Port Scan Attack Detector is an intrusion detection system which reads Linux iptables log entries. It can send email alerts and generate CSV reports for later analysis.

learn more… | top users | synonyms

0
votes
0answers
33 views

iptables, ufw, and psad - scanned UDP port alerts from router and devices on home network

I have a fresh install of Ubuntu 16.04. I configured iptables, ufw (with gufw), and psad using instructions from https://www.thefanclub.co.za/how-to/how-secure-ubuntu-1604-lts-server-part-1-basics and ...
0
votes
1answer
156 views

PSAD does not start on Ubuntu 14.04

I complied PSAD from source, compilation went smoothly however when I run this command: sudo psad --sig-update I got this: Can't load '/usr/lib/psad/x86_64-linux-gnu-thread-multi/auto/Date/Calc/...
0
votes
2answers
62 views

PSAD / removed iptables block

I'm pretty new to PSAD but eagerly getting into it to have a safer installation. But some understanding is missing I've had yesterday the following notification : [psad-status] removed iptables ...
0
votes
1answer
75 views

PSAD IPTables logging error

I installed PSAD on my Ubuntu server and then set the IPTables accordingly. But I still get this error by email: You may just need to add a default logging rule to the /sbin/iptables 'filter' '...
2
votes
1answer
599 views

Allow port scans for specific addresses in psad

How to enable port scans for specific address (or range) in psad? By default I get a lot of logs coming from my own monitoring service. How can I tell psad to treat my addresses or domains as trusted ...
-1
votes
1answer
282 views

psad does not detect nmap [closed]

I am new to this and just installed psad. I ran nmap several times on a server but psad didn't log this psad --Status. I configured it like this: http://www.thefanclub.co.za/how-to/how-install-psad-...
1
vote
1answer
584 views

Do we need PSAD if we already have Fail2Ban?

I already have installed Fail2Ban on my server. I planned to install PSAD on it. Are they equal? Isn't it a good idea to keep them both?
1
vote
4answers
3k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
1
vote
1answer
232 views

PSAD Firewall/ UDP flood?

Well I'm actually trying to block a UDP Flood on the Application port because the string "getstatus" is causing my application to make large output due to a small input to the attacker's IP. I ...