Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have blocked all the basic nmap scans using iptables by making a rule in the INPUT chain that if the no of packet send from a particular ip within 10 seconds exceeds a particular limit then put that ip in blacklist and deny the further packets. This way the nmap SYN Stealth Attack, SYN connect, UDP and all other basic scans are blocked Now I want to block nmap xmas scan. Can somebody tell me how to do that.

I have written the following rules:

$ iptables -A INPUT -m state --state NEW -m recent --set --name NEW
$ iptables -A INPUT -m recent --update --seconds 10 --hitcount 5 --rttl --name NEW -j DROP

Thanks in advance

share|improve this question
Hiding open ports adds nothing. Security be obscurity is no security at all. – Chris S Sep 28 '11 at 23:32

Can you be more specific about the rule that you've configured?

As you've described it, it would block an X-mas scan; a packet lit up with flags like a Christmas tree would still be a packet "sent from a particular IP" - but if that's truly how you've set up your rules, then you're likely going to unintentionally ban hosts sending legitimate traffic at a rate that violates the rule.

Don't put a lot of effort into security by obscurity. You service is open to the internet, and a scanner can simply slow their scan rate to a crawl to defeat your rate limit, or they can randomly hit the open port before the block kicks in. Blocking scans is not a substitute for securing your service.

share|improve this answer
+1, although the fact that "Blocking scans is not a substitute for securing your service" doesn't mean scan blocking shouldn't be implemented as well. – John Gardeniers Sep 23 '11 at 4:36
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j LOG --log-prefix "XMAS A: "
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j LOG --log-prefix "XMAS B: "
iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP

iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG --log-prefix "XMAS C: "
iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

nmap -sX sends the xmas type B that I have above (I just made "type b" up).

the canonical xmas is type A.

obviously you can add in the time limit stuff.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.