427 Botnet fm qxd

www.syngress.com
192
Chapter 5 • Botnet Detection: Tools and Techniques
427_Botnet_05.qxd 1/9/07 9:59 AM Page 192

---

turn it off. Even if you have no plans to use its port-filtering capabilities, it
provides a valuable record for understanding botnet activity.The firewall can
be controlled by the group policy settings in 
Computer Configuration |
Administrative Templates | Network | Network Connections |
Windows Firewall
.There are some exceptions that you should configure,
but the details of configuring the policy settings are beyond the scope of this
book. A nice write-up on configuring the firewall-related policy settings is
located here: www.microsoft.com/technet/prodtechnol/winxppro/
maintain/mangxpsp2/mngwfw.mspx.
The policy we are interested in is the Windows Firewall: Allow logging
policy.You should select logging for both logging dropped packets and log-
ging successful connections. It lets you set the log filename and the maximum
size of the log. A good size is about 4096K. Windows keeps two generations
of the log file and more if you have system restore turned on.
You would examine the firewall log during analysis and not during the
quick forensics step.Table 5.2 shows a few sample entries from Windows fire-
wall log. For illustration we’ve included at least one of each type of action
that the firewall records (Open, Closed, Drop, and Open-Inbound). We rec-
ommend that you use a log-parsing tool like Log Parser to assist in analyzing
the information, but in case you want to try analyzing the data without it, the
actual firewall log is a text file. With a little modification you can drop the
data into Excel and get some quick-and-dirty answers.
Table 5.2
Sample Entries from Windows Firewall Log
#Version: 1.5
#Software: Microsoft Windows Firewall
#Time Format: Local
#Fields: date time action protocol src-ip dst-ip src-port dst-port size
tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path
2006-11-13 18:43:47 DROP UDP 131.252.118.176 255.255.255.255 68 67 328 - - -
- - - - RECEIVE
2006-11-13 18:44:24 DROP UDP 131.252.118.4 239.255.255.250 8008 1900 129 - -
- - - - - RECEIVE
2006-11-13 18:44:37 OPEN UDP 131.252.116.92 131.252.120.128 1026 53 - - - -
- - - - -