unknown Source Consuming bandwidth

[Dyop_Geop]

May I ask, what could be this “viewpaulbusinezs.no-ip.org (0.0.0.0)” mentioned in the screenshot below? In the screenshot also is the configuration of the widget for your reference. How can I trace what is this or who is this?

[Dave_Hall]

What shows up if you do not resolve hostnames? Are you able to click on the entry to for detailed info? (Most logs allow you to drill down into sessions).

[FatalHalt]

No-ip is a dynamic DNS provider. The fortigate might be tripping over itself trying to resolve this properly. Like Dave mentioned, try to see if the IP is present when you turn off DNS resolution.

[netmin]

To me it looks like you have (serious?) DNS issues. If this is your private network, the name is resolved by reverse lookup to the defined DNS server. Wouldn' t this mean the defined (your?) DNS server thinks a host in range 172.[16-31].x.y is the displayed no-ip host? Forward lookup returns indeed 0.0.0.0 when using a public DNS.

[netmin]

...and I know that this is not something any admin ever wants to hear, so please don' t beat me for this: Taking your previous post into account: have you checked that this DNS server is still working safe and secured under your control?

[Dyop_Geop]

Hi Sir Dave, thanks for the reply. I can' t click the entry. Right now, viewpaulbussinezs is gone. Only 0.0.0.0 is showing. (please see attached) Sorry I' m not familiar on how to check in the fortigate if there are unresolved hostnames. How do I do this?

[Dyop_Geop]

Hi netmin, thanks too for replying. the other DNS issue I posted is a different case.

[Dyop_Geop]

If I right click the entry, and select View Matching Sessions. This is what i get. (I dunno if this can help)

[emnoc]

If you can find the policy-id# than you can confirm from the cli, diag sys session filter policy 1 diag sys session list

[Istvan_Takacs_FTNT]

I' d suggest to read the following article first; Microsoft Seized No-IP Domains, Millions of Dynamic DNS Service Users Suffer Outage http://thehackernews.com/2014/06/microsoft-seized-no-ip-domains-millions.html Than run update virus/malware scanner on your LAN hosts. BTW, 0.0.0.0 means that the host has no published record: $ dig +short @nf1.no-ip.com viewpaulbussinezs.no-ip.org 0.0.0.0