427 Botnet fm qxd

www.syngress.com
Advanced Ourmon Techniques • Chapter 9
335
427_Botnet_09.qxd 1/8/07 4:45 PM Page 335

---

Separate the Front End and Back 
End with Two Different Computers
Ourmon’s configure.pl application (which we discussed in Chapter 6) sepa-
rates the installation of the front-end probe and back-end processing software.
So, you can install the front end on one computer and install the back end on
a different computer. As a result, by definition they will not compete for one
computer.Then arrange somehow for the front end’s output files to be trans-
ferred using TCP (for reliability) to the back-end computer. We typically run
a small Web server on the probe and use the well-known 
wget
application to
copy the files.You could also use Secure Shell (www.openssh.org) in batch
mode with no passphrase. Our 
wget
approach can be found in the back-end
script /home/mrourmon/bin/omupdate.sh and simply needs to be com-
mented in with a suitable IP address for the probe. It is a good idea to use an
access control list on the probe to make sure that only the back-end host can
access it to get the files. (It is also a good idea to make sure that no external
host can talk to the probe.)
Buy a Dual-Core, Dual-CPU Motherboard
If you buy a dual CPU where each CPU is actually dual-core, SMP operating
systems will think you have four CPUs.This way you can run all of ourmon
on one system, both front end and back end. One hardware thread is for the
NIC reading packets; one is for the probe application. A third thread will be
used by Perl, which runs the back-end code, for the most part.This leaves you
one NIC, possibly for running a program like ngrep, ircfr, or Snort. In the
future we hope to have a threaded ourmon probe; four logical CPUs will be
needed for such software.
Make the Kernel Ring Buffer Bigger
We have found in our lab that a large kernel buffer size will sometimes help
reduce the number of dropped packets.This doesn’t always work, but it has
worked often enough that if you have drops, this is the first thing to try. If it
doesn’t work, maybe you need new hardware. First find the shell script that is
used for starting ourmon and then modify the kernel buffer size parameters