Using Botnet Filter Diagnostics

The Security Services > Botnet Filter page has a Diagnostics section containing:

•
Show Resolved Locations
•
Botnet Cache Statistics
•
Check Botnet Server Lookup

Show Resolved Locations

When you click on the Show Resolved Locations button, a table of resolved IP addresses displays with this information:

•
Index
•
IP Address
•
Is Botnet? (whether the location is a Botnet command and control server)
•
Domain

Botnet Cache Statistics

The Geo-IP Cache Statistics table contains this information:

•
Location Server IP
•
Resolved Entries
•
Unresolved Entries
•
Current Entry Count
•
Max. Entry Count
•
Location Map Count

Check Botnet Server Lookup

The Botnet Filter also provides the ability to look up IP addresses to determine:

•
Domain name or IP address
•
Country of origin and whether the server is classified as a Botnet server
* 
NOTE: The Botnet Server Lookup tool can also be accessed from the System > Diagnostics page.
To look up a Botnet server, perform the following steps:
1
Scroll to the Check BOTNET Server Lookup section at the bottom of the Security Services > Botnet Filter page.

2
Enter the IP address in the Lookup IP field,
3
Click Go. Details on the IP address are displayed below the Result heading.

* 
NOTE: If you believe that a certain address is marked as a botnet incorrectly, or if you believe an address should be marked as a botnet, report this issue at the SonicWALL Botnet IP Status Lookup tool by either clicking on the link in the Note at the bottom of the Security Services > Botnet Filter page or going to: http://botnet.global.sonicwall.com/.