malicious domain

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

malicious domain

L4 Transporter

Hi,

What is the benefit if we use sinkhole instead of just blocking malicious domain resolving

Thanks

1 accepted solution

Accepted Solutions

block will simply block the connection, end of story

 

sinkhole will feed the client a false IP address which can help track which hosts are infected:

 

Because malicious DNS requests will typically come from the company bind/ActiveDir DNS server instead of the clients directly you will not know which client is requesting malicious domain info

with sinkhole, the infected client will try to connect to the sinkhole IP and you'll know exactly which clients are infected

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

View solution in original post

5 REPLIES 5

L3 Networker
Hi Simsim,
If the malicious URL is resolved in to an ipaddress , session might be created and your public IP might get blacklisted

Hi,

There are two options 

1) block (default )

2) sinkhole 

My question is why we don't we go for block instead of sinkhole 

Thanks

 

if u block the URL will be blocked ( but resolve to an IP address)

sinkhole - will resolve to the specified address.

block will simply block the connection, end of story

 

sinkhole will feed the client a false IP address which can help track which hosts are infected:

 

Because malicious DNS requests will typically come from the company bind/ActiveDir DNS server instead of the clients directly you will not know which client is requesting malicious domain info

with sinkhole, the infected client will try to connect to the sinkhole IP and you'll know exactly which clients are infected

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

As @reaper mentioned it is good to identify infected client.

If your environment is set up correctly and traffic from clients to servers passes through firewall then you can identify client even with block activity.

But too many environments have clients and DNS in same zone so firewall sees only requests sent by DNS server but not clients.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011
  • 1 accepted solution
  • 3260 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!