427 Botnet fm qxd

www.syngress.com
292
Chapter 8 • IRC and Botnets
427_Botnet_08.qxd 1/8/07 4:10 PM Page 292

---

period.The third channel subreport is also useful; we will call it the 
channel
host report
. Above it is 
channels with associated host IPs and host stats.
In this sub-
report all the host IPs in the channel are given. Each host IP has a set of
statistics associated with it.
The following is a simple and benign example. First we want to look at
something safe, and then we will be able to compare it to a botnet client
mesh. Later on we will see some examples that are not so benign.
N
OTE
Compared with real ourmon data, the tabular data shown in Tables
8.1 and 8.2 has been simplified for formatting reasons. Not all avail-
able fields will necessarily be shown in the examples.
Table 8.1 
Channels Sorted by Max Messages
Channel
Msgs
Joins
Privmsgs Ipcount Wormyhosts Evil?
Ubuntu
4275
894
3381
2
0
Rubyonrails 2490
325
2165
2
0
Table 8.2
Channel Ubuntu with Per-Host Stats
Ip_src
Tmsgs Maxworm
Server? Sport/dport First_ts
192.168.1.1 14169 8
H
40507/6667 Sun_Oct_15_
00:30:40
10.10.10.10 14950 1
S
6667/40507
Sun_Oct_15_
00:09:44
In the two tables we see normal (and benign) IRC statistics. In this report,
the evil channel report has no messages, so we do not show it. In Table 8.1,
we show 
channels sorted by max messages.
All IRC channels seen during the
time in question are listed, and all the basic four kinds of message types are
added together and put under the label 
msgs
. We see that channel Ubuntu has