Botnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open source framework for automated botnet monitoring. The modular design will allow full customization of the used protocols, the monitoring clients behavior, how we log the collected information, processing of the data to analyze the botnets purpose, size and threat and how the monitoring task are distributed between dedicated nodes.
TCP as default is totally fine, I would be surprised if UDP will be needed very often but who knows :). If someone needs something else he would now and state it in the settings file.
TCP as default is totally fine, I would be surprised if UDP will be needed very often but who knows :). If someone needs something else he would now and state it in the settings file.