427 Botnet fm qxd

www.syngress.com
302
Chapter 8 • IRC and Botnets
427_Botnet_08.qxd 1/8/07 4:10 PM Page 302

---

T
IP
If you are unsure what the IRC TCP work weight means when it is
associated with a host, you can either look the host IP up via the Web
in either the basic TCP port report summarization or the syndump
summarization, which will have all local enterprise hosts in it. If you
want to get a 30-second sample point of view for the host over the
day, search the TCP port report log directory with the 
grep 
pattern-
matching tool. For example, first we change directory to the desired
day of the week in the logging directory and then we use find, xargs,
and grep to search the saved 30-second reports for the desired host IP
address. 
#cd /home/mrourmon/logs/portreport/Fri
# find . | xargs grep 192.168.21.138 
The output comes out in timestamp order, so you can watch how
the host behaved during the day. For example, here are three slightly
simplified log entries where we show the timestamp, IP address, work
weight, and port signature fields:
20:03:44_PDT 192.168.21.138 (Ew) 81 [80,9][139,23][445,65]
…
20:04:11_PDT 192.168.21.138 (EW) 95 [80,4][139,25][445,64]
…
20:04:45_PDT 192.168.21.138 (EW) 91 [80,0][139,26][445,67]
…
Last, one should point out that a commercial enterprisewide virus plat-
form (like Symantec’s System Center) might have enterprise-level tools that
can give you information about whether host 
X
is infected with some known
piece of malware. As a result, you might be able to make a correlation
between ourmon and the enterprisewide virus system.This can also help you
deal with fringe cases such as the host in our alien channel. If you are lucky,
your enterprisewide tool might tell you that hosts 
X,Y
, and 
Z
are infected
with toxbot or some other bot client. Correlation of a network point of view
like ourmon’s and virus detection systems is a new frontier, and we can hope
for more in this direction in the future. Of course, you might not be able to
make any correlation with virus detection tools if the bot is new and there is
as not yet an AV signature.