netmon-control.dropbox.com

[MrShaver]

I'm seeing a lot of DNS traffic to netmon-control.dropbox.com.  Can someone help me understand what the purpose is for that domain?

[Lusil]

Hi there @MrShaver, thanks for posting your question here. 

Generally, these are our official domains that you'd find when you receive an email or a link. 

However, since you're referring to DNS traffic, could you clarify if you have any of our apps installed? 

Let me know and we'll take it from there, cheers!

[MrShaver]

Yes, it seems to be originating from the app, but it seems excessive. In some cases, our client is detecting 15-20 dns requests/hits per minute.

[Walter]

Hey there @MrShaver; I'm sorry to jump in here, but where exactly are you spotting this traffic?

Could you send us a screenshot so that we can have a visual too? 

If you could send us the status of the app as shown on the affected device, it'd be very helpful too. 

 

[MrShaver]

We use Cisco Umbrella and it is detecting this constant traffic.  We have had users untinstall the app and it goes away completely for that user.  Some of the users state that they haven't used dropbox anytime recently, but have the app installed from a while back.  It seems to be just a dormant application beaconing back home.

This screenshot below shows a small snippet of traffic from a single user. 

[Lusil]

In this case, we're more than happy to look into this a bit more in-depth via ticket. 

Would it be alright if I reached out to you via email?

[MrShaver]

Sure.

[Lusil]

I've sent you a ticket, so whenever you have a moment to check it out, just check your inbox and we'll go from there. 

[MrShaver]

I seem to be unable to "open" the ticket.  I can only view the ticket in the list.

[Lusil]

I sent you one to the email address associated with your Community profile. 

You should be able to find it in your inbox and reply to it from there.