Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

BotNet Filter Report Veracity?

Company has a ASA5510 with BotNet Traffic filter enabled on it

When I go to the Report file (using ASDM) it shows me From the Monitor section->Botnet Traffic Filter -> Infected Hosts - > Highest Threat Level

If I save it as a pdf and review the report it shows my malware counts on different machines. If I go to that machine and run AV or Malwarebytes ot other tools I never detect anything

What is this report showing me?

Cordially

Thomas

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: BotNet Filter Report Veracity?

The ASA will not remove the botnet from the computer. It will only monitor and catch the traffic at the network level.

So, if it is removed, it could be some AV or virus cleaning software on the host. But the ASA only monitors at a network level and potentially blocks.

I hope it makes sense.

Let us know if your question is answered.

PK

7 REPLIES
Cisco Employee

Re: BotNet Filter Report Veracity?

The tool is reporting the hosts that tried to contact known Botnet mater ip addresses. The botnet feature monitors traffic to see is hosts are trying to call home to their masters.

So, even though AV might not catch a bot running on a machine, the ASA might catch its traffic ata network level when it tries to contact suspicious ip addresses. I would suggest to check the Botnet traffic logs from the ASA to see where these hosts are trying to talk to.

I hope it helps.

PK

New Member

Re: BotNet Filter Report Veracity?

PK

I am not questioning the process that you described. I would like to know that the bot that was "calling/reporting" back is no longer on the device/computer listed in the report

How do I know that there was malware on the device? Does something remove it? Is it time based? does it morph to ....

Or do I just take it on faith that I am protected and ignore the report?

It would be nice if it was reported on a device, if you went to the device and could find it and then remove it.

Cordially

Thomas

Cisco Employee

Re: BotNet Filter Report Veracity?

The ASA will not remove the botnet from the computer. It will only monitor and catch the traffic at the network level.

So, if it is removed, it could be some AV or virus cleaning software on the host. But the ASA only monitors at a network level and potentially blocks.

I hope it makes sense.

Let us know if your question is answered.

PK

New Member

Re: BotNet Filter Report Veracity?

PK

I alo have the WSA implemented (uses BotNet Traffic Filter. I understand the concept. I just never locate the bad code/application. Yes probably in traffic logs and in Database but not on AV quarintine orr av logs.

Kinda of like being in a wind storm you can see the anemometer spinning but you can't locate the wind.....

Thomas

Cisco Employee

Re: BotNet Filter Report Veracity?

I am with you.

Check the logs to see what servers they were calling and that could point you to what the Bot was and help you get closer.

Take care,

PK

New Member

Re: BotNet Filter Report Veracity?

Hi,

is there any option to check is an IP address is listed on the BotNet filter of the ASA ?

For example if I need to check the IP 41.238.146.25 with the following url I can do:

htttp://www.senderbase.org/senderbase_queries/detailip?search_string=41.238.146.25

Regards

Roberto Taccon

Cisco Employee

Re: BotNet Filter Report Veracity?

You can check if an ip address exists in the dns snooping database by doing

show dynamic-filter dns-snoop detail

And you can check if there is an entry for the dynamic filter asp table by checking the command

sh asp table classify domain dynamic-filter

show asp table dynamic-filter

I hope it helps.

PK

436
Views
0
Helpful
7
Replies
CreatePlease to create content