Cisco ASA 5505 Configuration Manual page 1093

Chapter 50 Configuring the Botnet Traffic Filter
Command
Monitoring > Botnet Traffic Filter > DNS
Snooping
Monitoring > Botnet Traffic Filter > Dynamic
Database
Monitoring > Botnet Traffic Filter > ASP Table
Hits
Where to Go Next
•
•
Feature History for the Botnet Traffic Filter
Table 50-2
backwards-compatible with multiple platform releases, so the specific ASDM release in which support
was added is not listed.
Table 50-2 Feature History for the Botnet Traffic Filter
Feature Name
Botnet Traffic Filter
Automatic blocking, and blacklist category and
threat level reporting.
OL-20339-01
Purpose
Shows the Botnet Traffic Filter DNS snooping actual IP addresses and
names. All inspected DNS data is included in this output, and not just
matching names in the blacklist. DNS data from static entries are not
included.
Shows information about the dynamic database, including when the
dynamic database was last downloaded, the version of the database, how
many entries the database contains, and 10 sample entries.
Shows the Botnet Traffic Filter rules that are installed in the accelerated
security path.
To configure the syslog server, see
To block connections with an access rule, see
lists each feature change and the platform release in which it was implemented. ASDM is
Platform
Releases
8.2(1)
8.2(2)
Chapter 71, "Configuring Logging."
Chapter 30, "Configuring Access Rules."
Feature Information
This feature was introduced.
The Botnet Traffic Filter now supports automatic blocking
of blacklisted traffic based on the threat level. You can also
view the category and threat level of malware sites in
statistics and reports.
The 1 hour timeout for reports for top hosts was removed;
there is now no timeout.
The following screens were introduced or modified:
Configuration > Firewall > Botnet Traffic Filter > Traffic
Settings, and Monitoring > Botnet Traffic Filter > Infected
Hosts.
Cisco ASA 5500 Series Configuration Guide using ASDM
Where to Go Next
50-15