Cisco ASA 5500 Series Configuration Guide using the CLI, 8.2 - Configuring the Botnet Traffic Filter [Cisco ASA 5500 Series Adaptive Security Appliances]

Table Of Contents

Configuring the Botnet Traffic Filter

Information About the Botnet Traffic Filter

Botnet Traffic Filter Address Categories

Botnet Traffic Filter Actions for Known Addresses

Botnet Traffic Filter Databases

Information About the Dynamic Database

Information About the Static Database

Information About the DNS Reverse Lookup Cache and DNS Host Cache

How the Botnet Traffic Filter Works

Licensing Requirements for the Botnet Traffic Filter

Guidelines and Limitations

Default Settings

Configuring the Botnet Traffic Filter

Task Flow for Configuring the Botnet Traffic Filter

Configuring the Dynamic Database

Adding Entries to the Static Database

Enabling DNS Snooping

Enabling Traffic Classification for Botnet Traffic Filter Logging

Blocking Botnet Traffic

Searching the Dynamic Database

Monitoring the Botnet Traffic Filter

Botnet Traffic Filter Syslog Messaging

Botnet Traffic Filtering Commands

Configuration Examples for the Botnet Traffic Filter

Recommended Configuration Example

Other Configuration Examples

Where to Go Next

Feature History for Botnet Traffic Filter

Configuring the Botnet Traffic Filter

Malware is malicious software that is installed on an unknowing host. Malware that attempts network activity such as sending private data (passwords, credit card numbers, key strokes, or proprietary data) can be detected by the Botnet Traffic Filter when the malware starts a connection to a known bad IP address. The Botnet Traffic Filter checks incoming and outgoing connections against a dynamic database of known bad domain names and IP addresses (the blacklist), and then logs any suspicious activity. When you see syslog messages about the malware activity, you can take steps to isolate and disinfect the host.

You can also supplement the Cisco dynamic database with blacklisted addresses of your choosing by adding them to a static blacklist; if the dynamic database includes blacklisted addresses that you think should not be blacklisted, you can manually enter them into a static whitelist. Whitelisted addresses still generate syslog messages, but because you are only targeting blacklist syslog messages, they are informational.

Note If you do not want to use the Cisco dynamic database at all, because of internal requirements, you can use the static blacklist alone if you can identify all the malware sites that you want to target.

This chapter describes how to configure the Botnet Traffic Filter, and includes the following sections:

•Information About the Botnet Traffic Filter

•Licensing Requirements for the Botnet Traffic Filter

•Guidelines and Limitations

•Default Settings

•Configuring the Botnet Traffic Filter

•Monitoring the Botnet Traffic Filter

•Configuration Examples for the Botnet Traffic Filter

•Where to Go Next

•Feature History for Botnet Traffic Filter

Information About the Botnet Traffic Filter

This section includes information about the Botnet Traffic Filter, and includes the following topics:

•Botnet Traffic Filter Address Categories

•Botnet Traffic Filter Actions for Known Addresses

•Botnet Traffic Filter Databases

•How the Botnet Traffic Filter Works

Botnet Traffic Filter Address Categories

Addresses monitored by the Botnet Traffic Filter include:

•Known malware addresses—These addresses are on the blacklist identified by the dynamic database and the static blacklist.

•Known allowed addresses—These addresses are on the whitelist. To be whitelisted, an address must be blacklisted by the dynamic database and also identified by the static whitelist.

•Ambiguous addresses—These addresses are associated with multiple domain names, but not all of these domain names are on the blacklist. These addresses are on the graylist.

•Unlisted addresses—These addresses are unknown, and not included on any list.

Botnet Traffic Filter Actions for Known Addresses

Unlisted addresses do not generate any syslog messages, but addresses on the blacklist, whitelist, and graylist generate syslog messages differentiated by type. See the "Botnet Traffic Filter Syslog Messaging" section for more information.

Note The Botnet Traffic Filter does not automatically block traffic; you can, however, block traffic manually if desired by configuring an access list to deny traffic to a known bad destination, or by using the shun command.

Botnet Traffic Filter Databases

The Botnet Traffic Filter uses two databases for known addresses. You can use both databases together, or you can disable use of the dynamic database and use the static database alone. This section includes the following topics:

•Information About the Dynamic Database

•Information About the Static Database

•Information About the DNS Reverse Lookup Cache and DNS Host Cache

Information About the Dynamic Database

The Botnet Traffic Filter can receive periodic updates for the dynamic database from the Cisco update server. This database lists thousands of known bad domain names and IP addresses.

