My firewall identifies an unusual amount of traffic to 22.214.171.124 from host 192.168.76.22 (a Mac OS X Server). Within that server, the network connections are defined with a primary DNS pointing to my ISP's DNS server and the secondary address pointing to the Google Public DNS at 126.96.36.199. None of the settings in this system have been set to use 188.8.131.52.
Another post at Forensics - trace back DNS query origin on host? suggests that I might have to change the resolver in order to find the guilty processes.
I have checked a similar question for assistance, but found no useful answers there as to checking the source. I have run netstat and not identified any communication to 184.108.40.206 listed on the output.
I am wondering:
1) If there is a system log that would allow me to identify the necessary information
2) If there is an easier method than replacing the system's DNS resolver
3) How to replace the resolver (if this is absolutely necessary)
OS: Mac OS X 10.10.5
Server Application Version: 5.0.3
Firewall: Watchguard XTM 505