427 Botnet fm qxd

www.syngress.com
IRC and Botnets • Chapter 8
291
427_Botnet_08.qxd 1/8/07 4:10 PM Page 291

---

The Format of the IRC Report
In this section we will look at a brief overview of the IRC report. First let’s
talk about the structure of the IRC report and then take a look at a few
benign human chat groups so that we know what normal looks like. Our goal
here is to explain some of the statistics and the overall layout of the report.
The basic report format consists of a timestamp of when the report was
made, followed by a short section of global statistics (see the following), and
two bigger sections on channel statistics and host statistics.
irc summarization at: Wed Sep 27 09:08:12 PDT 2006
###################################################
global stats:
# of sample files: 1098
# of irc hosts (servers and non-servers): 161
# of irc servers: 39
# of unique channels: 74
###################################################
channel stats:
channels sorted by wormy (evil) hosts
channels sorted by max messages
channels with associated host IPs and host stats
channels with no PRIVMSGS, only JOINS
channels with any wormy hosts
chanmap table
###################################################
irc host stats:
servers sorted by max messages most
hosts with JOINS but no PRIVMSGS
hosts with any sign of worminess
Various subreports are found under channel stats and host stats. We will
only look at the first few channel subreports that are by far the most impor-
tant parts of the IRC report. We informally call the first channel subreport
the 
evil channel report
.This report is officially called 
channels sorted by wormy
(evil) hosts
. We define an evil channel as a channel that might have a number
of scanning clients in it.The second subreport will be called the 
channel max
message report.
It is labeled 
channels sorted by max messages
above. Channels are
sorted in that subreport by the maximum IRC messages seen over the time