Outbound and DNS threats
How InfraFence sees what leaves the server - connections to listed addresses, DNS queries tied to the program that made them, DNS tunnels, DGA lookups and suspicious resolvers.
Last updated:
Most tools watch what comes in. A compromised server shows itself in what goes out: a connection to a botnet controller, data leaking through DNS, malware looking for its next domain.
Threat-intelligence lists
Each server downloads public lists once a day, straight from their publishers:
- the Spamhaus DROP lists (IPv4 and IPv6), networks hijacked or run by criminals;
- the Emerging Threats list of compromised hosts.
The dashboard can add more entries. All of them are used to recognize bad destinations; blocking them is a separate choice (below).
Outbound connections
Every 60 seconds the agent looks at the server's established IPv4 TCP connections to public addresses. A connection to a listed address is reported as a critical egress_threat_match event with the address, the ports and the list it is on. The same address is reported again after 30 minutes at the earliest.
These events say which address the server talked to, not which program: process attribution is available for DNS queries only.
DNS inspection
With Inspect DNS traffic on (the default), the agent reads the server's own DNS queries and answers at packet level: UDP port 53 only, read-only, with a filter that runs in the kernel, up to 3,000 packets a second. Queries that a DNS server on the host answers for other machines are ignored.
Each DNS event names the program that asked: the application that queried the local resolver (such as systemd-resolved) for that name, or the owner of the socket that sent the query.
| Event | Severity | When |
|---|---|---|
dns_threat_resolver |
critical | A query goes to a DNS server on a threat list. |
dns_threat_answer |
warning | A domain resolves to a listed address. |
dns_tunneling |
warning | 60 or more distinct long subdomains of one domain within 5 minutes, or TXT and NULL query patterns typical of tunnels. |
dns_dga |
warning | 20 or more random-looking domains that do not exist within 5 minutes, the mark of malware generating domains (DGA). |
dns_unlisted_resolver |
info | A program uses a DNS server other than the configured ones. |
The configured resolvers come from /etc/resolv.conf, systemd-resolved and NetworkManager. The same finding is reported once every 30 minutes at most.
What is not reported
- The server's own DNS service (systemd-resolved, dnsmasq, unbound, BIND, PowerDNS Recursor, CoreDNS, Pi-hole, AdGuard Home, Docker's resolver and similar), when it runs from a system path.
- Antivirus hash lookups and anti-spam or reputation lookups (Sophos, McAfee, Trend Micro, ESET, Kaspersky, Spamhaus, SURBL, URIBL, SpamCop and others), and large CDNs and clouds, which look like tunnels but are not.
Blocking
- Inbound: Block traffic from threat-intelligence lists (off by default) drops traffic from the listed networks, through the ipset
infrafence-threat. It needsipset, never applies in monitor mode, and skips entries broader than a /8 or covering your whitelist, private addresses or the dashboard. - Outbound: a destination can be blocked from the dashboard, or by AutoMode: see Ports and egress blocking.