1*26945a25Schristos 2*26945a25SchristosIP Scan Detetor. 3*26945a25Schristos---------------- 4*26945a25Schristos 5*26945a25SchristosThis program is designed to be a passive listener for TCP packets sent to 6*26945a25Schristosthe host. It does not exercise the promiscous mode of interfaces. For 7*26945a25Schristosrouting Unix boxes (and firewalls which route/proxy) this is sufficient to 8*26945a25Schristosdetect all packets going to/through them. 9*26945a25Schristos 10*26945a25SchristosUpon compiling, a predefined set of "sensitive" ports are configured into 11*26945a25Schristosthe program. Any TCP packets which are seen sent to these ports are counted 12*26945a25Schristosand the IP# of the sending host recorded, along with the time of the first 13*26945a25Schristospacket to that port for that IP#. 14*26945a25Schristos 15*26945a25SchristosAfter a given number of "hits", it will write the current table of packets 16*26945a25Schristosout to disk. This number defaults to 10,000. 17*26945a25Schristos 18*26945a25SchristosTo analyze the information written to disk, a sample program called "ipsdr" 19*26945a25Schristosis used (should but doesn't implement a tree algorithm for storing data) 20*26945a25Schristoswhich reads all log files it recognises and totals up the number of ports 21*26945a25Schristoseach host hit. By default, all ports have the same weighting (1). Another 22*26945a25Schristosgroup of passes is then made over this table using a netmask of 0xfffffffe, 23*26945a25Schristosgrouping all results which fall under the same resulting IP#. This netmask 24*26945a25Schristosis then shrunk back to 0, with a output for each level given. This is aimed 25*26945a25Schristosat detecting port scans done from different hosts on the same subnet (although 26*26945a25SchristosI've not seen this done, if one was trying to do it obscurely...) 27*26945a25Schristos 28*26945a25SchristosLastly, being passive means that no action is taken to stop port scans being 29*26945a25Schristosdone or discourage them. 30*26945a25Schristos 31*26945a25SchristosDarren 32*26945a25Schristosdarrenr@pobox.com 33