topic Botnet database updates in Network Security

Botnet database updates

Mike Brooks — Mon, 11 Mar 2019 21:50:09 GMT

In ASDM under monitoring, Botnet Traffic Filter, Updater Client I noticed the following:

Last update attempted at 16:32:15 EDT Oct 13 2011,

with result: Failed to read downloaded update file

Next update is in 00:00:00

Database file version is '1317880142' fetched at 02:19:29 EDT Oct 6 2011, size: 2097150

Can anybody tell me how to get this to update to current version of the database?

If I click on Fetch Botnet Database it tells me update already pending.

Enable Botnet Updater Client and Use Botnet data dynamically downloaded from updater server are both enabled.

I'm running on an ASA5510 with v8.2(5) and Botnet traffic filter is licensed.

Thanks,

Mike

Botnet database updates

Maykol Rojas — Mon, 14 Nov 2011 19:39:18 GMT

Mike,

From the command line, you can do dynamic-filter database fetch, and that will try to pull the databse directly from Cisco. Make sure that from the firewall you can ping update-manifests.ironport.com, if you can ping it, there sould not be any problem trying to download it.

Mike Rojas

Botnet database updates

Mike Brooks — Mon, 14 Nov 2011 19:48:42 GMT

I can ping update-manifests.ironport.com from the firewall. When I do dynamic-filter database fetch the firewall responds with 'INFO: Dynamic Filter: update already pending' as noted above.

Thanks,

Mike

Botnet database updates

Maykol Rojas — Mon, 14 Nov 2011 20:02:40 GMT

One quick question, is the botnet blocking sites at this point? Can you try to remove the dynamic filter commands and put them back again?

Mike

Botnet database updates

Mike Brooks — Mon, 14 Nov 2011 20:05:29 GMT

Yes it is still blocking sites. I already tried removing the dynamic filter commands and putting them back in earlier today.

Mike

Botnet database updates

Maykol Rojas — Mon, 14 Nov 2011 20:07:48 GMT

Can you run the following command?

debug dynamic-filter updater-client

Mike

Botnet database updates

Mike Brooks — Mon, 14 Nov 2011 20:11:11 GMT

Ok I have entered that command. So how do I collect/view the output from it?

Mike

Botnet database updates

Maykol Rojas — Mon, 14 Nov 2011 20:17:47 GMT

You should see the ASA trying to connect to update-manifests.ironport.com. That will indicate us if the Firewall has any problems trying to reach the updater server.

Do you have any new proxy server setup on the network, anything that may have changed?

Mike

Botnet database updates

Mike Brooks — Mon, 14 Nov 2011 20:32:11 GMT

I don't see anything related to update-manifests.ironport.com in the log. As a matter of fact we changed internet services on the afternoon of Oct. 13 which is the date noted in my original question. Now, nothing changed in the ASA during the internet service change with the exception of DNS server addresses. We kept the same block of public ip addresses.

Mike

Botnet database updates

Maykol Rojas — Mon, 14 Nov 2011 20:37:23 GMT

Alright,

Can you let the debug on, remove and put the dynamic filter commands to see what we get on the logs once you do it? We may need to create some captures on the outside interface going to the updater website.

Mike.

Re: Botnet database updates

Mike Brooks — Mon, 14 Nov 2011 21:10:32 GMT

Ok took out the commands and added them back via cli. Debug was left on. Received a lot of output on the terminal session but I'm not sure it's related. Captured all I could from the telnet app buffer and saved to a txt file. Uploaded it as an attachment.

Mike

Re: Botnet database updates

Maykol Rojas — Mon, 14 Nov 2011 21:41:30 GMT

Ok,

How much RAM do you have on the device?

Mike

Re: Botnet database updates

Mike Brooks — Mon, 14 Nov 2011 21:46:23 GMT

256 MB

Mike

Re: Botnet database updates

Maykol Rojas — Mon, 14 Nov 2011 21:52:18 GMT

Is it running out of RAM memory? (show mem)

Mike

Re: Botnet database updates

Mike Brooks — Mon, 14 Nov 2011 21:54:50 GMT

Free memory: 68516248 bytes (26%)

Used memory: 199919208 bytes (74%)

------------- ----------------

Total memory: 268435456 bytes (100%)

Mike

Re: Botnet database updates

Maykol Rojas — Mon, 14 Nov 2011 21:59:02 GMT

Alright, Do you have the Firewall on failover? Is there a way you can run in the other one and reload the current one? If not, have you tried to reload the ASA?

Ive seen a couple of cases where the low memory available can cause this, and some others where the case was resolved by reloading the unit.

Let me know.

Mike

Re: Botnet database updates

Mike Brooks — Mon, 14 Nov 2011 22:01:56 GMT

I'm coming in early tomorrow morning and was already planning to reload it just to see if that would help. I will let you know how it goes after that. I also have a kit to upgrade Ram to 1GB but won't have time to install that tomorrow. Thanks for you help.

Mike

Re: Botnet database updates

Maykol Rojas — Mon, 14 Nov 2011 22:33:11 GMT

Alright, keep me posted.

Mike

Re: Botnet database updates

Mike Brooks — Tue, 15 Nov 2011 13:19:04 GMT

Reloading the ASA did the trick. It is now updating again.

Thanks,

Mike

Botnet database updates

Maykol Rojas — Wed, 16 Nov 2011 03:57:39 GMT

Nice, Glad to hear it worked Mike.

Mike.