427 Botnet fm qxd

T
IP
See http://en.wikipedia.org/wiki/Internet_Relay_Chat for a good dis-
cussion of both IRC and its history, although it doesn’t say much about
IRC’s dark side.
Our goal here is to not explain all the IRC protocol. Ourmon only cares
about a very small restricted set of IRC, and as a result that IRC subset is all
we intend to explain here. Also please note that we are talking about the low-
level IETF IRC protocol; we are not talking about IRC commands used in
any particular IRC client program.The four kinds of IRC protocol messages
ourmon understands are as follows:
■
JOINS
JOINS are used by an IRC client to log into a channel on a
server.The channel name and password are part of the JOIN message.
■
PINGS
PINGS are sent from a server to a client to discover if the
client is still interested in the channel and has not for example
crashed or gone away otherwise.Typically PINGS are sent in a peri-
odic fashion at some multiple of 30 seconds.
■
PONGS
See PINGS above. PONGS are returned from the client to
the server to show that it does not want to be logged out and still
exists.
■
PRIVMSG
A PRIVMSG contains both the channel name and data
sent to the channel name.The basic idea here is that the message (“hi
mom” or “scan using port 445”) should be sent to all the hosts in the
logical IRC channel.
JOINS and PRIVMSG messages contain the channel names, and ourmon
uses those messages along with the IP addresses in the IP header to construct
a list of channels with associated IP hosts (as IP addresses). Ourmon does not
look at the data part of the PRIVMSG. because our goal is only to construct
a network mesh, not look at user data. It also keeps track of PING and
PONG messages because they indicate basic IRC mesh connectivity. It is
possible for a client to send a JOIN message and not do PINGs and PONGS.
So in some cases a client could simply send a JOIN over and over again. In