427 Botnet fm qxd

www.syngress.com
IRC and Botnets • Chapter 8
293
427_Botnet_08.qxd 1/8/07 4:10 PM Page 293

---

sent 4275 messages, which is more than the second channel, Rubyonrails.The
number of PRIVMSGS is high, which can be taken as a sign that the channel
is probably truly occupied by people, compared to a channel that has no
PRIVMSGS and possibly only JOIN messages.The various columns have
these meanings:
■
Msgs
Total number of IRC messages for all hosts in that channel
■
Joins
Total number of JOINS 
■
Privmsgs
Total number of PRIVMSGS
■
Ipcount
Total number of IP hosts in the channel (including IRC
servers)
■
Wormyhosts
Total number of hosts deemed to be scanners
according to the TCP work weight.
■
Evil?
E means that there are at least two scanners, and e (lowercase)
means at least one; this flag is both a joke and an attempt to alert the
analyst to potential trouble.
N
OTE
Why is the Evil flag a joke? On April 1, 2003, Steve Bellovin, a well-
known security expert, posted IETF RFC 3514. He proposed that every
IP packet should have a flag set if it was evil. In other words, hackers
with evil intentions should mark their packets so that firewalls could
drop them. Unfortunately, this idea remains unimplemented.
This subreport is important for any number of reasons. First and foremost
it gives you a list of the IRC channels within your network.Take a good hard
look at that list.You want to compare today’s summarization with previous
days to see if you have new channels (possibly new channels with strange
names). Knowledge of your IRC channels is important because it can lead
you to detect botnets or unknown hacker chat channels on your own, sans
fancy expert knowledge. IRC channels that lack PRIVMSGS are also inter-
esting.This means the channel is not being used for chat. It is possible that it