topic Re: DNS top applications? in General Topics

DNS top applications?

jharlow — Mon, 08 Jun 2015 20:09:43 GMT

I recently installed a PA-500 on our network. Currently it is in virtual mode as I start to understand how to configure the device. One of the things I have noticed is that consistently, DNS is the number 1 application. Second is web-browsing. Just in the past hour, 27.7k sessions for dns and 24.1k for web. Is this typical? We house our own DNS servers; however, they are setup to forward to external DNS servers (google, openDNS and Comcast). Just trying to figure this all out. Thanks,

Re: DNS top applications?

gwesson — Mon, 08 Jun 2015 21:19:22 GMT

This is extremely common. If you were to take a look at all the different URIs for most sites out there, there are lots of different domains. Each one may have ads, plugins from social media ("share" and "like" buttons, etc.), content distribution networks for images, etc.

Generally, DNS traffic isn't all that interesting and you can disable logging for it. I have created a rule on my firewall to allow DNS from inside to outside, and turn off logging (but still doing security profiles so I can catch botnets and other malicious stuff). I also disable logging for NTP as well, it's also noisy especially if you have a lot of servers behind your firewall.

Cheers,

Greg

Re: DNS top applications?

jharlow — Mon, 08 Jun 2015 21:31:20 GMT

Excellent. I kind of figure the actual traffic was usual just wanted to verify. Thanks for the screenshot. I created a rule based off yours to help clear those out of my logs. Much appreciated.