Free Software Foundation!

Join now

Port Scan Attack Detector

From Free Software Directory
 
Jump to: navigation,
[edit]

Port Scan Attack Detector

http://www.cipherdyne.com/
Port Scan Attack Detector (psad) works with the Linux kernel firewalling code (iptables in the 2.4.x kernels, and ipchains in the 2.2.x kernels) to detect port scans. It has highly configurable danger thresholds (with sensible defaults provided), verbose alert messages that include the source, destination, scanned port range, begin and end times, TCP flags and corresponding nmap options (Linux 2.4.x kernels only), email alerting, and automatic blocking of offending IP addresses via dynamic configuration of ipchains/iptables firewall rulesets. For the 2.4.x kernels psad incorporates many of the TCP signatures included in Snort to detect suspect scans for various backdoor programs (e.g. EvilFTP, GirlFriend, SubSeven), DDoS tools (mstream, shaft), and advanced port scans (syn, fin, Xmas) can be leveraged against a machine via nmap.

Documentation

User README included and available in HTML format from http://www.cipherdyne.com/psad/psaddoc.html


Download

Download version 1.4.2 (stable)
released on 15 July 2005

Categories

Related Projects




Licensing

LicenseVerified byVerified onNotes
GPLv2orlaterJanet Casey2 May 2002



Leaders and contributors

Contact(s)Role
Michael Rash Maintainer
See the CREDITS file in the distribution for a complete listContributor


Resources and communication

Audience Resource type URI
Developer VCS Repository Webview http://www.cipherdyne.com/cgi/viewcvs.cgi/psad/
Bug Tracking,Developer,Support E-mail mailto:mbr@cipherdyne.com


Software prerequisites

This entry (in part or in whole) was last reviewed on 15 July 2005.



Entry























Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the page “GNU Free Documentation License”.

The copyright and license notices on this page only apply to the text on this page. Any software or copyright-licenses or other similar notices described in this text has its own copyright notice and license, which can usually be found in the distribution or license text itself.


Personal tools
Namespaces

Variants
Actions
Navigation
Contribute