The adaptive security appliance uses the dynamic database as follows:

1. When the domain name in a DNS reply matches a name in the dynamic database, the Botnet Traffic Filter adds the name and IP address to the DNS reverse lookup cache.

2. When the infected host starts a connection to the IP address of the malware site, then the adaptive security appliance sends a syslog message informing you of the suspicious activity.

3. In some cases, the IP address itself is supplied in the dynamic database, and the Botnet Traffic Filter logs any traffic to that IP address without having to inspect DNS requests.

The database files are stored in running memory; they are not stored in Flash memory. If you need to delete the database, use the dynamic-filter database purge commandinstead. Be sure to first disable use of the database by entering the no dynamic-filter use-database command.

Note To use the database, be sure to configure a domain name server for the adaptive security appliance so that it can access the URL.

To use the domain names in the dynamic database, you need to enable DNS packet inspection with Botnet Traffic Filter snooping; the adaptive security appliance looks inside the DNS packets for the domain name and associated IP address.

Information About the Static Database

You can manually enter domain names or IP addresses (host or subnet) that you want to tag as bad names in a blacklist. You can also enter names or IP addresses in a whitelist, so that names or addresses that appear on both the dynamic blacklist and the whitelist are identified only as whitelist addresses in syslog messages and reports.

When you add a domain name to the static database, the adaptive security appliance waits 1 minute, and then sends a DNS request for that domain name and adds the domain name/IP address pairing to the DNS host cache. (This action is a background process, and does not affect your ability to continue configuring the adaptive security appliance).

If you do not have a domain name server configured for the adaptive security appliance, or it is unavailable, then you can alternatively enable DNS packet inspection with Botnet Traffic Filter snooping. With DNS snooping, when an infected host sends a DNS request for a name on the static database, the adaptive security appliance looks inside the DNS packets for the domain name and associated IP address and adds the name and IP address to the DNS reverse lookup cache.

Information About the DNS Reverse Lookup Cache and DNS Host Cache

When you use the dynamic database with DNS snooping, entries are added to the DNS reverse lookup cache. If you use the static database, entries are added to the DNS host cache (see the "Information About the Static Database" section about using the static database with DNS snooping and the DNS reverse lookup cache).

Entries in the DNS reverse lookup cache and the DNS host cache have a time to live (TTL) value provided by the DNS server. The largest TTL value allowed is 1 day (24 hours); if the DNS server provides a larger TTL, it is truncated to 1 day maximum.

For the DNS reverse lookup cache, after an entry times out, the adaptive security appliance renews the entry when an infected host initiates a connection to a known address, and DNS snooping occurs.

For the DNS host cache, after an entry times out, the adaptive security appliance periodically requests a refresh for the entry.

For the DNS host cache, the maximum number of blacklist entries and whitelist entries is 1000 each.

Table 54-1 lists the maximum number of entries in the DNS reverse lookup cache per model.

Table 54-1 DNS Reverse Lookup Cache Entries per Model

ASA Model

Maximum Entries

ASA 5505

5000

ASA 5510

10,000

ASA 5520

20,000

ASA 5540

40,000

ASA 5550

40,000

ASA 5580

100,000

How the Botnet Traffic Filter Works

Figure 1 shows how the Botnet Traffic Filter works with the dynamic database plus DNS inspection with Botnet Traffic Filter snooping.

Figure 1 How the Botnet Traffic Filter Works with the Dynamic Database

Figure 2 shows how the Botnet Traffic Filter works with the static database.

Figure 2 How the Botnet Traffic Filter Works with the Static Database

Licensing Requirements for the Botnet Traffic Filter

The following table shows the licensing requirements for this feature:

Model

License Requirement

All models

Botnet Traffic Filter License.

Guidelines and Limitations

This section includes the guidelines and limitations for this feature.

Context Mode Guidelines

Supported in single and multiple context mode.

Firewall Mode Guidelines

Supported in routed and transparent firewall mode.

Failover Guidelines

Does not support replication of the DNS reverse lookup cache, DNS host cache, or the dynamic database in Stateful Failover.

IPv6 Guidelines

Does not support IPv6.

