Botnet Report

[John Johnson]

I have recently setup the Botnet Traffic Filter on my ASA 5510.  Today my report showed 1 connection logged to tcp >8192.  My question is how do I find the associated ip's that go along with that particular entry.  When I look at top infected host none of them show any port other than port 80.

If you need any further information please do not hesitate to ask.

thanks in advance

John

[Maykol Rojas]

Hi John,

Would you please paste your report?

Thats odd... However, I've never thrown reports on botnet....I knwo that the majority of the traffic is going to be on port 80, since the ASA what blocks is the malicious sites based on Ironport. I have no idea why you are seeing ports other than 80....

Anyway, please paste the report, I would like to take a look at it.

Cheer

Mike