427 Botnet fm qxd

The 30-second IRC report
This report and the weekly summa-
rizations all have the same format. However, this particular report
only has the last 30 seconds’ worth of data.
■
The weekly summarizations, including the daily report
As is
usual with summarizations, the current daily report is available at the
left-hand side. It is run hourly and rolled over at midnight to become
www.syngress.com
290
Chapter 8 • IRC and Botnets
427_Botnet_08.qxd 1/8/07 4:10 PM Page 290

---

yesterday
.
Yesterday
is rolled over to become 
today,
then
2 days
, and so on.
All together there are eight full days in addition to the current day.
Figure 8.2
The IRC Stats Page
■
The RRDTOOL global IRC stats
Figure 8.2 shows the daily
strip chart, and 
Figure 8.3
shows a weekly strip chart. As is usual with
RRDTOOL, strip charts for daily, weekly, monthly, and yearly stats
are available.The ourmon system counts the total number of IRC
PING, PONG, JOIN, and PRIVMSGs for the entire network as seen
by the probe. Usually these messages have low counts.
T
IP
A typical way to use this information is to take a quick glance at the
daily and weekly total stats. This could help you detect the presence
of an IRC bot server on your network (as we will see in a moment).
You want to see normal small daily bumps, not counts in the thou-
sands. Then take a look at the summarized reports for today (daily)
and yesterday. You want to see if there are new channels you don’t
understand and if there are so-called evil channels with sets of
attacking hosts. We will look at examples in the following sections.