427 Botnet fm qxd

www.syngress.com
Ourmon: Anomaly Detection Tools • Chapter 7
267
427_Bot_07.qxd 1/8/07 3:40 PM Page 267

---

In the first case, imagine that you are looking at a TCP port report that
exactly matches the time in the spike in the worm graph.That port report has
2000 entries in it. Each entry more or less looks something like the entries
listed in Table 7.4 (we only have two lines as opposed to 2000, so imagine
more lines with more IP addresses from around the Internet).
Table 7.4
TCP Port Report
Port 
Ip_src
Flags
Work
SA/S
L3D/L4D Ip_dst
Snt/recv
Signature
10.0.0.1
(WOR) 100
0
1/1
192.168.45.12
41/1
[22,100]
10.0.0.2
(WOM) 100
0
1/1
192.168.45.12
39/0
[22,100] 
The important thing to notice here is that one port (probably a secure
shell server) on one host is the target.The IP destination address is the same,
and L3D/L4D indicates one IP and one port.This was a DDOS attack coor-
dinated via a botnet. On the other hand, we might have data that looks like
the pattern shown in Table 7.5.
Table 7.5
TCP Port Report #2
Port 
Ip_src
Flags
Work
SA/S
L3D/L4D Ip_dst
Snt/recv
Signature
10.0.0.1 (WOR) 100
0
41/1
192.168.45.12
41/1
[25,100]
10.0.0.2 (WOM) 100
0
39/1
192.168.33.2
39/0
[25,100] 
In this case, given that the IP destination addresses are different and L3D
data shows 30 or so unique IPs swept in the sample period, we can say that
we have a distributed botnet scan looking for e-mail ports.
A good question at this point is: If you have a spike, how can you find the
TCP port report? A brutal answer is that you have to go look in the logs
directory for the TCP port report and the day in question. First, note the
time in the graph, which is around 1:00 
A
.
M
.Then change directory to the
port report log directory for that day as follows (this depends on the base
ourmon install directory; here we assume /home/mrourmon):
% cd /home/mrourmon/logs/portreport/Tue