427 Botnet fm qxd

T
IP
One of the major differences between the TCP and UDP work weights is
that TCP has control packets for starting, ending, and terminating con-
nections (SYNS, FINS, and RESETS). TCP’s control packets are typically
abused by scanners. UDP has no control packets and data flows may in
fact be one way. As a result we use ICMP error messages like “ICMP port
unreachable” with the UDP work weight to help catch network errors.
www.syngress.com
Ourmon: Anomaly Detection Tools • Chapter 7
273
427_Bot_07.qxd 1/8/07 3:40 PM Page 273

---

Figure 7.4 
UDP Weight Graph
If a host sends a lot of UDP packets fast and they cause common ICMP
errors like destination host unreachable (used by UDP but not TCP as TCP
uses RESET packets), a high UDP work weight will be earned. Informally
this means that the Internet found what you were doing to be in error.These
sorts of events are often associated with DOS attacks or with UDP-based
scans like Internet SPIM probes, which are scans sent to many local IP hosts.
SPIM is spam for Internet Messenger applications. SPIM is something that
can be done by bots as well and can be viewed as a form of adware. Every 30
seconds the graph adds the current highest work weight from all the UDP
work weights in the UDP port report to the right side. So, like all the RRD-
TOOL graphs, this graph moves from right to left. Assuming we want more
details, we need to try to find the 12:40 or so report in our logs directory. In
this case we look in /home/mrourmon/logs/udpreport/Tue.
Now let’s assume we found the correct UDP port report and we need
only glance at the top entry (see Table 7.6).
Table 7.6
UDP Port Report
Ip src:
Weight:
Udp_
Udp_