NAME
scanlogd - detects and logs TCP port scans
SYNOPSIS
scanlogd
DESCRIPTION
scanlogd detects port scans and writes one line per scan via the
syslog(3) mechanism. If a source address sends multiple packets to
different ports in a short time, the event will be logged. The format
of the messages is:
saddr[:sport] to daddr [and others,] ports port[, port...], ...,
flags[, TOS TOS][, TTL TTL] @HH:MM:SS
The fields in square brackets are optional; sport, TOS, and TTL will
only be displayed if they were constant during the scan.
The flags field represents TCP control bits seen in packets coming to
the system from the address of the scan. It is a combination of eight
characters, with each corresponding to one of the six defined and two
reserved TCP control bits (see RFC 793). Control bits that were always
set are encoded with an uppercase letter, and a lowercase letter is
used if the bit was always clear. A question mark is used to indicate
bits that changed from packet to packet.
INTERFACES
In order to do its job, scanlogd needs a way to obtain raw IP packets
that either come to the system scanlogd is running on, or travel across
a network segment that is directly connected to the system. Current
versions of scanlogd can be built with support for one of several
packet capture interfaces.
scanlogd is aware of the raw socket interface on Linux, libnids, and
libpcap.
The use of libpcap alone is discouraged. If you’re on a system other
than Linux and/or want to monitor the traffic of an entire network at
once, you should be using libnids in order to handle fragmented IP
packets.
COMPILE-TIME DEFAULTS
At least 7 different privileged or 21 non-privileged ports, or a
weighted combination of those, have to be accessed with no longer than
3 seconds between the accesses to be treated as a scan. If more than 5
scans are detected within 20 seconds, that event will be logged and
logging will be stopped temporarily.
Logging is done with a facility of daemon and a priority level alert.
scanlogd should be started as root since it needs access to a packet
capture interface. By default, it chroots to /var/empty and switches
to running as user scanlogd after the packet capture interface is
initialized.
EXIT STATUS
If the daemon couldn’t start up successfully, it will exit with a
status of 1.
USAGE
You’re expected to create a dummy user for scanlogd to run as. Make
sure you allocate unique UID and GID to the user.
In most cases, scanlogd should be started from a rc.d script on system
startup.
In /etc/syslog.conf you may use something like:
daemon.alert /var/log/alert
SECURITY NOTES
As the name indicates, scanlogd only logs port scans. It does not
prevent them. You will only receive summarized information in the
system’s log.
Obviously, the source address of port scans can be spoofed. Don’t take
any action against the source of attacks unless other evidence is
available. Sometimes IP addresses are shared between many people; this
is the case for ISP shell servers, dynamic dialup pools, and corporate
networks behind NAT (masquerading).
BUGS
Due to the nature of port scans, both false positives (detecting a scan
when there isn’t one) and false negatives (not detecting a scan when
there’s one) are possible. In particular, false positives occur when
many small files are transferred rapidly with passive mode FTP.
AUTHORS
Solar Designer <solar at openwall.com>
Steffen Dettmer <steffen at dett.de> wrote the initial version of this
manual page.
SEE ALSO
syslog(3), syslog.conf(5), libnids(3), pcap(3)
scanlogd home page: http://www.openwall.com/scanlogd/
Phrack Magazine, issue 53, article 13