I have blocked all the basic nmap scans using iptables by making a rule in the INPUT chain that if the no of packet send from a particular ip within 10 seconds exceeds a particular limit then put that ip in blacklist and deny the further packets. This way the nmap SYN Stealth Attack, SYN connect, UDP and all other basic scans are blocked Now I want to block nmap xmas scan. Can somebody tell me how to do that.
I have written the following rules:
$ iptables -A INPUT -m state --state NEW -m recent --set --name NEW
$ iptables -A INPUT -m recent --update --seconds 10 --hitcount 5 --rttl --name NEW -j DROP
Thanks in advance