topic How to know the process in a Firewall that generate Traffic in General Topics

How to know the process in a Firewall that generate Traffic

Oscarresendiz — Fri, 25 Aug 2023 17:01:55 GMT

I have seen unusual traffic in the Firewall.

A lot of sessions are generated from an interface (inside) to the IP Address 5.5.5.5 to the outside interface.

I would like to know what process or the reason to the Firewall generated this traffic.

I check the NAT Route and I don't have to configure something like that.

I am a little bit worried, I don't know if it is possible to a malware or something like that.

Re: How to know the process in a Firewall that generate Traffic

JayGolf — Fri, 25 Aug 2023 19:31:15 GMT

Hi @Oscarresendiz ,

It looks like the 5.5.5.5 address is registered in Germany by using public IP address lookups. I would review which security policy is allowing that connection out, review which port/protocol it is using, when the traffic started, and as well as which internal source IP address is reaching out to 5.5.5.5.

Re: How to know the process in a Firewall that generate Traffic

Remo — Sun, 27 Aug 2023 06:36:49 GMT

Hi @Oscarresendiz

Behind this IP it does not look like that there is very much useful things behind it. At least when you check virustotal for it ( https://www.virustotal.com/gui/ip-address/5.5.5.5/relations ).

In addition to the things to check mentionned by @JayGolf, which application do you see in the logs and are there bytes received?

Re: How to know the process in a Firewall that generate Traffic

CesarSanchez — Tue, 29 Aug 2023 02:16:09 GMT

If you have DNS security you can enable sinkhold to verify if your host is requesting connect to a bad server.

Can you share the traffic and threat logs?