427 Botnet fm qxd

www.syngress.com
250
Chapter 7 • Ourmon: Anomaly Detection Tools
427_Bot_07.qxd 1/8/07 3:40 PM Page 250

---

Table 7.2
Ourmon Daily Summarizations
Summarization Type
Content: One Week’s Worth
Chapter
Event log 
Event logs
Chapter 9
Portsigs unfiltered
TCP port report filtered by 
Chapter 7
nonzero TCP work weight
Port 445 summarization
TCP port report filtered to 
Chapter 7 
port 445 only
Work weight >= 40
TCP port report filtered to 
Chapter 7
hosts with TCP work weight 
>= 40
P2P summarization
TCP port report filtered to 
Chapter 7
hosts recognized using 
various P2P signatures
Syndump summarization
Local IP TCP port report
Chapter 7
E-mail syn summarization
Hosts sending e-mail SYN 
Chapter 7
packets
N
OTE
We will explain at length about the TCP and UDP work weights in a
moment. For now you need only understand that they are measures
of efficiency in terms of packets sent by a particular IP host (IP
address). Scanners or boxes intent on performing a DOS attack have a
tendency to be inefficient. 
In Figure 7.3, one important thing to notice about the summarization
links is how they are organized in terms of time.The daily summarization is
first on the left side. It is updated hourly (say, 10:00 
A
.
M
., 11:00 
A
.
M
., etc.) on
the current day.The next link to that going from left to right is for yesterday;
the next link after that is for two days ago.Thus daily links are rolled over at
midnight to the next day.Today becomes yesterday. Roughly at the end of the
week, the oldest day is lost.