Detecting a host doing a port sweep across multiple interfaces/networks

Question

I'm trying to set up a honey-pot like machine that would detect port sweeps from multiple networks with multiple interfaces.

As an illustration, if I could set up a box with eth1, eth2 and eth3. eth1 is on the 192.168.10.254/24 network eth2 is on the 192.168.20.254/24 network eth2 is on the 192.168.30.254/24 network

If I get a TCP connection from 192.168.99.7 trying to access (say) port 443 on 192.168.[10/20/30].254 in a short period of time, it would generate a alert to the administrator that 192.168.99.7 is most likely compromised and scanning the network.

Anyone have any idea how to set something like that up? All the port sweep detection mechanisms (scanlogd, psad) I've currently seen all seem to focus on a single host being scanned for multiple ports.

Even something knocked up with iptables would be an option if it worked.

Many thanks in advance.

Answer 1

You may be able to adopt the logic of the "multiple ports" approach to a "multiple ports across multiple IPs" assessment.