I'm trying to set up a honey-pot like machine that would detect port sweeps from multiple networks with multiple interfaces.
As an illustration, if I could set up a box with eth1, eth2 and eth3. eth1 is on the 192.168.10.254/24 network eth2 is on the 192.168.20.254/24 network eth2 is on the 192.168.30.254/24 network
If I get a TCP connection from 192.168.99.7 trying to access (say) port 443 on 192.168.[10/20/30].254 in a short period of time, it would generate a alert to the administrator that 192.168.99.7 is most likely compromised and scanning the network.
Anyone have any idea how to set something like that up? All the port sweep detection mechanisms (scanlogd, psad) I've currently seen all seem to focus on a single host being scanned for multiple ports.
Even something knocked up with iptables would be an option if it worked.
Many thanks in advance.