Z3C and suspicious .null dns query

[tonyavk]

Hello wise community!

I have really weird acting z3c in office. Its connected to Meraki MX100 with IDS and I see this suspicious .null dns query 

almost every day even in times when no one uses Z3 

Second weird thing about it that this two requests on a picture above looks like the same request but it blocked from Z3C but allowed from MX100 like it passes through.  

Any ideas what might cause this ? 

[Mloraditch]

Are you saying you have a Z3 behind an MX100 and of the two entries above one is sourced from the Z3 and blocked and one is from an end client and allowed?

It's possible the one is being blocked because its going to an internal server vs the internet.  Support may be able to give more insight into how the rule in question operates.

The public documentation on the rule is not super detailed: https://www.snort.org/rule_docs/1-48666

[tonyavk]

Well I suspect that this is the same request -- same moment and MX100 by itself never generates this suspicious requests. I mostly curious why z3 act like this rather then why rule are not working properly 

[Mloraditch]

If the MX100 itself generated such a request you would may not see it in the logs. I'm not sure of exactly how the inline scanning works, but I suspect it doesn't look at Control Plane traffic.

Only support could definitively answer why the Z3 is generating such a request (and if it's actually the Z3)

[alemabrahao]

I suggest you open a support case, they will do a more detailed investigation.

[PhilipDAth]

What is 10.99.99.254?

If it is a DNS relay/server (such as a Z4 or MX), then the true client is hidden.  You could get a clearer result if you changes the clients to use an external DNS like 8.8.8.8 instead and not use the DNS server.

[tonyavk]

this is MX100. Thanks for suggestion! 

[RaphaelL]

So you must be running IPS and not IDS right ? Cause IDS won't block

[tonyavk]