Re: patch: Port- and netscan detection for netfilter

[Tim Gardner <timg@tpi.com>]

Patrick McHardy wrote:
> Gladewitz, Robert (FH) wrote:
>> in my Master-Theses I designed a new kernel- and netfilter module for
>> detection of net- and portscans. Now, the module is tested on more then
>> 10 different firewall-installations. It's working without any problems
>> during the last 8 months.
>>
>> Your can read the documentation on
>> http://ipt-portnetscan.sourceforge.net/. There is also a possibility to
>> download all versions of Kernel- and IpTables-Patches.
>>
>> I would be pleased to see you integrated these patches into IpTables of
>> your use.
>> Looking forward to your answer
> 
> Please attach patches inline so they can be read in the mail client.
> 
>> +++ linux-2.6.20.2/Documentation/ipt_PORTNETSCAN.txt
>> @@ -0,0 +1,389 @@
>> +Allgemein Informationen zum Modul ipt_PORTNETSCAN
> 
> Luckily I speak german :)
> 
> But seriously, we already had different portscan-detection matches
> submitted, but decided against merging them since its not clear
> what the benefit of detecting scans is. It clearly doesn't improve
> security since
> 
> - you can just scan slow enough not to be detected
> - you don't need to scan to crack something
> 
> So all it offers is a bit of correlated information ("you were scanned
> by ..."), that can also be extracted from log-files.
> 
> 

Patrick,

One benefit of being able to block a port scanner is that it reduces or
stops the amount of ARP traffic that is generated. Depending on your
internal network design, lots of ARP traffic can have a significant
impact on WAN links and so on.

rtg
-- 
Tim Gardner timg@tpi.com www.tpi.com
OR 503-601-0234 x102 MT 406-443-5357