I was viewing my firewall logs and come across the IP Further check reveals it belongs to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From here on, how should I determine whether it's legal traffic? I do not have any SIEM product installed yet. The next best thing is to physically go to each PC affect and check? On the other hand, would using some version of a web browser cause this?

  • You mean that DNS requests to are coming from your domain? If so, there is no issue. DNS requests are normal and is a common server to hit.
    – schroeder
    Feb 25, 2015 at 1:00
  • Hi schroeder, no. the source ip is from internal PCs/desktops. The destination IP is thanks
    – dorothy
    Feb 25, 2015 at 3:37
  • 1
    That's exactly what I mean. This is perfectly normal behavior. It's normal DNS request traffic.
    – schroeder
    Feb 25, 2015 at 3:53
  • The DNS for all our PCs/desktops are configured to be an internal DNS server 10.x.x.x. Why would be used? thanks
    – dorothy
    Feb 25, 2015 at 9:38
  • Is your internal DNS server configured to make requests of
    – schroeder
    Feb 25, 2015 at 19:32

2 Answers 2


Most likely either another administrator or some of your users have set their computers to use Google's DNS service (located at IP addresses and It's probably nothing to worry about. If your firewall has packet capture capabilities, you can try running a capture and then opening the capture file in Wireshark to inspect the traffic and make sure it's actually DNS and that the queries are not for malware domains. If none of your firewalls/routers can do packet captures it may be easiest to physically go to the computers and look at the DNS settings or ask your users if they've changed them.


You can choose whatever DNS provider you want on your computer if you are granted administrative rights on it.

The only purpose of the DNS request is to get the IP of a fully qualified domain name (FQDN), that is to say translate www.google.fr to some IP address.

If you manage a network of machines, you might want to :

  • completely block DNS request on unauthorised server (e.g. if you are hosting your own DNS server)
  • check if the traffic to DNS server are really DNS requests, as they do have a common format
  • be sure to provide a DNS entry in your DHCP answers so that client using automatic IP configuration will receive the address of an authorised DNS server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .