Tutorial: Internet Relay Chat (IRC)

Introduction

This tutorial discusses the plugin ircDecode.

Preparation

First, restore T2 into a pristine state by removing all unnecessary or older plugins from the plugin folder ~/.tranalyzer/plugins:

Are you sure you want to empty the plugin folder '/home/wurst/.tranalyzer/plugins' (y/N)? yes
Plugin folder emptied

Then compile the core (tranalyzer2) and the following plugins:

• basicFlow
• tcpStates
• ircDecode
• txtSink

...
BUILD SUCCESSFUL

If you did not create a separate data and results directory yet, please do it now in another bash window, that facilitates your workflow:

mkdir ~/data ~/results

The sample PCAP used in this tutorial can be downloaded here: irc.pcap.

Please save it in your ~/data folder.

Now you are all set for analyzing IRC traffic!

ircDecode

Let’s look at the plugin configuration first:

ircDecode

vi src/ircDecode.h

...
/* ========================================================================== */
/* ------------------------ USER CONFIGURATION FLAGS ------------------------ */
/* ========================================================================== */

#define IRC_SAVE       0 // save content to IRC_F_PATH
#define IRC_RMDIR      1 // empty IRC_F_PATH before starting (require IRC_SAVE=1)

#define IRC_CMD_AGGR   1 // Aggregate IRC commands/response codes
#define IRC_BITFIELD   0 // Bitfield coding of IRC commands

#define IRC_UXNMLN    10 // maximal username length
#define IRC_PXNMLN    10 // maximal password length
#define IRC_NXNMLN    10 // maximal nickname length
#define IRC_MXNMLN    50 // maximal name length

#define IRC_MAXUNM     5 // Maximal number of users
#define IRC_MAXPNM     5 // Maximal number of passwords
#define IRC_MAXNNM     5 // Maximal number of nicknames
#define IRC_MAXCNM    20 // Maximal number of parameters

#define IRC_F_PATH "/tmp/IRCFILES/" // Path for extracted content

/* ========================================================================== */
/* ------------------------- DO NOT EDIT BELOW HERE ------------------------- */
/* ========================================================================== */
...

Run t2 on the supplied pcap.

t2 -r ~/data/irc.pcap -w ~/results/ -s

So the aggregated ircStat tells us there is IRC.

The ircStat column is to be interpreted as follows:

   bit | ircStat | Description
   =============================================================================
     0 | 0x01    | IRC port found
     1 | 0x02    | IRC registration successful
     2 | 0x04    | IRC password incorrect
     3 | 0x08    | -

     4 | 0x10    | Unrecognized IRC command
     5 | 0x20    | File error (IRC_SAVE == 1)
     6 | 0x40    | Array, string or filename overflow
     7 | 0x80    | Invalid format or parsing error

tcol ~/results/irc_flows.txt

Conclusion

Don’t forget to reset the plugin configuration for the next tutorial.

t2conf ircDecode --reset && t2build ircDecode

Have fun analyzing IRC traffic!