Additional Guidelines and Limitations

•TCP DNS traffic is not supported.

•You can add up to 1000 blacklist entries and 1000 whitelist entries in the static database.

Default Settings

By default, the Botnet Traffic Filter is disabled, as is use of the dynamic database.

For DNS inspection, which is enabled by default, Botnet Traffic Filter snooping is disabled by default.

Configuring the Botnet Traffic Filter

This section includes the following topics:

•Task Flow for Configuring the Botnet Traffic Filter

•Configuring the Dynamic Database

•Enabling DNS Snooping

•Adding Entries to the Static Database

•Enabling Traffic Classification for Botnet Traffic Filter Logging

•Blocking Botnet Traffic

•Searching the Dynamic Database

Task Flow for Configuring the Botnet Traffic Filter

To configure the Botnet Traffic Filter, perform the following steps:

Step 1 Enable use of the dynamic database. See the "Configuring the Dynamic Database" section.

This procedure enables database updates from the Cisco update server, and also enables use of the downloaded dynamic database by the adaptive security appliance. Disallowing use of the downloaded database is useful in multiple context mode so you can configure use of the database on a per-context basis.

Step 2 (Optional) Add static entries to the database. See the "Adding Entries to the Static Database" section.

This procedure lets you augment the dynamic database with domain names or IP addresses that you want to blacklist or whitelist. You might want to use the static database instead of the dynamic database if you do not want to download the dynamic database over the Internet.

Step 3 Enable DNS snooping. See the "Enabling DNS Snooping" section.

This procedure enables inspection of DNS packets, compares the domain name with those in the dynamic database or the static database (when a DNS server for the adaptive security appliance is unavailable), and adds the name and IP address to the DNS reverse lookup cache. This cache is then used by the Botnet Traffic Filter logging function when connections are made to the suspicious address.

Step 4 Enable traffic classification for Botnet Traffic Filter logging. See the "Enabling Traffic Classification for Botnet Traffic Filter Logging" section.

This procedure enables the Botnet Traffic Filter, which compares the source and destination IP address in each initial connection packet to the IP addresses in the dynamic database, static database, DNS reverse lookup cache, and DNS host cache, and sends a syslog message for any matching traffic.

Step 5 Block traffic based on syslog message information. See the "Blocking Botnet Traffic" section.

The Botnet Traffic Filter does not automatically block traffic; you can, however, block traffic manually if desired by configuring an access list to deny traffic, or by using the shun command to block all traffic to and from a host.

Configuring the Dynamic Database

This procedure enables database updates, and also enables use of the downloaded dynamic database by the adaptive security appliance. Disabling use of the downloaded database is useful in multiple context mode so you can configure use of the database on a per-context basis.

By default, downloading and using the dynamic database is disabled.

Prerequisites

Enable adaptive security appliance use of a DNS server according to the "Configuring the DNS Server" section on page 8-6.

Detailed Steps
Command

Purpose
Step 1
dynamic-filter updater-client enable
Example:
hostname(config)# dynamic-filter updater-client enable
Enables downloading of the dynamic database from the Cisco update server. In multiple context mode, enter this command in the system execution space. If you do not have a database already installed on the adaptive security appliance, it downloads the database after approximately 2 minutes. The update server determines how often the adaptive security appliance polls the server for future updates, typically every hour.
Step 2
(Multiple context mode only)

changeto context context_name
Example:
hostname# changeto context admin
hostname/admin# 
Changes to the context so that you can configure use of the database on a per-context basis.
Step 3
dynamic-filter use-database
Example:
hostname(config)# dynamic-filter use-database
Enables use of the dynamic database. In multiple context mode, enter this command in the context execution space.
Examples

The following multiple mode example enables downloading of the dynamic database, and enables use of the database in context1 and context2:
hostname(config)# dynamic-filter updater-client enable
hostname(config)# changeto context context1
hostname/context1(config)# dynamic-filter use-database
hostname/context1(config)# changeto context context2
hostname/context2(config)# dynamic-filter use-database
The following single mode example enables downloading of the dynamic database, and enables use of the database:
hostname(config)# dynamic-filter updater-client enable
hostname(config)# dynamic-filter use-database
What to Do Next

See the "Adding Entries to the Static Database" section.

Adding Entries to the Static Database

The static database lets you augment the dynamic database with domain names or IP addresses that you want to blacklist or whitelist. See the "Information About the Static Database" section for more information.

