From owner-freebsd-questions@FreeBSD.ORG  Mon Sep 22 15:47:51 2008
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 5315B1065671
	for <freebsd-questions@freebsd.org>;
	Mon, 22 Sep 2008 15:47:51 +0000 (UTC)
	(envelope-from the.real.david.allen@gmail.com)
Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.173])
	by mx1.freebsd.org (Postfix) with ESMTP id 2D7918FC1C
	for <freebsd-questions@freebsd.org>;
	Mon, 22 Sep 2008 15:47:51 +0000 (UTC)
	(envelope-from the.real.david.allen@gmail.com)
Received: by wf-out-1314.google.com with SMTP id 24so1652602wfg.7
	for <freebsd-questions@freebsd.org>;
	Mon, 22 Sep 2008 08:47:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:received:received:message-id:date:from:to
	:subject:mime-version:content-type:content-transfer-encoding
	:content-disposition;
	bh=q7o1nbHfonETOm4XhQOvn1qTDJFRVBT68RqzZwVq2gQ=;
	b=o77l6OyX0emwQ4NfhY2AXo0/HNdUNOh6MNdkQ6XEg4IZ6bKEakLFQkicxBwFUObV8S
	XE1sHs+8w8Bn0AMrODjqGg2vprjMRT5stHo4eWPD0KoSYMOrJUotMJSaaE7ePekpdyhf
	PLsbzkpj5A3KfqQzLNEtNAMAogvpPa6FFmnRk=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=message-id:date:from:to:subject:mime-version:content-type
	:content-transfer-encoding:content-disposition;
	b=isc502WPF469neep1n93MnDqhpU4YCw57gGs3hMf4ijulNKAvTqUtyBrBJNeKHERFY
	KUsfXYzg9rDIZjITEF4N0TLIF/WO6cRBzjJBLDFqaE5PGXTnRV4ZYSa569S7MxZMsH3O
	M+uICZdLrs6pGCRJ88BxsGkwH/NyqFRPCwD8c=
Received: by 10.115.111.1 with SMTP id o1mr4732312wam.100.1222096622484;
	Mon, 22 Sep 2008 08:17:02 -0700 (PDT)
Received: by 10.114.47.16 with HTTP; Mon, 22 Sep 2008 08:17:02 -0700 (PDT)
Message-ID: <2daa8b4e0809220817v10c4a657l6ee76f853a62b246@mail.gmail.com>
Date: Mon, 22 Sep 2008 08:17:02 -0700
From: "David Allen" <the.real.david.allen@gmail.com>
To: freebsd-questions@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Subject: Dealing with portscans
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 22 Sep 2008 15:47:51 -0000

Over the last few weeks I've been getting numerous ports scans, each from
unique hosts.  The situation is more of an annoyance than anything else,
but I would prefer not seeing or having to deal with an extra 20-30K
entries in my logs as was the case recently.

I use pf for firewalling, and while it does offer different methods
(max-src-conn, max-src-conn-rate, etc.) for dealing with abusive hosts, it
doesn't seem to offer much in the way of dealing with repeated blocked
(non-stateful) connection attempts from a given host.

Short of running something like snort, is there a suitable tool for
dealing with this?  If not, I'll probably resort to running a cronjob to
parse the logfile and add the offending hosts manually.