what is the difference between Botnet report and DNS Sinkholing?

[Gururaj]

HI All,

what is the difference between Botnet report and DNS Sinkholing? we can see the botnet reports to identify the infected machine by identifing the connection requests to the malicius URL repetedly, please help me to understand this.

Thank you,

Guru

[BPry]

My understanding of sinkholing is that when it's active you are actively inspecting the traffic and then setting the DNS record to send it to another device, often times stopping the traffic all together. The botnet report is simply telling you that the PA has identified the devices going to the malicious links but doesn't actively take steps to block it.

[reaper]

The Botnet Report is an additional source of information for an administrator where the firewall makes a summary of 'suspicious' traffic that did not necessarily get blocked but could be an indication of a dormant infection by adding up all the parts

dns sinkhole is an interception method that injects spoofed replies in a DNS lookup so the client gets a false IP address to a domain name and when it tries to connect, the session is 'sinkholed'

This prevents (potentially infected) clients from reaching a malicious host and also makes the source more visible, in case the dns query is routed through an internal DNS server

[pulukas]

As Reaper notes, the sinkhole is a great add on to the bot net report.  With the report we frequently have to do some detective work with the logs can cross references to get the actual source address of the infected machines.

With a sinkhole you not only block the traffic, but you get a solid and direct host address to go and clean up.