[closed] Search for Client Controller (botnet) in WireShark

Is there somebody who knows where and how I am able to find the client controller.

well, as there are several hundred (or even thousand) different bots in the wild, it's hard to give any good advice, as most of them have different 'control protocols'. So, if you don't know what kind of botnet you are looking for and you don't know the protocol being used, the only way to find botnet communication in the capture file (if it exists at all), is the hard way by removing what does not look like botnet traffic. The traffic that remains is the botnet traffic.

Here is how I would start.

• First look at very long conversations from one client to one 'server' (Statistics -> Conversations -> TCP (perhaps also UDP)). Sort the connections for the duration. If there is one connection that lasts much longer as any of the other connections, take a closer look at the conversation (Follow, Reverse Resolve the 'server' IP, get the Geolocation of the IP, take a look at the transmitted data, etc.). Do everything that might help to identify botnet traffic in that conversation.
• Then look at lots of short connections from one client, the either the same 'server' (perhaps also to a bunch of 'servers'). You can use the Conversation statistics as well
• Get a list of destination addresses your client is communicating with (Statistics -> Conversations -> IPv4). Take those IP addresses and map them with a GeoIP tool (online, or with Wireshark: http://wiki.wireshark.org/HowToUseGeoIP). If you find any reagion of the world, that sounds 'suspicious' to you (because you would usually not communicate with North Korea), then have a closer look at the conversation with that destination IP address

Regards
Kurt

I would take a look at the RSA Security Analytics forum for this. They have lists of some fresh botnet traffic captures for botnets. The SA parses don't translate to ws filters but you can amend them. They list for user agent strings, which in WS would http user agent contains, dst ip, and ports etc etc. There are 1000's of bad ips, you could try the freeware version of netwitness. Just experiment and apply them as filters to see what you get. One method would be to put a pfsense firewall up at home then you can create a more permanent solution. Here is an example.

http.user_agent contains "GTB0.0" <- botnet useragent

some ips to look for

ip.dst == 117.20.165.245 || ip.dst == 174.56.218.245 || ip.dst == 184.172.204.122 || ip.dst == 208.103.243.252 || ip.dst == 37.154.32.249 || ip.dst == 66.85.130.234 || ip.dst == 70.180.80.2 || ip.dst == 77.238.214.249 || ip.dst == 78.83.197.4 || ip.dst == 79.115.90.253 || ip.dst == 80.48.209.4 || ip.dst == 86.105.156.250