Cisco Systems ASA 5580 Manual De Usuario

When the infected host starts a connection to the IP address of the malware site, then the ASA sends 
a syslog message informing you of the suspicious activity and optionally drops the traffic if you 
configured the ASA to do so.

In some cases, the IP address itself is supplied in the dynamic database, and the Botnet Traffic Filter 
logs or drops any traffic to that IP address without having to inspect DNS requests.

The database files are downloaded from the Cisco update server, and then stored in running memory; 
they are not stored in flash memory. Be sure to identify a DNS server for the ASA so that it can access 
the Cisco update server URL. In multiple context mode, the system downloads the database for all 
contexts using the admin context interface; be sure to identify a DNS server in the admin context.

If you need to delete the database, use the dynamic-filter database purge command instead. Be sure to 
first disable use of the database by entering the no dynamic-filter use-database command.

To filter on the domain names in the dynamic database, you need to enable DNS packet inspection with 
Botnet Traffic Filter snooping; the ASA looks inside the DNS packets for the domain name and 
associated IP address.

The dynamic database includes the following types of addresses:

Ads—These are advertising networks that deliver banner ads, interstitials, rich media ads, pop-ups, 
and pop-unders for websites, spyware and adware. Some of these networks send ad-oriented HTML 
emails and email verification services.

Data Tracking—These are sources associated with companies and websites that offer data tracking 
and metrics services to websites and other online entities. Some of these also run small advertising 
networks.

Spyware—These are sources that distribute spyware, adware, greyware, and other potentially 
unwanted advertising software. Some of these also run exploits to install such software.

Malware—These are sources that use various exploits to deliver adware, spyware and other malware 
to victim computers. Some of these are associated with rogue online vendors and distributors of 
dialers which deceptively call premium-rate phone numbers.

Adult—These are sources associated with adult networks/services offering web hosting for adult 
content, advertising, content aggregation, registration & billing, and age verification. These may be 
tied to distribution of adware, spyware, and dialers.

Bot and Threat Networks—These are rogue systems that control infected computers. They are either 
systems hosted on threat networks or systems that are part of the botnet itself.

You can manually enter domain names or IP addresses (host or subnet) that you want to tag as bad names 
in a blacklist. Static blacklist entries are always designated with a Very High threat level. You can also 
enter names or IP addresses in a whitelist, so that names or addresses that appear on both the dynamic 
blacklist and the whitelist are identified only as whitelist addresses in syslog messages and reports. Note 
that you see syslog messages for whitelisted addresses even if the address is not also in the dynamic 
blacklist.