427 Botnet fm qxd

www.syngress.com
324
Chapter 9 • Advanced Ourmon Techniques
427_Botnet_09.qxd 1/8/07 4:45 PM Page 324

---

Any event log message starts with a timestamp, followed by the event mes-
sage itself, which can come from any part of the ourmon system. For
example, we previously saw a UDP work weight threshold message that
started like this:
Tue Oct 10 03:20:00 PDT 2006: udpweight threshold exceeded:192.168.125.43
Note the time of the event, which is followed by an explanation of the
event and other data. Given our focus on anomaly detection, the anomaly
detection events are of the most interest.These include the UDP work weight
threshold event and the trigger-on and -off messages mentioned previously. In
addition, we have two events that can come from the IRC software:
botnet client mesh?: irc channel X has bad #hosts:
botserver?: irc channel X has #hosts:
The first message is trying to alert you to an evil botnet channel that has
at least three scanning hosts.The second message alerts you to the possible
presence of a bot server on campus. In both cases,
X
is replaced by the actual
channel name. If you see these messages, go straight to the IRC data page and
check out what is happening.
In general, see the ourmon help page (info.html) for more information on
the event log.This page also includes information on how to change the
botnet-related event log constants that trigger these two messages.
In summary, the event log is something you should check daily. If an
interesting anomaly-related event occurs, you might want to either refer to
various sections of ourmon for more details, including your IRC logs
(Chapter 8) and tcpdump packet traces as discussed in this chapter, or possibly
your TCP port report summarizations and logs (Chapter 7 and the next sec-
tion).