Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Some of our users are launching port scans on Internet servers. These users connect to our servers using ssh and openvpn. We obviously suspend their accounts where appropriate however I'd like to find a technical solution that either prevents the scan or discourages them (e.g. by slowing it down).

The best solution I have come up with is (which is aimed at SYN scanning):

# Log suspected port scanners 
iptables -A Limit_Pscan -p tcp --syn -m state --state NEW -m recent --name port_scan --rcheck --seconds 10 --hitcount 30 -j LOG --log-prefix 'PORT SCANNER(?): '

# Drop connections where packets > 29 in 10 second period.
iptables -A Limit_Pscan -p tcp --syn -m state --state NEW -m recent --update --name port_scan  --seconds 10 --hitcount 30 -j DROP

# Allow and add the source address of the packet to the port_scan list
iptables -A Limit_Pscan -p tcp --syn -m state --state NEW -m recent --set --name port_scan 

However this obviously catches a lot of legitimate traffic. In my testing if I restart my browser with a few dozen tabs it opens enough connections that most of the tabs timeout. I can't seem to find a balance and am thinking that perhaps there is a better way. Any ideas?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

It seems to me that a portscan can be best weeded out from legitimate traffic by looking for a program checking > 5 ports on a single machine, or by checking the same port on some number of machines. The second one is trickier because there are plenty of applications which will legitimately talk to lots of hosts on the same port in a short period of time (such as with your web browser problem).

I would also look for a high number of TCP RST packets or ICMP errors (for UDP scans, usually ICMP unreachable).

While I can't get to the site at the moment, psad (port scan attack detector) may also give you a greater degree of flexibility, though I'm not sure how it reacts to being a detector on the originating system. It's usually run on target hosts to stop scans.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.