427 Botnet fm qxd

www.syngress.com
140
Chapter 5 • Botnet Detection: Tools and Techniques
427_Botnet_05.qxd 1/9/07 9:59 AM Page 140

---

However, firewalls typically are in the data path for packets and are
consequently said to be “in-line” devices.
■
More complex setups may have one or more probes hooked up to
switches.The probes may in turn send aggregated data to a central
monitoring system (second-stage analysis box), which can provide
logging, summarization and analysis, and visualization (graphics).
Traditional SNMP Remote Monitoring (RMON) probes function in
this manner.The very common netflow system may work like this if
you are running an open-source netflow probe daemon on a PC.The
ourmon network-monitoring and anomaly detection system pre-
sented elsewhere in this book fits this model.
■
In another common variation, the “probe” and the network infras-
tructure gear (routers and Ethernet switches) are essentially the same
box.You simply collect data directly from the routers and switches.
Typically using SNMP, for example, with RRDTOOL-based tools
such as traditional MRTG, or Cricket (see http://oss.oetiker.ch/rrd-
tool/rrdworld/index.en.html for a list of such tools), a central data
collection box polls network infrastructure gear every few minutes. It
collects samples of per-port statistics like bytes in and bytes out, as
well as CPU utilization values and other data variables available via
SNMP Management Information Bases (MIBS).The popular netflow
tool may also be set up in such a manner using a Cisco router or
switch to collect flows (a statistic about related packets), which are
pushed out periodically to a collection box. We will discuss SNMP
and netflow in a little more detail in a moment.
www.syngress.com