427 Botnet fm qxd

www.syngress.com
Ourmon: Overview and Installation • Chapter 6
239
427_Botnet_06.qxd 1/8/07 3:14 PM Page 239

---

Solutions Fast Track
Case Studies:Things That Go Bump in the Night
Ourmon uses graphics based on Tobias Oetiker’s popular RRDtool
system (http://oss.oetiker.ch/rrdtool).
The pkts filter shows how many packets per second (pps) the
ourmon system is processing.
You need to observe your ourmon graphs and data daily and over
time build up some idea of what is normal.Then you will be able to
spot anomalies.
The pkts filter can be used to see DoS and DDoS attacks.
The worm graph filter can be used to see large parallel scans.
The hourly IRC report can be used to look for anomalous IRC
channels and may indicate botnet activity.
The RRDtool IRC message count graph can show an on-campus
botnet server.
How Ourmon Works
Ourmon architecturally has two main components, a probe (sniffer)
used for packet capture and a back-end graphics engine that makes
Web pages.
The ourmon system has three important cycle times.The probe
produces outputs every 30 seconds.The back-end software produces
base-lined data including hourly and daily ASCII reports.
RRDtool graphs include daily, weekly, monthly, and yearly graphs.
Ourmon dynamically creates Web pages and logs.The logs may be
used for extracting more details about a particular case and are also
used internally by ourmon to produce hourly summarizations.
www.syngress.com
240
Chapter 6 • Ourmon: Overview and Installation
427_Botnet_06.qxd 1/8/07 3:14 PM Page 240

---

Installation of Ourmon
The supplied tool configure.pl is used for installing ourmon.
Ourmon has various dependencies (software not supplied by us)
including a Web server, the RRDtool library, the libpcap library, and
the PCRE library.These should be installed before ourmon is
configured.
The ourmon.sh script is used to start the probe.
The back-end graphics software is run from the root crontab once a
minute.
If you have installation problems refer to the INSTALL file.
It is a very good practice to dedicate a small subnet as a darknet.This
can be very helpful in detecting scanning hosts.