Watches for TCP connection, records state for the past 1 second - if multiple connections occur from the same host, an internal counter is increased for that IP. If the counter reaches some value (which can be changed in #define) scandetd will send email to administrator. Information sent includes time, ip address, number of connections made, first and last connection times, and guessed type of scan (syn/fin). Logs to syslog by default. Configurable to allow trusted addresses. Tested under linux - possibly sunos and freebsd.
49e46dec1be32115ddc605960a380dbf
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed