classify.untangle.com excessive communication on dns

[CalebHawley]

A few of my locations I am seeing classify.untangle.com as 3-6% of the total network traffic. Ive gone through everything I can think of and cant see a correlation of events etc and this communication. I know that untangle communicates with command center, but on testing I see no issues with this.

Anyone have any idea what might be causing this specific outgoing request?

[dmorris]

classify.untangle.com is the virus blocker cloud scan.
If you are seeing tons of traffic there (by 3-6%, i'm sure you mean sessions, not bytes because the communication is small) its likely because you are scanning lots of things. Check your virus blocker reports. You may need to turn off scanning for some extensions or sites that are being frequently hit.

Not much uses http anymore, so maybe you're doing ssl inspection?

edit: also you can just turn off the cloud scan in virus blocker.

[CalebHawley]

Thanks, that helps. It is actually http even though its useless. Regulations in the field I'm in. And yeah it was sessions.

Looking at it I can tell what is causing this, its legit/needed so adding it to a pass site, thanks again!