>
    Strata Copilot
    Direct-to-IP Detection
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced IP Defense
    3. Introducing Advanced IP Defense
    4. Direct-to-IP Detection
    Download PDF
    Advanced IP Defense

    Direct-to-IP Detection

    Table of Contents

    Direct-to-IP Detection

    Advanced IP Defense direct-to-IP detection identifies outbound connections made directly to IP addresses without a preceding DNS resolution, exposing potential C2 channels and data exfiltration attempts.
    Attackers and unauthorized applications frequently bypass DNS-based security controls by connecting directly to IP addresses. Malware can communicate with C2 servers through hardcoded IPs, and data exfiltration can occur through direct IP connections to ephemeral cloud addresses that can't be blocked long-term. Direct-to-IP detection applies a zero trust approach to IP-based traffic by flagging any connection where the destination IP was not resolved through DNS.

    How Direct-to-IP Detection Works

    Your enforcement point passively inspects DNS traffic crossing each zone and maintains a local DNS Seen Table of IP address and TTL pairs for each resolved domain. It also forwards a copy of this DNS response data to Advanced IP Defense. Advanced IP Defense then builds a DNS Seen Table unique to your tenant that tracks every IP address resolved through DNS and when that resolution expires, enabling cross-firewall detection in asymmetric routing environments.
    When your enforcement point queries Advanced IP Defense about an IP address, Advanced IP Defense checks whether that IP appears in your tenant's DNS Seen Table with a valid (non-expired) entry. If the IP has no DNS history or the entry has expired beyond a grace period, Advanced IP Defense returns a direct-to-IP verdict. The grace period (currently 300 seconds) accounts for transmission delays and clients that use slightly expired cache entries.
    Direct-to-IP detection applies only to publicly routable IP addresses in outbound traffic. Advanced IP Defense allowlists all private IP ranges, so protocols that operate exclusively on internal networks (such as DHCP, mDNS, and NetBIOS) do not trigger false positives. Do not apply direct-to-IP rules to inbound traffic — direct-to-IP detection is designed for outbound sessions where a client initiates a connection without resolving the destination through DNS.

    Limitations

    DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT)
    Direct-to-IP detection requires the firewall to passively inspect DNS traffic crossing a zone and parse IP-TTL pairs from DNS responses. If clients use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT), their DNS queries are encrypted within HTTPS or TLS sessions. This prevents the firewall from parsing the DNS responses, so resolved IPs are never registered in the DNS Seen Table. Subsequent connections to those IPs are then incorrectly flagged as direct-to-IP under a blocking policy.
    Asymmetric routing
    In networks with asymmetric routing, the DNS query and the subsequent application session may traverse different firewalls. If a client resolves a domain through one firewall but initiates the connection through a second firewall, the second firewall has no local record of the DNS resolution. While Advanced IP Defense builds a shared per-tenant DNS Seen Table in the cloud to mitigate this, synchronization delays can cause the second firewall to evaluate the connection as direct-to-IP before the cloud table is updated. The default fail-open cache-miss behavior minimizes disruption on the first packet, but strict enforcement rules in heavily asymmetric paths may produce intermittent false positives.

    Initial Deployment Guidance

    When you first enable direct-to-IP detection, configure your Advanced IP Defense profile rules to use the Alert (Permit and Log) action for at least seven days before switching to Block (Drop & Log). This observation period allows you to:
    • Identify legitimate direct-to-IP connections in your environment (such as infrastructure services, APIs, or health checks that connect without prior DNS resolution).
    • Create exceptions for known-good traffic before enforcement begins.
    • Evaluate detection accuracy and tune rules based on your specific traffic patterns.
    After the observation period, review your threat logs to confirm that remaining direct-to-IP detections are genuine threats, then change the action to Block for high-confidence rules.

    Allowlists

    Advanced IP Defense uses allowlists to reduce false positives and unnecessary cloud lookups:
    • AIPD Allowlist — A cloud-maintained list of confirmed-benign IP addresses (such as well-known DNS resolvers and major infrastructure providers). Traffic to these IPs bypasses the Advanced IP Defense cloud lookup entirely.
    • No-DNS Allowlist — Contains IP addresses, ports, and IP-port combinations for protocols that legitimately use direct-to-IP connections. These entries skip the direct-to-IP check while still allowing other IP attribute checks to proceed.
    Your enforcement point downloads updated allowlists periodically. Advanced IP Defense prioritizes entries so that if memory constraints require truncation, the most critical entries are retained.

    © 2026 Palo Alto Networks, Inc. All rights reserved.