AVL Code
All cases
#004 · Traffic Analysis

Case study · Traffic Analysis

IRC Botnet Traffic Capture Analysis

You are an incident responder, and all you have is a net.pcap — 42,100 bytes, 466 packets, no sample and no host logs. Work through this article and you will get a traffic analysis report reconstructing the network topology and C2 behavior, plus an IOC list you can import into blocking the same day.

pcap · 42,100 bytes· 466 packets · about 4 min 27 s· TCP stream payload, 0 bytes· IRC botnet C2· Landi N2.5

View session Download session archive Import into your AVL Code workspace to replay the full conversation

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model

Overview

  1. 01

    Profile the file — a traffic picture of 42,100 bytes / 466 packets

    You hand net.pcap to AVL Code; first you get the basics: file size, capture window, packet count, link layer.

  2. 02

    Payload comes up empty — every TCP stream is 0 bytes, so pivot to hexdump

    You extract TCP stream payloads hoping to read the IRC conversation, but only handshakes come back; the analysis pivots to per-packet hexdump and timing.

  3. 03

    Reconstruct behavior — verdict: IRC botnet C2

    You see the topology, the key DNS findings and the rhythm of 140+ reconnections rebuilt: ircbd.anondns.net → 45.9.148.85:6697.

  4. 04

    Blocking on the ground — IOCs and detection rules

    You get IOCs each backed by traffic evidence, network detection rules and a DNS monitoring policy, plus host forensics guidance.

Task for AVL Code

Analyze this network traffic capture, net.pcap, for me

Prerequisites: The pcap to analyze is already in the workspace (samples/net.pcap for this case); no analysis tools need to be installed, and the whole run is read-only — the original file is never modified

Reproduction materials at the end of this article Try it yourself ↓

Analyzing the Capture

No sample, no host logs — your only input is this capture, and the analysis starts by handing it to AVL Code:

You type → AVL Code 
Analyze this network traffic capture, net.pcap, for me
AVL Code runs → you see
Locates samples/net.pcap (42,100 bytes) → basics: 466 packets · about 4 min 27 s · Ethernet
→ Extracts TCP stream payloads to read the IRC conversation
→ Key turning point: every TCP stream payload is 0 bytes (handshake packets only)
→ The payload road is a dead end → pivots to per-packet hexdump analysis of the raw packets

Reconstructing Behavior

Zero-byte payload does not mean zero information — topology, domains and the reconnection rhythm are all written in the headers and the timing:

You type → AVL Code 
Analyze this network traffic capture, net.pcap, for me
AVL Code runs → you see
Per-packet hexdump analysis → topology rebuilt: victim host 192.168.7.133 (a VMware virtual machine) · C2 45.9.148.85:6697 (the standard IRC-over-SSL port)
→ Key DNS finding: continuous queries for ircbd.anondns.net → 45.9.148.85, about once every 5 seconds, 70+ in total, TTL of only 5 seconds
→ Domain background: anondns.net is an anonymous DNS provider, and the ircbd prefix hints at an IRC bot
→ Behavior fingerprint: about 140 TCP streams all pointing at the C2, each only 5 packets (connect and drop), source ports incrementing in sequence
→ Corroborating traffic: the usual mDNS / LLMNR / PTR lookups

IOC Blocking

The report’s final section is "recommendations" — every IOC and rule traces back to the traffic evidence above:

You type → AVL Code 
Analyze this network traffic capture, net.pcap, for me
AVL Code runs → you see
Generates the full traffic analysis report: basics / network topology / communication patterns / threat assessment / conclusions / recommendations
→ IOC blocking list: domain ircbd.anondns.net · IP 45.9.148.85 · port 6697
→ Detection rules: alert on connections to the C2’s 6697 port and on *.anondns.net domains · DNS monitoring for short-TTL high-frequency queries
→ Host forensics: full scan of the victim host to root out IRC bot malware

Try it yourself

Download the session and import it into your workspace to replay the full process, or hand your capture straight to AVL Code:

View session Download session archive Import into your AVL Code workspace to replay the full conversation
› Analyze this network traffic capture, <your capture>.pcap, for me
  • The pcap in this case was captured in a virtual-machine lab (the victim host’s MAC prefix 00:0c:29 marks a VMware virtual NIC); the 192.168.7.x internal addresses are real data from that environment. The session export does not expose the exact command lines executed, so the action sequences in this article follow the "input → output" record; the whole analysis is read-only and never modifies the original pcap.

Next question: The capture identifies the C2, but the malware itself is still missing — next step: full forensic imaging of the victim host to find the IRC bot behind the reconnections.