Prerequisites

•In multiple context mode, perform this procedure in the context execution space.

•Enable adaptive security appliance use of a DNS server according to the "Configuring the DNS Server" section on page 8-6.

Detailed Steps
Command

Purpose
Step 1
dynamic-filter blacklist
Example:
hostname(config)# dynamic-filter blacklist
Edits the Botnet Traffic Filter blacklist.
Step 2

Enter one or both of the following:
name domain_name
Example:
hostname(config-llist)# name bad.example.com
Adds a name to the blacklist. You can enter this command multiple times for multiple entries. You can add up to 1000 blacklist entries.
address ip_address mask
Example:
hostname(config-llist)# address 10.1.1.1 255.255.255.255
Adds an IP address to the blacklist. You can enter this command multiple times for multiple entries. The mask can be for a single host or for a subnet.
Step 3
dynamic-filter whitelist
Example:
hostname(config)# dynamic-filter whitelist
Edits the Botnet Traffic Filter whitelist.
Step 4

Enter one or both of the following:
name domain_name
Example:
hostname(config-llist)# name good.example.com
Adds a name to the whitelist. You can enter this command multiple times for multiple entries. You can add up to 1000 whitelist entries.
address ip_address mask
Example:
hostname(config-llist)# address 10.1.1.2 255.255.255.255
Adds an IP address to the whitelist. You can enter this command multiple times for multiple entries. The mask can be for a single host or for a subnet.
Examples

The following example creates entries for the blacklist and whitelist:
hostname(config)# dynamic-filter blacklist
hostname(config-llist)# name bad1.example.com
hostname(config-llist)# name bad2.example.com
hostname(config-llist)# address 10.1.1.1 255.255.255.0
hostname(config-llist)# dynamic-filter whitelist
hostname(config-llist)# name good.example.com
hostname(config-llist)# name great.example.com
hostname(config-llist)# name awesome.example.com
hostname(config-llist)# address 10.1.1.2 255.255.255.255
What to Do Next

See the "Enabling DNS Snooping" section.

Enabling DNS Snooping

This procedure enables inspection of DNS packets and enables Botnet Traffic Filter snooping, which compares the domain name with those on the dynamic database or static database, and adds the name and IP address to the Botnet Traffic Filter DNS reverse lookup cache. This cache is then used by the Botnet Traffic Filter logging function when connections are made to the suspicious address.

The following procedure creates an interface-specific service policy for DNS inspection. See the "DNS Inspection" section on page 41-1 and Chapter 9, "Using Modular Policy Framework," for detailed information about configuring advanced DNS inspection options using the Modular Policy Framework.

Prerequisites

In multiple context mode, perform this procedure in the context execution space.

Restrictions

TCP DNS traffic is not supported.

Default DNS Inspection Configuration and Recommended Configuration

The default configuration for DNS inspection inspects all UDP DNS traffic on all interfaces, and does not have DNS snooping enabled.

We suggest that you enable DNS snooping only on interfaces where external DNS requests are going. Enabling DNS snooping on all UDP DNS traffic, including that going to an internal DNS server, creates unnecessary load on the adaptive security appliance.

For example, if the DNS server is on the outside interface, you should enable DNS inspection with snooping for all UDP DNS traffic on the outside interface. See the "Examples" section for the recommended commands for this configuration.

Detailed Steps
Command

Purpose
Step 1
class-map name
Example:
hostname(config)# class-map dynamic-filter_snoop_class
Creates a class map to identify the traffic for which you want to inspect DNS.
Step 2
match parameters
Example:
hostname(config-cmap)# match port udp eq domain
Specifies traffic for the class map. See the "Identifying Traffic (Layer 3/4 Class Map)" section on page 9-13 for more information about available parameters. For example, you can specify an access list for DNS traffic to and from certain addresses, or you can specify all UDP DNS traffic.
Step 3
policy-map name
Example:
hostname(config)# policy-map dynamic-filter_snoop_policy
Adds or edits a policy map so you can set the actions to take with the class map traffic.
Step 4
class name
Example:
hostname(config-pmap)# class dynamic-filter_snoop_class
Identifies the class map you created in Step 1.
Step 5
inspect dns [map_name] dynamic-filter-snoop
Example:
hostname(config-pmap-c)# inspect dns preset_dns_map dynamic-filter-snoop
Enables DNS inspection with Botnet Traffic Filter snooping. To use the default DNS inspection policy map for the map_name, specify preset_dns_map for the map name. See the "DNS Inspection" section on page 41-1 for more information about creating a DNS inspection policy map.
Step 6
service-policy policymap_name interface interface_name
Example:
hostname(config)# service-policy dynamic-filter_snoop_policy interface outside
Activates the policy map on an interface. The interface-specific policy overrides the global policy. You can only apply one policy map to each interface.
Examples

