what is the difference between Botnet report and DNS Sinkholing? we can see the botnet reports to identify the infected machine by identifing the connection requests to the malicius URL repetedly, please help me to understand this.
My understanding of sinkholing is that when it's active you are actively inspecting the traffic and then setting the DNS record to send it to another device, often times stopping the traffic all together. The botnet report is simply telling you that the PA has identified the devices going to the malicious links but doesn't actively take steps to block it.
The Botnet Report is an additional source of information for an administrator where the firewall makes a summary of 'suspicious' traffic that did not necessarily get blocked but could be an indication of a dormant infection by adding up all the parts
dns sinkhole is an interception method that injects spoofed replies in a DNS lookup so the client gets a false IP address to a domain name and when it tries to connect, the session is 'sinkholed'
This prevents (potentially infected) clients from reaching a malicious host and also makes the source more visible, in case the dns query is routed through an internal DNS server
As Reaper notes, the sinkhole is a great add on to the bot net report. With the report we frequently have to do some detective work with the logs can cross references to get the actual source address of the infected machines.
With a sinkhole you not only block the traffic, but you get a solid and direct host address to go and clean up.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!