427 Botnet fm qxd

www.syngress.com
270
Chapter 7 • Ourmon: Anomaly Detection Tools
427_Bot_07.qxd 1/8/07 3:40 PM Page 270

---

■
IP address.
■
Flags; the flags field from all the 30-second instances are 
OR
ed with a
logical 
OR.
■
App flags; application flags from all instances are 
OR
ed together.
■
Work weights; the TCP work weight is presented as a (minimum,
average, maximum).The average is computed over all the 30-second
instances. Minimum and maximum simply represent the minimum
and maximum seen over all instances
■
The SA/S field is an average across all instances (as are all the
remaining fields on this line).
■
The L3D/L4D fields give the number of unique IP address and
unique TCP destination ports as averaged across instances.
■
SYN/FIN/RESET; SYN, FIN, and RESET counts are averaged
across all instances.
■
Snt/rcv; total packets sent and received are shown as averages.
So for line 1, what can we say about our bot client? The application flags
field with the value of 
I
for IRC and 
P
for darknet means that the host used
IRC and scanned into the darknet.The work weight average is high. And in
general the box is scanning with SYNS aimed at unique IP addresses.
For line 2, we have the following field:
■
DNS name; this is the resolved DNS name. DNS names don’t always
resolve, of course, but given that the report in this case is computed
over hours, we can take the time to try to resolve them.
For line 3, we have these fields:
■
Instance count is the count of separate port report files in which the
IP address appeared. Divide by two to get the total number of min-
utes for the host in question.The time here is not necessarily con-
tiguous time.
■
First timestamp is the timestamp for the first port report that
included the host.Timestamps are often useful for IT organizations