The following recommended configuration creates a class map for all UDP DNS traffic, enables DNS inspection and Botnet Traffic Filter snooping with the default DNS inspection policy map, and applies it to the outside interface:
hostname(config)# class-map dynamic-filter_snoop_class
hostname(config-cmap)# match port udp eq domain
hostname(config-cmap)# policy-map dynamic-filter_snoop_policy
hostname(config-pmap)# class dynamic-filter_snoop_class
hostname(config-pmap-c)# inspect dns preset_dns_map dynamic-filter-snoop
hostname(config-pmap-c)# service-policy dynamic-filter_snoop_policy interface outside
What to Do Next

See the "Enabling Traffic Classification for Botnet Traffic Filter Logging" section.

Enabling Traffic Classification for Botnet Traffic Filter Logging

This procedure enables the Botnet Traffic Filter. The Botnet Traffic Filter compares the source and destination IP address in each initial connection packet to the following:

•Dynamic database IP addresses

•Static database IP addresses

•DNS reverse lookup cache (for dynamic database domain names)

•DNS host cache (for static database domain names)

When an address matches, the adaptive security appliance sends a syslog message.

Prerequisites

In multiple context mode, perform this procedure in the context execution space.

Recommended Configuration

Although DNS snooping is not required, we recommend configuring DNS snooping for maximum use of the Botnet Traffic Filter (see the "Enabling DNS Snooping" section). Without DNS snooping for the dynamic database, the Botnet Traffic Filter uses only the static database entries, plus any IP addresses in the dynamic database; domain names in the dynamic database are not used.

We recommend enabling the Botnet Traffic Filter on all traffic on the Internet-facing interface. See the "Examples" section for the recommended commands used for this configuration.

Detailed Steps
Command

Purpose
Step 1
(Optional)

access-list access_list_name extended {deny | permit} protocol source_address mask [operator port] dest_address mask
[operator port]
Example:
hostname(config)# access-list dynamic-filter_acl extended permit tcp any any eq 80
Identifies the traffic that you want to monitor. If you do not create an access list, by default you monitor all traffic. See Chapter 11, "Adding an Extended Access List," for more information about creating an access list.
Step 2
dynamic-filter enable [interface name] [classify-list access_list]
Example:
hostname(config)# dynamic-filter enable interface outside classify-list dynamic-filter_acl
Enables the Botnet Traffic Filter for all traffic.

We recommend enabling the Botnet Traffic Filter on all traffic on the Internet-facing interface using the interface keyword.

You can optionally limit monitoring to specific traffic by using the classify-list keyword with an access list.

You can enter this command one time for each interface and one time for the global policy (where you do not specify the interface keyword). Each interface and global command can have an optional classify-list keyword. Any interface-specific commands take precedence over the global command.
Examples

The following recommended configuration monitors all traffic on the outside interface:
hostname(config)# dynamic-filter enable interface outside
If you decide not to monitor all traffic, you can limit the traffic using an access list. The following example monitors only port 80 traffic on the outside interface:
hostname(config)# access-list dynamic-filter_acl extended permit tcp any any eq 80
hostname(config)# dynamic-filter enable interface outside classify-list dynamic-filter_acl
Blocking Botnet Traffic

The Botnet Traffic Filter does not automatically block traffic; you can, however, block traffic manually if desired by configuring an access list to deny traffic, or by using the shun command tool to block all traffic to and from a host.

For example, you receive the following syslog message:
ASA-4-338002: Dynamic Filter permitted black listed TCP traffic from inside:10.1.1.45/6798 
(209.165.201.1/7890) to outside:209.165.202.129/80 (209.165.202.129/80), destination 
209.165.202.129 resolved from dynamic list: bad.example.com
You can then perform one of the following actions:

•Create an access list to deny traffic.

