Port Scan Attack Detector is an intrusion detection system which reads Linux iptables log entries. It can send email alerts and generate CSV reports for later analysis.

learn more… | top users | synonyms

0
votes
0answers
14 views

iptables, ufw, and psad - scanned UDP port alerts from router and devices on home network

I have a fresh install of Ubuntu 16.04. I configured iptables, ufw (with gufw), and psad using instructions from https://www.thefanclub.co.za/how-to/how-secure-ubuntu-1604-lts-server-part-1-basics and ...
0
votes
1answer
130 views

PSAD does not start on Ubuntu 14.04

I complied PSAD from source, compilation went smoothly however when I run this command: sudo psad --sig-update I got this: Can't load ...
0
votes
2answers
48 views

PSAD / removed iptables block

I'm pretty new to PSAD but eagerly getting into it to have a safer installation. But some understanding is missing I've had yesterday the following notification : [psad-status] removed iptables ...
0
votes
1answer
71 views

PSAD IPTables logging error

I installed PSAD on my Ubuntu server and then set the IPTables accordingly. But I still get this error by email: You may just need to add a default logging rule to the /sbin/iptables 'filter' ...
2
votes
1answer
474 views

Allow port scans for specific addresses in psad

How to enable port scans for specific address (or range) in psad? By default I get a lot of logs coming from my own monitoring service. How can I tell psad to treat my addresses or domains as trusted ...
-1
votes
1answer
265 views

psad does not detect nmap [closed]

I am new to this and just installed psad. I ran nmap several times on a server but psad didn't log this psad --Status. I configured it like this: ...
1
vote
1answer
558 views

Do we need PSAD if we already have Fail2Ban?

I already have installed Fail2Ban on my server. I planned to install PSAD on it. Are they equal? Isn't it a good idea to keep them both?
1
vote
4answers
3k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
1
vote
1answer
230 views

PSAD Firewall/ UDP flood?

Well I'm actually trying to block a UDP Flood on the Application port because the string "getstatus" is causing my application to make large output due to a small input to the attacker's IP. I ...