What is command-and-control server (C&C server)? - Definition from WhatIs.com


command-and-control server (C&C server)

Part of the Network security glossary:

A command and control server (C&C server) is the centralized computer that issues commands to a botnet (zombie army) and receives reports back from the coopted computers.

In the traditional botnet, which includes a C&C server, the bots are typically infected with a Trojan horse and subsequently communicate with a central server using IRC. The botnet might be used to gather misappropriated information, such as credit card numbers. Depending on the purpose and structure of the botnet, the C&C server might also issue commands to start sending spam or begin a DDoS (distributed denial of service) attack.

Depending on its topology, a botnet may have multiple C&C servers or none at all.

Typical botnet topologies include:

  • Star, in which the bots are organised around a central server.
  • Multi-server, in which there are multiple C&C servers for redundancy.
  • Hierarchical, in which there are multiple C&C servers that are organized into tiered groups.
  • Random, in which there is no C&C server at all and coopted computers communicate as a peer-to-peer botnet (P2P botnet).

Since IRC communication is typically used to command botnets, it is often guarded against, which has motivated the drive for more covert ways for C&C servers to issue commands. Alternative channels used for botnet command include JPG images, Microsoft Word files and posts from LinkedIn or Twitter dummy accounts.

Learn more about botnet command and control in this video:

This was last updated in May 2014
Contributor(s): Matthew Haughn
Posted by: Margaret Rouse

Related Terms


  • going dark

    - The going dark problem, as described by the FBI, is the Bureau’s inability to access legally intercepted communications and information because of the encryption technologies used for data privacy ... (WhatIs.com)

  • threat actor

    - A threat actor is an entity that is partially or wholly responsible for an incident that impacts – or has the potential to impact -- the security of an organization. (WhatIs.com)

  • threat intelligence service (TI service)

    - A threat intelligence service (TI service) is a provider of information about current or emerging threats that could negatively impact the security of a customer’s organization. (WhatIs.com)


  • Network security

    - Terms related to network security, including definitions about intrusion prevention and words and phrases about VPNs and firewalls.

  • Internet applications

    - This WhatIs.com glossary contains terms related to Internet applications, including definitions about Software as a Service (SaaS) delivery models and words and phrases about web sites, e-commerce ...

Ask a Question. Find an Answer.Powered by ITKnowledgeExchange.com

Ask An IT Question

Get answers from your peers on your most technical challenges

Ask Question

Tech TalkComment



    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.