Date: Mon, 22 Sep 2008 13:05:12 -0700 From: "David Allen" <the.real.david.allen@gmail.com> To: freebsd-questions@freebsd.org Subject: Re: Dealing with portscans Message-ID: <2daa8b4e0809221305v6f5000f1w11090e4a85c21162@mail.gmail.com> In-Reply-To: <20080922200121.289abdcb.ghirai@ghirai.com> References: <2daa8b4e0809220817v10c4a657l6ee76f853a62b246@mail.gmail.com> <20080922200121.289abdcb.ghirai@ghirai.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 9/22/08, Ghirai <ghirai@ghirai.com> wrote: > On Mon, 22 Sep 2008 08:17:02 -0700 > "David Allen" <the.real.david.allen@gmail.com> wrote: > >> Over the last few weeks I've been getting numerous ports scans, each >> from unique hosts. The situation is more of an annoyance than >> anything else, but I would prefer not seeing or having to deal with >> an extra 20-30K entries in my logs as was the case recently. >> >> I use pf for firewalling, and while it does offer different methods >> (max-src-conn, max-src-conn-rate, etc.) for dealing with abusive >> hosts, it doesn't seem to offer much in the way of dealing with >> repeated blocked (non-stateful) connection attempts from a given host. >> >> Short of running something like snort, is there a suitable tool for >> dealing with this? If not, I'll probably resort to running a cronjob >> to parse the logfile and add the offending hosts manually. > > Add the abusive hosts to a table x, via max-src-conn, max-src-conn-rate, > etc., then add near the top of your ruleset: > > block drop quick from <x> You either didn't read my message or have misunderstood pf. The features you (and I) mention apply only to rules which create state. If your rules are written for port 22, 25, and 80 traffic, for example, you can most certainly can make use of those features. However, receiving SYN packets to ports 1024-40000 isn't going to match anything than a default "block all" rule, which creates no state. That gives you zero such features to work with, but does give you 38976 individual log entries.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?2daa8b4e0809221305v6f5000f1w11090e4a85c21162>