Filter
Top Products
26-3
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter 26 Configuring the Botnet Traffic Filter
Information About the Botnet Traffic Filter
3. In some cases, the IP address itself is supplied in the dynamic database, and the Botnet Traffic Filter
logs or drops any traffic to that IP address without having to inspect DNS requests.
Database Files
The database files are downloaded from the Cisco update server, and then stored in running memory;
they are not stored in flash memory. Be sure to identify a DNS server for the ASA so that it can access
the Cisco update server URL. In multiple context mode, the system downloads the database for all
contexts using the admin context interface; be sure to identify a DNS server in the admin context.
If you need to delete the database, use theConfiguration > Firewall > Botnet Traffic Filter > Botnet
Database pane Purge Botnet Database button instead. Be sure to first disable use of the database by
unchecking the Use Botnet data dynamically downloaded from updater server check box in the
Configuration > Firewall > Botnet Traffic Filter > Botnet Database > Dynamic Database Configuration
area.
Note To filter on the domain names in the dynamic database, you need to enable DNS packet inspection with
Botnet Traffic Filter snooping; the ASA looks inside the DNS packets for the domain name and
associated IP address.
Database Traffic Types
The dynamic database includes the following types of addresses:
• Ads—These are advertising networks that deliver banner ads, interstitials, rich media ads, pop-ups,
and pop-unders for websites, spyware and adware. Some of these networks send ad-oriented HTML
emails and email verification services.
• Data Tracking—These are sources associated with companies and websites that offer data tracking
and metrics services to websites and other online entities. Some of these also run small advertising
networks.
• Spyware—These are sources that distribute spyware, adware, greyware, and other potentially
unwanted advertising software. Some of these also run exploits to install such software.
• Malware—These are sources that use various exploits to deliver adware, spyware and other malware
to victim computers. Some of these are associated with rogue online vendors and distributors of
dialers which deceptively call premium-rate phone numbers.
• Adult—These are sources associated with adult networks/services offering web hosting for adult
content, advertising, content aggregation, registration & billing, and age verification. These may be
tied to distribution of adware, spyware, and dialers.
• Bot and Threat Networks—These are rogue systems that control infected computers. They are either
systems hosted on threat networks or systems that are part of the botnet itself.
Information About the Static Database
You can manually enter domain names or IP addresses (host or subnet) that you want to tag as bad names
in a blacklist. Static blacklist entries are always designated with a Very High threat level. You can also
enter names or IP addresses in a whitelist, so that names or addresses that appear on both the dynamic
blacklist and the whitelist are identified only as whitelist addresses in syslog messages and reports. Note
that you see syslog messages for whitelisted addresses even if the address is not also in the dynamic
blacklist.