Sure. But anyone who's interested in keeping it a secret would just rename it to something innocuous. I'll admit that I don't know much about eggdrops (I was never much into IRC), but it seems to me that the correct way would be to see what the program's doing. It would have to attach to an IRC port, right? In that case, I'd use lsof to see what processes are using that port.