For example, using the syslog message above, you might want to deny traffic from the infected host at 10.1.1.45 to the malware site at 209.165.202.129. Or, if there are many connections to different blacklisted addresses, you can create an access list to deny all traffic from 10.1.1.45 until you resolve the infection on the host computer. For example, the following commands deny all traffic from 10.1.1.5 to 209.165.202.129, but permits all other traffic on the inside interface:
hostname(config)# access-list BLOCK_OUT extended deny ip host 10.1.1.45 host 
209.165.202.129
hostname(config)# access-list BLOCK_OUT extended permit ip any any
hostname(config)# access-group BLOCK_OUT in interface inside
See Chapter 11, "Adding an Extended Access List," for more information about creating an access list, and see Chapter 35, "Permitting or Denying Network Access," for information about applying the access list to the interface.

Note Access lists block all future connections. To block the current connection, if it is still active, enter the clear conn command. For example, to clear only the connection listed in the syslog message, enter the clear conn address 10.1.1.45 address 209.165.202.129 command. See the Cisco ASA 5500 Series Command Reference for more information.

•Shun the infected host.

Shunning blocks all connections from the host, so you should use an access list if you want to block connections to certain destination addresses and ports. To shun a host, enter the following command. To drop the current connection as well as blocking all future connections, enter the destination address, source port, destination port, and optional protocol.
hostname(config)# shun src_ip [dst_ip src_port dest_port [protocol]]
For example, to block future connections from 10.1.1.45, and also drop the current connection to the malware site in the syslog message, enter:
hostname(config)# shun 10.1.1.45 209.165.202.129 6798 80
See "Blocking Unwanted Connections" section on page 57-2 for more information about shunning.

After you resolve the infection, be sure to remove the access list or the shun. To remove the shun, enter no shun src_ip.

Searching the Dynamic Database

If you want to check if a domain name or IP address is included in the dynamic database, you can search the database for a string.

Detailed Steps
Command

Purpose
dynamic-filter database find string
Example:
hostname# dynamic-filter database find
Searches the dynamic database for a domain name or IP address. The string can be the complete domain name or IP address, or you can enter part of the name or address, with a minimum search string of 3 characters. If there are multiple matches, the first two matches are shown. To refine your search for a more specific match, enter a longer string.

Note Regular expressions are not supported for the database search.
Examples

The following example searches on the string "example.com", and finds 1 match:
hostname# dynamic-filter database find bad.example.com
   bad.example.com
Found 1 matches
The following example searches on the string "bad", and finds more than 2 matches:
hostname# dynamic-filter database find bad
   bad.example.com
   bad.example.net
Found more than 2 matches, enter a more specific string to find an exact
match
Monitoring the Botnet Traffic Filter

Whenever a known address is classified by the Botnet Traffic Filter, then a syslog message is generated. You can also monitor Botnet Traffic Filter statistics and other parameters by entering commands on the adaptive security appliance. This section includes the following topics:

•Botnet Traffic Filter Syslog Messaging

•Botnet Traffic Filtering Commands

Botnet Traffic Filter Syslog Messaging

The Botnet Traffic Filter generates detailed syslog messages numbered 338nnn. Messages differentiate between incoming and outgoing connections, blacklist, whitelist, or graylist addresses, and many other variables. (The graylist includes addresses that are associated with multiple domain names, but not all of these domain names are on the blacklist.)

See the Cisco ASA 5500 Series System Log Messages for detailed information about syslog messages.

Botnet Traffic Filtering Commands

To monitor the Botnet Traffic Filter, enter one of the following commands:

Command

Purpose

show asp table dynamic-filter [hits]

Shows the Botnet Traffic Filter rules that are installed in the accelerated security path.

show dynamic-filter data

Shows information about the dynamic database, including when the dynamic database was last downloaded, the version of the database, how many entries the database contains, and 10 sample entries.

show dynamic-filter dns-snoop [detail]

Shows the Botnet Traffic Filter DNS snooping summary, or with the detail keyword, the actual IP addresses and names. All inspected DNS data is included in this output, and not just matching names in the blacklist. DNS data from static entries are not included.

To clear the DNS snooping data, enter the clear dynamic-filter dns-snoop command.

show dynamic-filter reports top [botnet-sites | botnet-ports | infected-hosts]

Generates reports of the top 10 botnet sites, ports, and infected hosts. This report is a snapshot of the data, and may not match the top 10 items since the statistics started to be collected. For hosts, the timeout value is 1 hour (non-configurable) to reduce the memory impact. The site and port reports do not have a timeout value.

