Re: Botnet Traffic

[John Kristoff <jtk () cymru com>]

On Thu, 23 Feb 2012 18:17:38 -0400
"James Smith" <james () smithwaysecurity com> wrote:

> Can anyone on this list provide botnet network traffic for analysis,
> or Ip’s which have been infected.

Hi James,

Normally few people are going to be unwilling to provide such a thing,
at least for live or recently active botnets to the general public.  In
essence, few people like to spread that sort of dirty laundry around to
anyone who comes asking in a public forum.

However, there is some public data available in various locations.  For
instance, the Dragon Research Group (DRG) provides some public data it
sees on the well known HTTP, VNC and SSH ports.  The SSH report is
primarily compiled from random SSH brute force spreading worms.

  <http://dragonresearchgroup.org/insight/>

Note, I'm one of the DRG volunteers.

You can browse around the SANS ISC reports and get an idea of what they
see from various hosts and networks too.

  <http://isc.sans.edu/reports.html>

I'm not involved with that organization.

Lenny Zeltser has a page detailing where you might get some sample
malware to research:

  <http://zeltser.com/combating-malicious-software/malware-sample-sources.html>

There are likely many other sources of info if you dig around,
but you may be better off asking in another forum where security,
rather than networking is the major theme.  Feel free to contact me off
list and I'll see if I can help introduce you to the appropriate venues.

John