🚀 go-pugleaf

On 9 Jan 1999 06:25:28 GMT, Anthony Towns <csatowns@mailbox.uq.edu.au> wrote:
|Glen Turner (glen.turner@adelaide.edu.au) wrote:
|: Ben Rouse wrote:
|: > Just out of curiosity, how does one know when they are being port
|: > scanned???
|: I use our high-end Cisco border router for this.
|
|I use iplogger.deb. :)
|
|It's not all *that* great -- it only checks tcp connection attempts
|and icmp packets (so some of the really illegitimate port scans don't get
|noticed, and anything can happen on udp ports), but it's basically enough
|to catch the clueless script kiddies.
|
|Of course, logging alone isn't enough. You have to actually look through
|your logs to get any benefit from this. And also, this only logs *failed*
|attempts -- successful attacks are generally going to involve people
|clueful enough to have a quick grep through your logs and remove most of
|their traces.


Have a look at the 'Sentry' program at http://www.psionic.com/abacus/abacus.html

It can automatically block the source of a port scan as soon
as it detects it.


-- 
Reverend Paul Colquhoun,     paulcol+sig@andor.dropbear.id.au
Universal Life Church    http://andor.dropbear.id.au/~paulcol
-=*=-=*=-=*=-=*=-=*=-=*=-=*=-=*=-=*=-=*=-=*=-=*=-=*=-=*=-=*=-
xenaphobia: The fear of being beaten to a pulp by
            a leather-clad, New Zealand woman.