427 Botnet fm qxd

www.syngress.com
Advanced Ourmon Techniques • Chapter 9
315
427_Botnet_09.qxd 1/8/07 4:45 PM Page 315

---

2. You then reboot ourmon and it checks your trigger syntax. It fails if
you made a mistake. (See /var/log/messages for errors or check the
console display.)
3. Every 30 seconds, ourmon now checks the trigger threshold.
4. If the trigger threshold is exceeded, ourmon creates a unique file-
name for the trigger that does not conflict with other triggers or
trigger files produced by the same trigger.
5. Ourmon then begins to store packets until either the packet count is
exhausted or the trigger threshold is crossed in the opposite direction
(going down). For example, packets will no longer be stored if the
trigger is set at 50 hosts for the worm trigger and the threshold is
crossed from 60 hosts to 40 hosts during a sample period.
In general, packets are stored based on a per-trigger filter specification. For
example, the UDP trigger we mention in a moment is per IP address, and
only UDP packets involving that IP address will be stored. Some triggers have
a trigger filter specification, and some don’t. For the kinds of triggers we talk
about here, the trigger filter specifications are not user programmable.
(However, there is a form of trigger that we are ignoring here that is associ-
ated with the BPF user graph feature and is programmable by the user. See
info.html for more information; we won’t cover it here.) 
When ourmon decides to store packets, it opens a file in the specified
directory with the filename syntax as follows:
trigger_name.timestamp.dmp.
There are two things to note in general about the stored packets. One is
that the packets will not be any bigger than the so-called snap length, which
is passed into the ourmon probe when it is booted. Currently that value is
256, which will catch a great deal of Layer 7 payload information (IRC infor-
mation in particular). Second, it is always possible that a trigger will fail to
capture any packets.This is because triggers get turned on only after one basic
probe cycle of 30 seconds.There might simply be no packets after the trigger
is turned on, so the packet capture dump file might have no content for the
obvious reason that no packets are arriving.