427 Botnet fm qxd

www.syngress.com
298
Chapter 8 • IRC and Botnets
427_Botnet_08.qxd 1/8/07 4:10 PM Page 298

---

Let’s look at 
x0#
and its host breakdown to begin to see why we can
claim it is a botnet (see Table 8.4).
Table 8.4
Channel x0# Hosts
Ip_src
Tmsgs
Maxworm Server? Sport/dport First_ts
192.168.1.1
42
100
H
4779/504
Tue_Sep_26_
00:48:21
192.168.2.3
56
99
H
3962/504
Tue_Sep_26_
03:45:04
192.168.14.12
70
99
H
4058/504
Tue_Sep_26_
08:47:34
192.168.27.33
75
99
H
1048/504
Tue_Sep_26_
08:50:04
192.168.37.100
18
99
H
1756/504
Tue_Sep_26_
14:34:36
10.250.43.222
196
5
S
504/4931
Tue_Sep_26_
00:48:21
10.37.2.4
14
0
S
504/3962
Tue_Sep_26_
08:48:36
10.240.1.2
33
0
S
504/1046
Tue_Sep_26_
08:47:34
10.0.0.1
15
7
S
504/1756
Tue_Sep_26_
14:35:36
Let’s also look at the summarized TCP port report for one of the local IP
addresses, which we get from the Web page syndump summarization:
192.168.1.1
WORM
IPw
(
0: 99:100:)
0: (143/2) (232:0:0) (232:4)
dns: somelocalbox.someuniversity.edu
:1065: Tue_Sep_26_00:00:42_PDT_2006: Tue_Sep_26_09:01:04_PDT_2006:
portuples[4]: [1433, 128105][5900, 119368][80, 550][504, 79]
What we can observe here is that all the local hosts (net 192.168) have
high work weights, and when we look at the port report ports we see that is
because the hosts in question (like 192.168.1.1) are scanning on ports 1433
and 5900, and scanned into our darknet as well (P in application flags). A little