Cisco ASA 5505 - Manual (Page 1167)

55-3
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 55 Configuring the Botnet Traffic Filter
Information About the Botnet Traffic Filter
3. In some cases, the IP address itself is supplied in the dynamic database, and the Botnet Traffic Filter
logs or drops any traffic to that IP address without having to inspect DNS requests.
Database Files
The database files are stored in running memory; they are not stored in flash memory. If you need to
delete the database, use the dynamic-filter database purge command instead. Be sure to first disable
use of the database by entering the no dynamic-filter use-database command.
Note To use the database, be sure to configure a domain name server for the ASA so that it can access the URL.
To use the domain names in the dynamic database, you need to enable DNS packet inspection with
Botnet Traffic Filter snooping; the ASA looks inside the DNS packets for the domain name and
associated IP address.
Database Traffic Types
The dynamic database includes the following types of addresses:
• Ads—Advertising networks that deliver banner ads, interstitials, rich media ads, pop-ups, and
pop-unders for websites, spyware and adware. Some of these networks send ad-oriented HTML
emails and email verification services.
• Data Tracking—Sources associated with companies and websites that offer data tracking and
metrics services to websites and other online entities. Some of these also run small advertising
networks.
• Spyware—Sources that distribute spyware, adware, greyware, and other potentially unwanted
advertising software. Some of these also run exploits to install such software.
• Malware (higher threat level)—Sources that use various exploits to deliver adware, spyware and
other malware to victim computers. Some of these are associated with rogue online vendors and
distributors of dialers which deceptively call premium-rate phone numbers.
• Malware (lower threat level)—Sources that deliver deceptive or malicious anti-spyware,
anti-malware, registry cleaning, and system cleaning software.
• Adult—Sources associated with adult networks/services offering web hosting for adult content,
advertising, content aggregation, registration and billing, and age verification. These may be tied to
distribution of adware, spyware, and dialers.
• Bot and Threat Networks—Rogue systems that control infected computers. They are either systems
hosted on threat networks or systems that are part of the botnet itself."
• (Conficker) Bot and Threat Networks—Command-and-control servers or botnet-masters of
conficker botnets.
• (ZeusBotnet) Bot and Threat Networks—Command-and-control servers or botnet-masters of Zeus
botnets.
Information About the Static Database
You can manually enter domain names or IP addresses (host or subnet) that you want to tag as bad names
in a blacklist. Static blacklist entries are always designated with a Very High threat level. You can also
enter names or IP addresses in a whitelist, so that names or addresses that appear on both the dynamic