Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i have setup a log server with splunk running on it. i pinged one of the clients using backtrack....Does this also genrate log which is sent the log server??????

I wanted to detect port scanning ...on any clients ..How to do it???

The client is ubuntu machine and so is the server i.e the syslog server

share|improve this question
You'd be better off setting up Snort with a simplified ruleset for detecting rogue scanners. – gravyface Feb 8 '11 at 18:02
Yeah @gravyface is right I think your thing/looking for snort – Jacob Mar 16 '11 at 4:20

It depends on the firewall on the clients, you don't even mention the OS involved let along what it is you're pinging but certainly it would be possible to setup some OS's firewalls to syslog on port access attempts/denies.

That said this isn't a particularly good way of going about doing what, I think, you want. If you want to see if any machine on the inside of your network is port-scanning and have no switch/router-based way of doing this then go ahead and do what you want with firewalls, syslogs and splunk but if you're expecting port-scans to come in from a different network then you only need to look at the ingress port/s, which would be much easier.

Perhaps come back to us with much more information and we may be able to be clearer.

share|improve this answer
both client and server are ubuntu machines – Vinod Feb 8 '11 at 18:17

Syslog is a means for recording data, and Splunk is a means for parsing and searching data. Neither is designed for detecting security events like a port scan.

To detect security events, you need software usually called an "IDS" - Intrusion Detection System. That IDS will need a network interface that sees all the traffic you hope to watch. That's either a mirrored port on a managed switch or any port on a hub.

Attach a network intrusion detection sniffer like Snort to the monitoring port. Create rules to watch for port scanning attempts. Dump the IDS output to Splunk for analysis via syslog.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.