Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up a honey-pot like machine that would detect port sweeps from multiple networks with multiple interfaces.

As an illustration, if I could set up a box with eth1, eth2 and eth3. eth1 is on the 192.168.10.254/24 network eth2 is on the 192.168.20.254/24 network eth2 is on the 192.168.30.254/24 network

If I get a TCP connection from 192.168.99.7 trying to access (say) port 443 on 192.168.[10/20/30].254 in a short period of time, it would generate a alert to the administrator that 192.168.99.7 is most likely compromised and scanning the network.

Anyone have any idea how to set something like that up? All the port sweep detection mechanisms (scanlogd, psad) I've currently seen all seem to focus on a single host being scanned for multiple ports.

Even something knocked up with iptables would be an option if it worked.

Many thanks in advance.

share|improve this question

1 Answer 1

You may be able to adopt the logic of the "multiple ports" approach to a "multiple ports across multiple IPs" assessment.

share|improve this answer
    
Could you elaborate further? –  user95369 Sep 20 '11 at 22:49
    
"All the port sweep detection mechanisms (scanlogd, psad) I've currently seen all seem to focus on a single host being scanned for multiple ports." - update the logic to track against multiple IP occurrences vs. multiple ports. –  user48838 Sep 23 '11 at 9:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.