1768, dns_authorities_0_soa_mname: pri.authdns.ripe.net, dns_authorities_0_soa_rname: dns.ripe.net, dns_authorities_0_soa_serial: 1499122278, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 864000, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 7978372, event_type: dns, proto: UDP, dns_type: query, dns_id: 59422, dns_rrname: blocklist.addons.mozilla.org, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 7978374, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 59422, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: blocklist.addons.mozilla.org, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: blocklist.addons.mozilla.org, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 33, dns_answers_0_rdata: versioncheck.prod.mozaws.net, dns_grouped_CNAME_0: versioncheck.prod.mozaws.net, dns_authorities_0_rrname: prod.mozaws.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 71, dns_authorities_0_soa_mname: ns-1260.awsdns-29.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8105735, event_type: dns, proto: UDP, dns_type: query, dns_id: 25079, dns_rrname: m2.wettercomassets.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8105845, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25079, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: m2.wettercomassets.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: wettercomassets.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 1799, dns_authorities_0_soa_mname: cns1.alfahosting.info, dns_authorities_0_soa_rname: dns.wetter.com, dns_authorities_0_soa_serial: 2017050522, dns_authorities_0_soa_refresh: 28800, dns_authorities_0_soa_retry: 7200, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 3600 ; pcap_cnt: 8208512, event_type: dns, proto: UDP, dns_type: query, dns_id: 15626, dns_rrname: BN3SCH020010559.wns.windows.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8208514, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15626, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: BN3SCH020010559.wns.windows.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: BN3SCH020010559.wns.windows.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 3058, dns_answers_0_rdata: 131.253.34.246, dns_grouped_A_0: 131.253.34.246 ; pcap_cnt: 8313506, event_type: dns, proto: UDP, dns_type: query, dns_id: 39458, dns_rrname: safebrowsing.cache.l.google.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 8313507, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 39458, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: safebrowsing.cache.l.google.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: safebrowsing.cache.l.google.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 299, dns_answers_0_rdata: 172.217.6.206, dns_grouped_A_0: 172.217.6.206 ; pcap_cnt: 8450698, event_type: dns, proto: UDP, dns_type: query, dns_id: 58003, dns_rrname: olympia.prod.mozaws.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8450699, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 58003, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: olympia.prod.mozaws.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: prod.mozaws.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 15, dns_authorities_0_soa_mname: ns-1260.awsdns-29.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 86400 ; pcap_cnt: 8568217, event_type: dns, proto: UDP, dns_type: query, dns_id: 34112, dns_rrname: ckm-m.xp1.ru4.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 8568322, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 34112, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ckm-m.xp1.ru4.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: xp1.ru4.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 59, dns_authorities_0_soa_mname: ns1.p20.dynect.net, dns_authorities_0_soa_rname: hostmaster.gtm1001.ru4.com, dns_authorities_0_soa_serial: 2017070418, dns_authorities_0_soa_refresh: 3600, dns_authorities_0_soa_retry: 600, dns_authorities_0_soa_expire: 604800, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 10066623, event_type: dns, proto: UDP, dns_type: query, dns_id: 62535, dns_rrname: epiv.cardlytics.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 10066710, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 62535, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: epiv.cardlytics.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: epiv.cardlytics.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 58, dns_answers_0_rdata: eastepiv-713184650.us-east-1.elb.amazonaws.com, dns_grouped_CNAME_0: eastepiv-713184650.us-east-1.elb.amazonaws.com, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 7, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 10350364, event_type: dns, proto: UDP, dns_type: query, dns_id: 56425, dns_rrname: prodlb03-58312814.eu-west-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10350383, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 56425, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: prodlb03-58312814.eu-west-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: prodlb03-58312814.eu-west-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 59, dns_answers_0_rdata: 176.34.231.11, dns_answers_1_rrname: prodlb03-58312814.eu-west-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 59, dns_answers_1_rdata: 54.247.94.134, dns_answers_2_rrname: prodlb03-58312814.eu-west-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 59, dns_answers_2_rdata: 176.34.108.120, dns_answers_3_rrname: prodlb03-58312814.eu-west-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 59, dns_answers_3_rdata: 46.137.115.159, dns_answers_4_rrname: prodlb03-58312814.eu-west-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 59, dns_answers_4_rdata: 46.137.164.87, dns_answers_5_rrname: prodlb03-58312814.eu-west-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 59, dns_answers_5_rdata: 46.137.179.240, dns_answers_6_rrname: prodlb03-58312814.eu-west-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 59, dns_answers_6_rdata: 46.137.93.21, dns_answers_7_rrname: prodlb03-58312814.eu-west-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 59, dns_answers_7_rdata: 176.34.111.21, dns_grouped_A_0: 176.34.231.11, dns_grouped_A_1: 54.247.94.134, dns_grouped_A_2: 176.34.108.120, dns_grouped_A_3: 46.137.115.159, dns_grouped_A_4: 46.137.164.87, dns_grouped_A_5: 46.137.179.240, dns_grouped_A_6: 46.137.93.21, dns_grouped_A_7: 176.34.111.21 ; pcap_cnt: 10719224, event_type: dns, proto: UDP, dns_type: query, dns_id: 25074, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 10719250, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 25074, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 72.30.3.43, dns_answers_1_rrname: fo-fd-world-new.yax.gysm.yahoodns.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 1, dns_answers_1_rdata: 98.139.225.43, dns_grouped_A_0: 72.30.3.43, dns_grouped_A_1: 98.139.225.43 ; pcap_cnt: 10815652, event_type: dns, proto: UDP, dns_type: query, dns_id: 22051, dns_rrname: 147.75.27.198.in-addr.arpa, dns_rrtype: PTR, dns_tx_id: 0 ; pcap_cnt: 10815655, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 22051, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: 147.75.27.198.in-addr.arpa, dns_rrtype: PTR, dns_rcode: NOERROR, dns_answers_0_rrname: 147.75.27.198.in-addr.arpa, dns_answers_0_rrtype: PTR, dns_answers_0_ttl: 66886, dns_answers_0_rdata: ads4-us-east.stickyadstv.com, dns_grouped_PTR_0: ads4-us-east.stickyadstv.com ; pcap_cnt: 11205142, event_type: dns, proto: UDP, dns_type: query, dns_id: 26853, dns_rrname: i.s-microsoft.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 11205148, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 26853, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: i.s-microsoft.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: i.s-microsoft.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 2722, dns_answers_0_rdata: i.s-microsoft.com.edgekey.net, dns_answers_1_rrname: i.s-microsoft.com.edgekey.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 16547, dns_answers_1_rdata: e1863.dscg.akamaiedge.net, dns_answers_2_rrname: e1863.dscg.akamaiedge.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 11, dns_answers_2_rdata: 23.194.140.100, dns_grouped_CNAME_0: i.s-microsoft.com.edgekey.net, dns_grouped_CNAME_1: e1863.dscg.akamaiedge.net, dns_grouped_A_0: 23.194.140.100
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.