overflowing with security goodness

Register | Login

FilesNewsUsersAuthors

Home Files News About Contact Add New

Showing 1 - 1 of 1

Files

psad-0.9.4.tar.gz

Posted Dec 9, 2001

Site cipherdyne.com

Port Scan Attack Detector (psad) is a perl program that is designed to work with Linux firewalling code (iptables in the 2.4.x kernels, and ipchains in the 2.2.x kernels) to detect port scans. It features a set of highly configurable danger thresholds (with sensible defaults provided), verbose alert messages that include the source, destination, scanned port range, begin and end times, TCP flags and corresponding nmap options (Linux 2.4.x kernels only), email alerting, and automatic blocking of offending IP addresses via dynamic configuration of ipchains/iptables firewall rulesets. In addition, for the 2.4.x kernels psad incorporates many of the TCP signatures included in Snort to detect highly suspect scans for various backdoor programs (e.g. EvilFTP, GirlFriend, SubSeven), DDoS tools (mstream, shaft), and advanced port scans (syn, fin, Xmas) which are easily leveraged against a machine via nmap.

Changes: Added h2xs support so psad will install Psad.pm The Right Way. Added the conntrack_patch kernel patch to fix the iptables ip_conntrack bug which causes packets to be dropped that are part of legitimate tcp sessions. Added the USR1 option to support automatic sending of a USR1 signal to a running psad process. Updated documentation and man page to reflect the above changes.

tags | kernel, perl, tcp

systems | linux

MD5 | 7fae1a92687d1491cb6d614dc71d4640

Download | Favorite | Comments (0)