427 Botnet fm qxd

www.syngress.com
Advanced Ourmon Techniques • Chapter 9
327
427_Botnet_09.qxd 1/8/07 4:45 PM Page 327

---

:2309: Sun_Oct_15_00:02:47_PDT_2006: Sun_Oct_15_23:01:42_PDT_2006:
portuples[10]: [80, 477022][6667, 6421][995, 5873][8080, 3802][5190,
1314][993, 1098][443, 612][8000, 218][3127, 138][800, 45]
Another possibility is to simply use 
grep –A 4
on the IP address, with no
need for a text editor, as follows (the result should be the same):
# grep –A 4 192.168.10.10 syndump*txt
Since we saw a high scanning value in the IRC data, we also might
choose to examine individual TCP port report files in the log directory.
Remember, these are 30-second report files.This can help us learn more
details about the scanning behavior of this host. In this case we go to the
/home/mrourmon/logs/portreport/Sun directory and use the 
find
command
to do a 
grep
across those files.The Unix 
find
command is useful here because
it is often the case that there are too many files in a log directory and simpler
commands like 
ls
will not work.
Find
always works. So, for example, we might
do something like the following to get individual 30-second port report data
(see Table 9.2):
# cd /home/mrourmon/logs/portreport/Sun
# find . | xargs grep 192.168.10.10
Table 9.2
TCP Port Report File Search
Port 
Ip_src
Flags Apps Work
SA/S
L3D/L4D L4S/src
Snt/rcv Signature
192.168.10.10
WO
94
0
4/2
6/65490
34/1
[5190,2]
[8080,97]
192.168.10.10
WO
92
0
3/3
6/64956
30/1
[6667,6]
[8000,90]
192.168.10.10
wO
79
0
2/2
5/65515
26/3
[6667,11]
[8000,85]
Again we have cleaned this data up for formatting reasons and eliminated
some fields.The entries are sorted in increasing order of time because the files
are stored with the filename and timestamp matching. We can thus search the
individual TCP port reports and watch what happens over time. In effect, you
can play the data back. From an analysis point of view, we can see that there