427 Botnet fm qxd

www.syngress.com
258
Chapter 7 • Ourmon: Anomaly Detection Tools
427_Bot_07.qxd 1/8/07 3:40 PM Page 258

---

or hosts employing peer-to-peer protocols such as BitTorrent or
Gnutella will appear.These systems may be considered false positives
unless your local policy forbids peer-to-peer applications. We will talk
about this phenomenon more later in this chapter. Hardwired appli-
cation flags include:
■
B
BitTorrent protocol
■
G
Gnutella protocol
■
K
Kazaa protocol
■
M
Morpheus protocol (P2P, too)
■
P
Honeypot (darknet) violation
■
E
E-mail source port (e.g., port 25) seen
■
H
Web source port (e.g., port 80 or 443) seen
■
I
IRC messages seen
■
s
UDP only; indicates Spam for Internet Messenger (SPIM)
■
work
This is short for the 
TCP work weight
. We will talk more later
about the TCP work weight because it is very important. It varies
from 0 to 100 percent, and a high value means the host is sending all
control packets.This is often the case with a scanner. For example,
SYN packets used by clients to open a TCP conversation or
SYN+ACK packets used by servers as a response to a normal SYN
from a client are examples of control packets. So are FIN and
RESET packets. A 100-percent value means the host is only sending
control packets.TCP usually has some control packets and some data
packets in a balance or preferably with more data packets than con-
trol packets. In summary, the work weight is a measure of 
control
versus data efficiency
. Low values, including 0 percent, are common,
even with hosts using P2P protocols like BitTorrent. An FTP client
transferring a large file would typically have a value of zero.
■
SA/S
SA/S stands for 
SYN+ACK packets divided by SYN packets
.
Like the TCP work weight, SA/S is expressed as a percentage, from 0
to 100 percent.The basic idea is that during the 30-second sample
period, the number of SYN+ACK flag packets sent by the IP host is