I was viewing my firewall logs and come across the IP 220.127.116.11. Further check reveals it belongs to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From here on, how should I determine whether it's legal traffic? I do not have any SIEM product installed yet. The next best thing is to physically go to each PC affect and check? On the other hand, would using some version of a web browser cause this?
Most likely either another administrator or some of your users have set their computers to use Google's DNS service (located at IP addresses 18.104.22.168 and 22.214.171.124). It's probably nothing to worry about. If your firewall has packet capture capabilities, you can try running a capture and then opening the capture file in Wireshark to inspect the traffic and make sure it's actually DNS and that the queries are not for malware domains. If none of your firewalls/routers can do packet captures it may be easiest to physically go to the computers and look at the DNS settings or ask your users if they've changed them.
You can choose whatever DNS provider you want on your computer if you are granted administrative rights on it.
The only purpose of the DNS request is to get the IP of a fully qualified domain name (FQDN), that is to say translate www.google.fr to some IP address.
If you manage a network of machines, you might want to :
- completely block DNS request on unauthorised server (e.g. if you are hosting your own DNS server)
- check if the traffic to DNS server are really DNS requests, as they do have a common format
- be sure to provide a DNS entry in your DHCP answers so that client using automatic IP configuration will receive the address of an authorised DNS server.