'ipconfig /displaydns' display over 200 DNS unrecognized, should we worry

jana
jana used Ask the Experts™
on
We are having a problem with a connection and came upon recommended task where we were instructed to run the line "ipconfig /displaydns".   This displayed a series of sites unrecognized to us.

The result showed over 200 DNS and with the list actual sites and IPs.  The sites are in line "Record Name . . . . . :" and "CNAME Record  . . . . : ", the IPs are in line "A (Host) Record . . . :".

For example:
    in.greta.io
    ----------------------------------------
    Record Name . . . . . : in.greta.io
    Record Type . . . . . : 1
    Time To Live  . . . . : 41482
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 35.186.212.13

Open in new window


and 
    p2-eiiarhhxducde-vnxdzw56kwg3gh6t-299593-i1.stbcast3-stb.metric.gstatic.com
    ----------------------------------------
    Record Name . . . . . : p2-eiiarhhxducde-vnxdzw56kwg3gh6t-299593-i1.stbcast3-stb.metric.gstatic.com
    Record Type . . . . . : 1
    Time To Live  . . . . : 79151
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 216.239.32.62

Open in new window


So we wanted to know,
  • what is causing this?
  • should we worry?
  • what should we do?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
View Solutions Only
Jeremy WeisingerSenior Network Consultant / Engineer
Commented:
Well all this is revealing what the websites are pulling from in the background. Web pages apps, and Windows are all making calls to different resources over the Internet. The DNS lookups are all cached on your computer.

As an example, this Experts Exchange page here is pulling from the following domains when looking at the stats in my browser:
www.experts-exchange.com
cdn.experts-exchange.com
expertsexchange.112.2o7.net
filedb.experts-exchange.com

And I'm using uBlock Origin so this is going to be greatly reduced.
KimputerIT Manager
Commented:
Even during the most simple browsing session, your browser fires away countless of cloud based services (be it Google, ad services or content delivery networks). In your case, those are still normal requests you make on a more busy website (news outlet or such).
Jeremy WeisingerSenior Network Consultant / Engineer

Commented:
Bottom line is this is normal.
Build an E-Commerce Site with Angular 5

Learn how to build an E-Commerce site with Angular 5, a JavaScript framework used by developers to build web, desktop, and mobile applications.

Enroll Today!
jana

Author

Commented:
Understood and gives a relief.  

However, if we were check them out, recommended steps you guys recommend?
Jeremy WeisingerSenior Network Consultant / Engineer

Commented:
What do you mean "check them out"?
KimputerIT Manager
Commented:
Would require extreme knowledge of all hosts. I know in.greta.io is checking for CDN, while gstatic is Google owned. For you to do that, takes you a lot of time to find out, making it a 24/7 job to keep up with all the hostnames used every day.
You could use some algorithm to lessen the load as times go by (slowly whitelisting the known ones), but still requires a lot of time.
jana

Author

Commented:
I  got it, you mean check every site and google them one by one (yes, painstaking)
KimputerIT Manager

Commented:
Some are not revealed by a simple google query, and needs quite a bit more research.
jana

Author

Commented:
Ok, prior closing the question, can you suggest some of "bit more research"? (just a little to direct us the right way)
Senior Network Consultant / Engineer
Commented:
It depends on what kind of research you want to do. If you are just concerned about browser activity then something like Privacy Badger (from the EFF https://www.eff.org/privacybadger) or uBlock Origin can do logging and blocking and show you a lot of resources that are being pulled from. You can also hit F12 when in your browser and you can explore all the elements.

More in depth would be to use wireshark on your computer and filter by DNS...

But if you're looking for general security knowledge then I have to say that the landscape is always changing. Following blogs or podcasts is how I keep up with it.... as best I can.
jana

Author

Commented:
Thanx!!!
Jeremy WeisingerSenior Network Consultant / Engineer

Commented:
Glad to help. :)

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial