<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Botnet Report in Network Security</title>
    <link>https://community.cisco.com/t5/network-security/botnet-report/m-p/1653474#M604527</link>
    <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;Hi John,&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Would you please paste your report?&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Thats odd... However, I've never thrown reports on botnet....I knwo that the majority of the traffic is going to be on port 80, since the ASA what blocks is the malicious sites based on Ironport. I have no idea why you are seeing ports other than 80....&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Anyway, please paste the report, I would like to take a look at it.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Cheer&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Mike&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
    <pubDate>Sat, 19 Feb 2011 04:58:55 GMT</pubDate>
    <dc:creator>Maykol Rojas</dc:creator>
    <dc:date>2011-02-19T04:58:55Z</dc:date>
    <item>
      <title>Botnet Report</title>
      <link>https://community.cisco.com/t5/network-security/botnet-report/m-p/1653473#M604526</link>
      <description>&lt;P&gt;I have recently setup the Botnet Traffic Filter on my ASA 5510.&amp;nbsp; Today my report showed 1 connection logged to tcp &amp;gt;8192.&amp;nbsp; My question is how do I find the associated ip's that go along with that particular entry.&amp;nbsp; When I look at top infected host none of them show any port other than port 80.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;If you need any further information please do not hesitate to ask.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;thanks in advance&lt;/P&gt;&lt;P&gt;John&lt;/P&gt;</description>
      <pubDate>Tue, 26 Mar 2019 00:45:48 GMT</pubDate>
      <guid>https://community.cisco.com/t5/network-security/botnet-report/m-p/1653473#M604526</guid>
      <dc:creator>John Johnson</dc:creator>
      <dc:date>2019-03-26T00:45:48Z</dc:date>
    </item>
    <item>
      <title>Re: Botnet Report</title>
      <link>https://community.cisco.com/t5/network-security/botnet-report/m-p/1653474#M604527</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;P&gt;Hi John,&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Would you please paste your report?&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Thats odd... However, I've never thrown reports on botnet....I knwo that the majority of the traffic is going to be on port 80, since the ASA what blocks is the malicious sites based on Ironport. I have no idea why you are seeing ports other than 80....&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Anyway, please paste the report, I would like to take a look at it.&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Cheer&lt;/P&gt;&lt;P&gt;&lt;/P&gt;&lt;P&gt;Mike&lt;/P&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Sat, 19 Feb 2011 04:58:55 GMT</pubDate>
      <guid>https://community.cisco.com/t5/network-security/botnet-report/m-p/1653474#M604527</guid>
      <dc:creator>Maykol Rojas</dc:creator>
      <dc:date>2011-02-19T04:58:55Z</dc:date>
    </item>
  </channel>
</rss>

