427 Botnet fm qxd

www.syngress.com
Ourmon: Anomaly Detection Tools • Chapter 7
283
Frequently Asked Questions
The following Frequently Asked Questions, answered by the authors of this
book, are designed to both measure your understanding of the concepts pre-
sented in this chapter and to assist you with real-life implementation of these
concepts. To have your questions about this chapter answered by the author,
browse to 
www.syngress.com/solutions
and click on the 
“Ask the Author”
form. 
427_Bot_07.qxd 1/8/07 3:40 PM Page 283

---

427_Bot_07.qxd 1/8/07 3:40 PM Page 284

---

IRC and Botnets
Solutions in this chapter:
■
Understanding the IRC Protocol
■
Ourmon’s RRDTOOL Statistics and IRC
Reports
■
Detecting an IRC Client Botnet
■
Detecting an IRC Botnet Server 
Chapter 8
285
Summary
Solutions Fast Track
Frequently Asked Questions
427_Botnet_08.qxd 1/8/07 4:10 PM Page 285

---

Introduction 
In this chapter we look at ourmon’s IRC facility and see how it can be used
to detect botnet client meshes and botnet server meshes as well as the occa-
sional compromised host that may be hosting an IRC-related hacker channel.
We will refer to the two case histories introduced in Chapter 6: “Case Study
#3: Bot Client” and “Case Study #4: Bot Server.” We will also look at a few
other cases of malware that could be bot-related as well. Before we get started
on bot clients and servers, though, we want to first talk about the IRC pro-
tocol itself and then take a brief look at ourmon’s IRC related statistics.This
will help you navigate ourmon’s IRC Web page and reports.