tracing malware

[mickyq]

I have been informed by my ISP that a botnet has been detected and the ip address is the Global PAT address. how do i trace the source ip? 

[Karsten Iwen · Accepted solution]

Probably it's not possible any more. What do you need:

1. An exact timestamp from the event and if possible the destination-address/port.
2. Your firewall-log showing which PC was communicating at that moment with the destination.
3. If you are using DHCP, you also need a DHCP-log to see which internal system was using that IP at that time.

Perhaps it's time to migrate to ASA with FirePOWER.

[mickyq]

Thanks Karsten

I'll put that on my Christmas wish list :-)