To clear the report data, enter the clear dynamic-filter reports command.

show dynamic-filter statistics [interface name]

Shows how many connections were monitored with the Botnet Traffic Filter, and how many of those connections match the whitelist, blacklist, and graylist. (The graylist includes addresses that are associated with multiple domain names, but not all of these domain names are on the blacklist.)

To clear the statistics, enter the clear dynamic-filter statistics [interface name] command.

show dynamic-filter updater-client

Shows information about the updater server, including the server IP address, the next time the adaptive security appliance will connect with the server, and the database version last installed.

Examples

The following is sample output from the show dynamic-filter statistics command:
hostname# show dynamic-filter statistics
Enabled on interface outside
 Total conns classified 2108, ingress 2108, egress 0
 Total whitelist hits 0, ingress 0, egress 0
 Total greylist hits 0, ingress 0, egress 0
 Total blacklist hits 11, ingress 11, egress 0
Enabled on interface inside
 Total conns classified 4908, ingress 4908, egress 0
 Total whitelist hits 3, ingress 3, egress 0
 Total greylist hits 0, ingress 0, egress 0
 Total blacklist hits 1179, ingress 1179, egress 0
The following is sample output from the show dynamic-filter reports top botnet-sites command:
hostname# show dynamic-filter reports top botnet-sites
Site                                       Connections logged
----------------------------------------------------------------------
bad1.example.com (10.67.22.34)                      11
bad2.example.com (209.165.200.225)                   8
bad1.cisco.example(10.131.36.158)                    6
bad2.cisco.example(209.165.201.1)                    2
horrible.example.net(10.232.224.2)                   2
nono.example.org(209.165.202.130)                    1
The following is sample output from the show dynamic-filter reports top botnet-ports command:
hostname# show dynamic-filter reports top botnet-ports
Port                                       Connections logged
----------------------------------------------------------------------
tcp 1000                                           617
tcp 2001                                           472
tcp 23                                              22
tcp 1001                                            19
udp 2000                                            17
udp 2001                                            17
tcp 8080                                             9
tcp 80                                               3
tcp >8192                                            2
The following is sample output from the show dynamic-filter reports top infected-hosts command:
hostname# show dynamic-filter reports top infected-hosts
Host                                       Connections logged
----------------------------------------------------------------------
10.10.10.51(inside)                               1190
10.12.10.10(inside)                                10             
10.10.11.10(inside)                                 5 
Configuration Examples for the Botnet Traffic Filter

This section includes the recommended configuration for single and multiple context mode, as well as other possible configurations. This section includes the following topics:

•Recommended Configuration Example

•Other Configuration Examples

Recommended Configuration Example

The following recommended example configuration for single context mode enables downloading of the dynamic database, and enables use of the database. It creates a class map for all UDP DNS traffic, enables DNS inspection and Botnet Traffic Filter snooping with the default DNS inspection policy map, and applies it to the outside interface, the Internet-facing interface.
hostname(config)# dynamic-filter updater-client enable
hostname/context1(config)# dynamic-filter use-database
hostname/context1(config)# class-map dynamic-filter_snoop_class
hostname/context1(config-cmap)# match port udp eq domain
hostname/context1(config-cmap)# policy-map dynamic-filter_snoop_policy
hostname/context1(config-pmap)# class dynamic-filter_snoop_class
hostname/context1(config-pmap-c)# inspect dns preset_dns_map dynamic-filter-snoop
hostname/context1(config-pmap-c)# service-policy dynamic-filter_snoop_policy interface 
outside
hostname/context1(config)# dynamic-filter enable interface outside
The following recommended example configuration for multiple context mode enables the Botnet Traffic Filter for two contexts:
hostname(config)# dynamic-filter updater-client enable
hostname(config)# changeto context context1
hostname/context1(config)# dynamic-filter use-database
hostname/context1(config)# class-map dynamic-filter_snoop_class
hostname/context1(config-cmap)# match port udp eq domain
hostname/context1(config-cmap)# policy-map dynamic-filter_snoop_policy
hostname/context1(config-pmap)# class dynamic-filter_snoop_class
hostname/context1(config-pmap-c)# inspect dns preset_dns_map dynamic-filter-snoop
hostname/context1(config-pmap-c)# service-policy dynamic-filter_snoop_policy interface 
outside
hostname/context1(config)# dynamic-filter enable interface outside
hostname/context1(config)# changeto context context2
hostname/context2(config)# dynamic-filter use-database
hostname/context2(config)# class-map dynamic-filter_snoop_class
hostname/context2(config-cmap)# match port udp eq domain
hostname/context2(config-cmap)# policy-map dynamic-filter_snoop_policy
hostname/context2(config-pmap)# class dynamic-filter_snoop_class
hostname/context2(config-pmap-c)# inspect dns preset_dns_map dynamic-filter-snoop
hostname/context2(config-pmap-c)# service-policy dynamic-filter_snoop_policy interface 
outside
hostname/context2(config)# dynamic-filter enable interface outside
Other Configuration Examples

