I was viewing my firewall logs and come across the IP 8.8.8.8. Further check reveals it belongs to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From here on, how should I determine whether it's legal traffic? I do not have any SIEM product installed yet. The next best thing is to physically go to each PC affect and check? On the other hand, would using some version of a web browser cause this?
-
You mean that DNS requests to 8.8.8.8 are coming from your domain? If so, there is no issue. DNS requests are normal and 8.8.8.8 is a common server to hit.– schroeder ♦Commented Feb 25, 2015 at 1:00
-
Hi schroeder, no. the source ip is from internal PCs/desktops. The destination IP is 8.8.8.8. thanks– dorothyCommented Feb 25, 2015 at 3:37
-
1That's exactly what I mean. This is perfectly normal behavior. It's normal DNS request traffic.– schroeder ♦Commented Feb 25, 2015 at 3:53
-
The DNS for all our PCs/desktops are configured to be an internal DNS server 10.x.x.x. Why would 8.8.8.8 be used? thanks– dorothyCommented Feb 25, 2015 at 9:38
-
Is your internal DNS server configured to make requests of 8.8.8.8?– schroeder ♦Commented Feb 25, 2015 at 19:32
|
Show 2 more comments
2 Answers
Most likely either another administrator or some of your users have set their computers to use Google's DNS service (located at IP addresses 8.8.8.8 and 8.8.4.4). It's probably nothing to worry about. If your firewall has packet capture capabilities, you can try running a capture and then opening the capture file in Wireshark to inspect the traffic and make sure it's actually DNS and that the queries are not for malware domains. If none of your firewalls/routers can do packet captures it may be easiest to physically go to the computers and look at the DNS settings or ask your users if they've changed them.
You can choose whatever DNS provider you want on your computer if you are granted administrative rights on it.
The only purpose of the DNS request is to get the IP of a fully qualified domain name (FQDN), that is to say translate www.google.fr to some IP address.
If you manage a network of machines, you might want to :
- completely block DNS request on unauthorised server (e.g. if you are hosting your own DNS server)
- check if the traffic to DNS server are really DNS requests, as they do have a common format
- be sure to provide a DNS entry in your DHCP answers so that client using automatic IP configuration will receive the address of an authorised DNS server.
