How to know the process in a Firewall that generate Traffic

[Oscarresendiz]

I have seen unusual traffic in the Firewall.

A lot of sessions are generated from an interface (inside) to the IP Address 5.5.5.5 to the outside interface.

I would like to know what process or the reason to the Firewall generated this traffic.

I check the NAT Route and I don't have to configure something like that.

I am a little bit worried, I don't know if it is possible to a malware or something like that.

[JayGolf]

Hi @Oscarresendiz ,

It looks like the 5.5.5.5 address is registered in Germany by using public IP address lookups. I would review which security policy is allowing that connection out, review which port/protocol it is using, when the traffic started, and as well as which internal source IP address is reaching out to 5.5.5.5. 

[Remo]

Hi @Oscarresendiz 

Behind this IP it does not look like that there is very much useful things behind it. At least when you check virustotal for it ( https://www.virustotal.com/gui/ip-address/5.5.5.5/relations ).

In addition to the things to check mentionned by @JayGolf, which application do you see in the logs and are there bytes received? 

[CesarSanchez]

If you have DNS security you can enable sinkhold to verify if your host is requesting connect to a bad server. 

Can you share the traffic and threat logs?