02-29-2024 10:34 PM
I would like to validate if the below monitored traffic on our internal firewall is service-affecting. How can we address this dropped traffic?
How can we cleanup these alerts? The same alert is shown on another FW 3430. Is it a normal behavior of firewall management IP to send DNS query?
02-29-2024 10:50 PM
You can configure DNS Sink holing to find out which actual IP Address generating this Spyware traffic, Based on that you can scan your device.
Use the below document to configure DNS Sink holing.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0
02-29-2024 10:50 PM
You can configure DNS Sink holing to find out which actual IP Address generating this Spyware traffic, Based on that you can scan your device.
Use the below document to configure DNS Sink holing.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0
02-29-2024 11:09 PM
Once we get to identify the IP address generating this spyware traffic, what will be the best approach to do next? And does it mean that this IP address is infected by a virus(spyware) or something?
03-01-2024 02:43 AM
yes, There could be a possibility, the best approach is scan the host with an Antivirus software and verify is there any specific application has infected.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
