Portsweep

Portsweep

[bahamin takhtaei]

Hi everybody,
Do you know How to use iptables against Portsweep attacks?

Thank you.




      

Re: Portsweep

[Grant Taylor]

On 09/23/08 01:51, bahamin takhtaei wrote:
> Do you know How to use iptables against Portsweep attacks?

There use to be a Port Scan Detection (psd) match extension that would 
help detecting this easier.  I.e. did it look like a system was 
initiating a port scan, and if so, handle it accordingly (drop / reject 
/ tar pit / etc.).  I don't know what the current state of the psd match 
is, so you will have to find out.



Grant. . . .

Re: Portsweep

[John Haxby]

Grant Taylor wrote:
> On 09/23/08 01:51, bahamin takhtaei wrote:
>> Do you know How to use iptables against Portsweep attacks?
>
> There use to be a Port Scan Detection (psd) match extension that would 
> help detecting this easier.  I.e. did it look like a system was 
> initiating a port scan, and if so, handle it accordingly (drop / 
> reject / tar pit / etc.).  I don't know what the current state of the 
> psd match is, so you will have to find out.
FWIW, my Netgear DG834N has this in a chain called DOS:

SCAN       all  --  anywhere             anywhere           psd weight-threshold: 21 delay-threshold: 300 lo-ports-weight: 3 hi-ports-weight: 1



Netgear make their source available so you could try looking there.

jch

Re: Portsweep

[bahamin takhtaei]

Thanks for your attention,
but unfortunately psd match doesn't handle portsweep attacks.
It only handles portscan attacks; as you know in portscan an 
attacker scans many ports on a specific destination, but in 
portsweep attacker scans a few ports on many destinations.



--- On Tue, 9/23/08, Grant Taylor <gtaylor@riverviewtech.net> wrote:
From: Grant Taylor <gtaylor@riverviewtech.net>
Subject: Re: Portsweep
To: "Mail List - Netfilter" <netfilter@vger.kernel.org>
Date: Tuesday, September 23, 2008, 4:36 PM

On 09/23/08 01:51, bahamin takhtaei wrote:
> Do you know How to use iptables against Portsweep attacks?

There use to be a Port Scan Detection (psd) match extension that would 
help detecting this easier.  I.e. did it look like a system was 
initiating a port scan, and if so, handle it accordingly (drop / reject 
/ tar pit / etc.).  I don't know what the current state of the psd match 
is, so you will have to find out.



Grant. . . .
--
To unsubscribe from this list: send the line "unsubscribe netfilter"
in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html



      

Re: Portsweep

[Grant Taylor]

On 09/24/08 02:59, John Haxby wrote:
> FWIW, my Netgear DG834N has this in a chain called DOS:
> 
> SCAN       all  --  anywhere             anywhere           psd 
> weight-threshold: 21 delay-threshold: 300 lo-ports-weight: 3 
> hi-ports-weight: 1
> 
> Netgear make their source available so you could try looking there.

I was wondering if it was not possible to make the psd match have a wild 
card in it like a netmask that would drop some of the least significant 
bits thus watching a larger range (network).  It looks like it might 
indeed do that.



Grant. . . .