427 Botnet fm qxd

www.syngress.com
IRC and Botnets • Chapter 8
289
427_Botnet_08.qxd 1/8/07 4:10 PM Page 289

---

the world of large IRC servers, clients might do this to keep an administrator
from logging a particular client out manually.
Of course we are really looking for botnets with this mechanism. We
don’t care about human chat groups. We care about programmatic use of IRC
as a communication channel and programs that link up to servers elsewhere
(meaning bot clients and bot servers). As a result, our focus is on statistics. For
example, we want to know the IRC channel names and the IP addresses of
hosts in those channels. We want to know if mysterious new channels appear.
We want to know if the statistics show anything unusual, which might
include unexpected numbers of PINGS and PONGS, indicating a very large
(and previously unknown) IRC channel on campus. We especially want to
know about any IRC channel that is inhabited by a large number of scanning
hosts.This might indicate a botnet client mesh.
Ourmon’s RRDTOOL 
Statistics and IRC Reports
In this section we look at ourmon’s IRC user interface. Before we go on,
refer to Chapter 7, Figure 7.1. Find the middle jump table with the title
important security and availablility reports/web pages
and then note the hypertext
link called 
irc stats page
.That’s where the ourmon IRC statistics live. Go to
that page for the following discussion. A screenshot of the IRC page is find-
able, as shown in Figure 8.2. We want to discuss both the page and the format
of the summarized IRC report as well as say a few words about the RRD-
TOOL statistics available on that page.
The IRC stats page has three things available on it that are all IRC-
related:
■