The folloiwng sample configuration adds static entries are to the blacklist and to the whitelist. Then, it monitors all port 80 traffic on the outside interface.
hostname(config)# dynamic-filter updater-client enable
hostname(config)# changeto context context1
hostname/context1(config)# dynamic-filter use-database
hostname/context1(config)# class-map dynamic-filter_snoop_class
hostname/context1(config-cmap)# match port udp eq domain
hostname/context1(config-cmap)# policy-map dynamic-filter_snoop_policy
hostname/context1(config-pmap)# class dynamic-filter_snoop_class
hostname/context1(config-pmap-c)# inspect dns preset_dns_map dynamic-filter-snoop
hostname/context1(config-pmap-c)# service-policy dynamic-filter_snoop_policy interface 
outside
hostname/context1(config-pmap-c)# dynamic-filter blacklist
hostname/context1(config-llist)# name bad1.example.com
hostname/context1(config-llist)# name bad2.example.com
hostname/context1(config-llist)# address 10.1.1.1 255.255.255.0
hostname/context1(config-llist)# dynamic-filter whitelist
hostname/context1(config-llist)# name good.example.com
hostname/context1(config-llist)# name great.example.com
hostname/context1(config-llist)# name awesome.example.com
hostname/context1(config-llist)# address 10.1.1.2 255.255.255.255
hostname/context1(config-llist)# access-list dynamic-filter_acl extended permit tcp any 
any eq 80
hostname/context1(config)# dynamic-filter enable interface outside classify-list 
dynamic-filter_acl
hostname/context1(config)# changeto context context2
hostname/context2(config)# dynamic-filter use-database
hostname/context2(config)# class-map dynamic-filter_snoop_class
hostname/context2(config-cmap)# match port udp eq domain
hostname/context2(config-cmap)# policy-map dynamic-filter_snoop_policy
hostname/context2(config-pmap)# class dynamic-filter_snoop_class
hostname/context2(config-pmap-c)# inspect dns preset_dns_map dynamic-filter-snoop
hostname/context2(config-pmap-c)# service-policy dynamic-filter_snoop_policy interface 
outside
hostname/context2(config-pmap-c)# dynamic-filter blacklist
hostname/context2(config-llist)# name bad1.example.com
hostname/context2(config-llist)# name bad2.example.com
hostname/context2(config-llist)# address 10.1.1.1 255.255.255.0
hostname/context2(config-llist)# dynamic-filter whitelist
hostname/context2(config-llist)# name good.example.com
hostname/context2(config-llist)# name great.example.com
hostname/context2(config-llist)# name awesome.example.com
hostname/context2(config-llist)# address 10.1.1.2 255.255.255.255
hostname/context2(config-llist)# access-list dynamic-filter_acl extended permit tcp any 
any eq 80
hostname/context2(config)# dynamic-filter enable interface outside classify-list 
dynamic-filter_acl
Where to Go Next

•To configure the syslog server, see Chapter 74, "Configuring Logging."

•To configure an access list to block traffic, see Chapter 11, "Adding an Extended Access List," and also see Chapter 35, "Permitting or Denying Network Access," for information about applying the access list to the interface.

•To shun connections, see the "Blocking Unwanted Connections" section on page 57-2.

Feature History for Botnet Traffic Filter

Table 2 lists the release history for this feature.

Table 2 Feature History for Botnet Traffic Filter

Feature Name

Releases

Feature Information

Botnet Traffic Filter

8.2(1)

This feature was introduced.