Using Botnet Filter Diagnostics

The Security Services > Botnet Filter page has a Diagnostics section containing:

•	Show Resolved Locations

•	Botnet Cache Statistics

•	Check BOTNET Server Lookup

Show Resolved Locations

When you click on the Show Resolved Locations button, a table of resolved IP addresses displays with this information:

•

Index

•	IP Address

•	Is Botnet? (whether the location is a Botnet command and control server)

•

Domain

Botnet Cache Statistics

The Geo-IP Cache Statistics table contains this information:

•	Location Server IP

•	Resolved Entries

•	Unresolved Entries

•	Current Entry Count

•	Max. Entry Count

•	Location Map Count

Check BOTNET Server Lookup

The Botnet Filter also provides the ability to look up IP addresses to determine:

•	Domain name or IP address

•	Country of origin and whether the server is classified as a Botnet server

NOTE: The Botnet Server Lookup tool can also be accessed from the System > Diagnostics page.

To look up a Botnet server, perform the following steps:

1	Scroll to the Check BOTNET Server Lookup section at the bottom of the Security Services > Botnet Filter page.

2	Enter the IP address in the Lookup IP field,

3	Click Go. Details on the IP address are displayed below the Result heading.

NOTE: If you believe that a certain address is marked as a botnet incorrectly, or if you believe an address should be marked as a botnet, report this issue at the SonicWALL Botnet IP Status Lookup tool by either clicking on the link in the Note at the bottom of the Security Services > Botnet Filter page or going to: http://botnet.global.sonicwall.com/.