0

we have one computer in ours network that constantly send to 8.8.8.8 dns requests. I see this in Fortigate forward traffic log and the user of that computer have to solve reCAPTCHA a few times in hour when he use google search. This computer is a notebook with two network card, one is usually connected to ethernet LAN (fortigate) and wi-fi network card is usually connected in the same time to guest network from other SOHO router (with is send through DHCP 8.8.8.8 as main DNS).

My question is how to find with app/process on that computer send this unusually DNS request to 8.8.8.8?

EDIT:

So I do some checks. The case is definitely related with enabled and connected wi-fi network card. When I change SOHO router DHCP configuration to send different DNS configuration (not 8.8.8.8 but DNS server of my local internet service provider) in Fortigate forward trafic log there are now entries with source of ethernet IP address(and MAC) and destination to DNS server of my local internet service provider.

It is look like some process/app take DNS configuration from wi-fi and send request through ethernet.

Sysmon doesn' t show any unusually dns query. Any ideas?

0

If the app/process is constantly running you could use the following:

netstat -tapvln | grep 8.8.8.8

It will need to be run as root because the -p flag means show the process ID.

If its not constantly running, you could put the watch command before it and monitor until you find the culprit.

watch netstat -tapvln | grep 8.8.8.8
0

Microsoft Sysmon has DNS logging.

https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

It can be enabled using a configuration file.

Sysmon.xml:

<Sysmon schemaversion="4.21">
 <EventFiltering>
  <DnsQuery onmatch="exclude" />
 </EventFiltering>
</Sysmon>

To install:

sysmon.exe -accepteula -i sysmon.xml

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.