🚀 go-pugleaf

Glen Turner (glen.turner@adelaide.edu.au) wrote:
: Ben Rouse wrote:
: > Just out of curiosity, how does one know when they are being port
: > scanned???
: I use our high-end Cisco border router for this.

I use iplogger.deb. :)

It's not all *that* great -- it only checks tcp connection attempts
and icmp packets (so some of the really illegitimate port scans don't get
noticed, and anything can happen on udp ports), but it's basically enough
to catch the clueless script kiddies.

Of course, logging alone isn't enough. You have to actually look through
your logs to get any benefit from this. And also, this only logs *failed*
attempts -- successful attacks are generally going to involve people
clueful enough to have a quick grep through your logs and remove most of
their traces.

Cheers,
aj

-- 
Anthony Towns -- <aj@humbug.org.au> <http://azure.humbug.org.au/~aj>
I don't speak for anyone save myself. PGP encrypted email preferred.

``...and then I had to reboot a hundred times, through tangled threads,
  and corporate crimes, you may never find love down a T1 line...''