427 Botnet fm qxd

www.syngress.com
310
Chapter 8 • IRC and Botnets
427_Botnet_08.qxd 1/8/07 4:10 PM Page 310

---

Detecting an IRC Botnet Server 
High and anomalous counts in the RRDTOOL IRC statistics graph
could indicate the presence of a local botnet server.
Botnet servers typically have unusual host counts.
Botnet servers could have unusual counts for remote IP destinations
(L3D).
Botnet servers might appear in the evil channel sort.This is due to
connection failures by remote exploited hosts.
Q: 
Why is the measurement for the TCP work weight weaker here than in
the TCP port report? For example, it does not take into account some
number of SYNS per second as is the case with the normal work weight.
A: 
The reason is that we are looking at things from a parallel point of view.
We want to see if there are many scanning hosts in a channel. So, for
example, if you see a channel with 10 hosts and nine hosts having a sum-
marized work weight of 99, you can take that as meaning the entire
channel is infected. On the other hand, one host out of 10 scanning might
not mean much.You can go and examine the TCP port reports, either
individual logged versions or the daily summarization, and see if you can
learn anything more. If you can’t find the host, that means the host had a
trivial work weight problem.You can probably ignore it.
Q: 
In the section on detecting IRC bot servers, why did you mention the
L3D statistic?
www.syngress.com
IRC and Botnets • Chapter 8
311
Frequently Asked Questions
The following Frequently Asked Questions, answered by the authors of this
book, are designed to both measure your understanding of the concepts pre-
sented 
in 
this chapter and to assist you with real-life implementation of these concepts.
To have your questions about this chapter answered by the author, browse to