🚀 go-pugleaf

Ben Rouse wrote:
>
> Just out of curiosity, how does one know when they are being port
> scanned???

I use our high-end Cisco border router for this.

I send the Cisco Netflow accounting UDP packets generated
by the router to a multicast IP address.

It's a simple application to join the group and print
the incoming data.

Each port scan, by definition, is a seperate IP flow.
So you see the number of IP flows per second jump
considerably.

"Stealth scanning" is designed to reduce the number
of IP flows per second, but all the current scanners
are detectable using a simple linear correlation model
of the flows with about 6 variables.  It appears the
creators of these packages should be paying more attention
in their maths/stats classes.


It's harder for an individual machine to detect port
scanning.  Once of the more instructive things you
can do is to modify the kernel to dump packets that
cannot be delivered to an application.  The TCP
Wrapper package already does this to a limited extent.

There are also specialist applications, none of which
I have used.

The new 2.2 IP Chains package makes detecting and
acting upon port scans and other IP weirdness really
easy.

-- 
 Glen Turner                               Network Specialist
 Tel: (08) 8303 3936          Information Technology Services
 Fax: (08) 8303 4400         The University of Adelaide  5005
 Email: glen.turner@adelaide.edu.au           South Australia