Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1424 / 2164

1-18
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the Botnet Traffic Filter
Monitoring the Botnet Traffic Filter
Examples
The following is sample output from the show dynamic-filter statistics command:
hostname# show dynamic-filter statistics
Enabled on interface outside
Total conns classified 11, ingress 11, egress 0
Total whitelist classified 0, ingress 0, egress 0
Total greylist classified 0, dropped 0, ingress 0, egress 0
Total blacklist classified 11, dropped 5, ingress 11, egress 0
Enabled on interface inside
Total conns classified 1182, ingress 1182, egress 0
Total whitelist classified 3, ingress 3, egress 0
Total greylist classified 0, dropped 0, ingress 0, egress 0
Total blacklist classified 1179, dropped 1000, ingress 1179, egress 0
The following is sample output from the show dynamic-filter reports top malware-sites command:
hostname# show dynamic-filter reports top malware-sites
Site Connections logged dropped Threat Level Category
--------------------------------------------------------------------------------------
bad1.example.com (10.67.22.34) 11 0 2 Botnet
bad2.example.com (209.165.200.225) 8 8 3 Virus
bad1.cisco.example(10.131.36.158) 6 6 3 Virus
bad2.cisco.example(209.165.201.1) 2 2 3 Trojan
show dynamic-filter reports infected-hosts
{ max-connections | latest-active |
highest-threat | subnet ip_address netmask
| all }
Generates reports about infected hosts. These reports contain detailed
history about infected hosts, showing the correlation between infected
hosts, visited malware sites, and malware ports. The
max-connections
keyword shows the 20 infected hosts with the most number of
connections. The
latest-active keyword shows the 20 hosts with the most
recent activity. The highest-threat keyword shows the 20 hosts that
connected to the malware sites with the highest threat level. The subnet
keyword shows up to 20 hosts within the specified subnet. The all
keyword shows all buffered infected-hosts information. This display
might include thousands of entries. You might want to use ASDM to
generate a PDF file instead of using the CLI.
To clear the report data, enter the clear dynamic-filter reports
infected-hosts command.
show dynamic-filter updater-client
Shows information about the updater server, including the server IP
address, the next time the ASA will connect with the server, and the
database version last installed.
show dynamic-filter dns-snoop [ detail ]
Shows the Botnet Traffic Filter DNS snooping summary, or with the
detail keyword, the actual IP addresses and names. All inspected DNS
data is included in this output, and not just matching names in the
blacklist. DNS data from static entries are not included.
To clear the DNS snooping data, enter the clear dynamic-filter
dns-snoop command.
show dynamic-filter data
Shows information about the dynamic database, including when the
dynamic database was last downloaded, the version of the database, how
many entries the database contains, and 10 sample entries.
show asp table dynamic-filter [ hits ]
Shows the Botnet Traffic Filter rules that are installed in the accelerated
security path.
Command Purpose