2

I just started working for a small business and run their server. The entire thing is on macOS, and I've been monitoring my network lately due to some weird things in a few log files.

I've come across something called named which makes connections both UDP and TCP all across the world. From what I've gathered, the named service has something to do with my DNS, however, that doesn't make much sense because I don't have anybody working overseas, or trying to connect from different countries.

enter image description here

My question to all of you would be, is this a reason for me to be alarmed?

  • 4
    named is really just bind for mac as far as I know. And the way the DNS protocol works, I can think of a few reasons why it would connect out (replicating/renewal of dns records to name one, these records will be requested from the Authoritative DNS servers). Best would be to check the individual Remote IP's to verify if these are actual DNS servers if you're really suspicious. – Nomad Apr 6 '18 at 16:35
  • 1
    It is for DNS. Don't make strong statements on systems you havens understood! – Marcus Müller Apr 6 '18 at 16:53
  • 1
    "I don't think that's normal" – Marcus Müller Apr 6 '18 at 16:59
  • 1
    @Nomad awh, the caching is what got me thinking. I refreshed my cache yesterday because it was overflowing with useless stuff. I've been taking your advice and checking the individual IP addresses. It seems about 99% of them run to a DNS server there's still a few that are weird but I can figure those out. I appreciate your help! – CertifcateJunky Apr 6 '18 at 17:09
  • 1
    Np, that's what stackexchange is for! I've thrown it all in an answer for others to find if they have the same question :-) – Nomad Apr 6 '18 at 17:29
4

named - MacOS

named can be considered to be the bind service for Mac, which all comes down to being a DNS server.

DNS

A DNS server makes requests to other DNS servers on the internet if it needs to turn a domain name into an IP address, and it doesn't know about that domain name.

A solution to this is caching, which stores addresses and hostnames, so your server doesn't have to make all requests at the corresponding servers.

Connections

This means that for every domain that has to be resolved, and isn't known to the cache, a connection (TCP) will be made, or a packet will be sent and received (UDP) by another server.

Visiting a single website with all the JS frameworks and possibly (but rarely) externally hosted images, can result in multiple DNS requests.

There are a lot of programs that have to connect to a server for licensing issues, feeds, ... which also have name resolution.

Some software is known to use getHostByName() as a connection test to big sites, or their own DNS servers, because it will check internet connection and UDP is a super fast. (For Example: Huawei's EMUI(Android) makes a DNS Request to Baidu when booting)

But it's not all good

Before panicking, consider what I wrote above, and verify your configurations to see that connections are legit. You could also use whois to check if the connections are actually towards and from legitimate DNS servers.

If they're not all good, or you keep getting high traffic outside office hours etc, consider the fact that misconfiguration of DNS servers and firewall rules can lead to UDP flood attacks and the like.

Another totally paranoid thing to consider after all above failed is that someone activated malware on your system that hides as the named service, but that is completely out of consideration before being absolutely certain about firewall and configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.