1

I was viewing my firewall logs and come across the IP 8.8.8.8. Further check reveals it belongs to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From here on, how should I determine whether it's legal traffic? I do not have any SIEM product installed yet. The next best thing is to physically go to each PC affect and check? On the other hand, would using some version of a web browser cause this?

  • You mean that DNS requests to 8.8.8.8 are coming from your domain? If so, there is no issue. DNS requests are normal and 8.8.8.8 is a common server to hit. – schroeder Feb 25 '15 at 1:00
  • Hi schroeder, no. the source ip is from internal PCs/desktops. The destination IP is 8.8.8.8. thanks – dorothy Feb 25 '15 at 3:37
  • 1
    That's exactly what I mean. This is perfectly normal behavior. It's normal DNS request traffic. – schroeder Feb 25 '15 at 3:53
  • The DNS for all our PCs/desktops are configured to be an internal DNS server 10.x.x.x. Why would 8.8.8.8 be used? thanks – dorothy Feb 25 '15 at 9:38
  • Is your internal DNS server configured to make requests of 8.8.8.8? – schroeder Feb 25 '15 at 19:32
5

Most likely either another administrator or some of your users have set their computers to use Google's DNS service (located at IP addresses 8.8.8.8 and 8.8.4.4). It's probably nothing to worry about. If your firewall has packet capture capabilities, you can try running a capture and then opening the capture file in Wireshark to inspect the traffic and make sure it's actually DNS and that the queries are not for malware domains. If none of your firewalls/routers can do packet captures it may be easiest to physically go to the computers and look at the DNS settings or ask your users if they've changed them.

1

You can choose whatever DNS provider you want on your computer if you are granted administrative rights on it.

The only purpose of the DNS request is to get the IP of a fully qualified domain name (FQDN), that is to say translate www.google.fr to some IP address.

If you manage a network of machines, you might want to :

  • completely block DNS request on unauthorised server (e.g. if you are hosting your own DNS server)
  • check if the traffic to DNS server are really DNS requests, as they do have a common format
  • be sure to provide a DNS entry in your DHCP answers so that client using automatic IP configuration will receive the address of an authorised DNS server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.