Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have blocked all the basic nmap scans using iptables by making a rule in the INPUT chain that if the no of packet send from a particular ip within 10 seconds exceeds a particular limit then put that ip in blacklist and deny the further packets. This way the nmap SYN Stealth Attack, SYN connect, UDP and all other basic scans are blocked Now I want to block nmap xmas scan. Can somebody tell me how to do that.

I have written the following rules:

$ iptables -A INPUT -m state --state NEW -m recent --set --name NEW
$ iptables -A INPUT -m recent --update --seconds 10 --hitcount 5 --rttl --name NEW -j DROP

Thanks in advance

share|improve this question
    
Hiding open ports adds nothing. Security be obscurity is no security at all. –  Chris S Sep 28 '11 at 23:32
add comment

2 Answers

Can you be more specific about the rule that you've configured?

As you've described it, it would block an X-mas scan; a packet lit up with flags like a Christmas tree would still be a packet "sent from a particular IP" - but if that's truly how you've set up your rules, then you're likely going to unintentionally ban hosts sending legitimate traffic at a rate that violates the rule.

Don't put a lot of effort into security by obscurity. You service is open to the internet, and a scanner can simply slow their scan rate to a crawl to defeat your rate limit, or they can randomly hit the open port before the block kicks in. Blocking scans is not a substitute for securing your service.

share|improve this answer
3  
+1, although the fact that "Blocking scans is not a substitute for securing your service" doesn't mean scan blocking shouldn't be implemented as well. –  John Gardeniers Sep 23 '11 at 4:36
add comment
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j LOG --log-prefix "XMAS A: "
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j LOG --log-prefix "XMAS B: "
iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP

iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG --log-prefix "XMAS C: "
iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

nmap -sX sends the xmas type B that I have above (I just made "type b" up).

the canonical xmas is type A.

http://techhelplist.com/index.php/tech-tutorials/43-linux-adventures/120-nmap-linux-iptables-xmas-packets

obviously you can add in the time limit stuff.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.