what is the difference between Botnet report and DNS Sinkholing?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

what is the difference between Botnet report and DNS Sinkholing?

L4 Transporter

HI All,


what is the difference between Botnet report and DNS Sinkholing? we can see the botnet reports to identify the infected machine by identifing the connection requests to the malicius URL repetedly, please help me to understand this.


Thank you,



Cyber Elite
Cyber Elite

My understanding of sinkholing is that when it's active you are actively inspecting the traffic and then setting the DNS record to send it to another device, often times stopping the traffic all together. The botnet report is simply telling you that the PA has identified the devices going to the malicious links but doesn't actively take steps to block it.


The Botnet Report is an additional source of information for an administrator where the firewall makes a summary of 'suspicious' traffic that did not necessarily get blocked but could be an indication of a dormant infection by adding up all the parts


dns sinkhole is an interception method that injects spoofed replies in a DNS lookup so the client gets a false IP address to a domain name and when it tries to connect, the session is 'sinkholed'

This prevents (potentially infected) clients from reaching a malicious host and also makes the source more visible, in case the dns query is routed through an internal DNS server

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

L7 Applicator

As Reaper notes, the sinkhole is a great add on to the bot net report.  With the report we frequently have to do some detective work with the logs can cross references to get the actual source address of the infected machines.


With a sinkhole you not only block the traffic, but you get a solid and direct host address to go and clean up.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!