NAME

       scanlogd - detects and logs TCP port scans

SYNOPSIS

       scanlogd

DESCRIPTION

       scanlogd detects port scans and writes one line per scan via the syslog(3) mechanism. If a source address
       sends multiple packets to different ports in a short time, the event will be logged. The  format  of  the
       messages is:

       saddr[:sport] to daddr [and others,] ports port[, port...], ..., flags[, TOS TOS][, TTL TTL] @HH:MM:SS

       The  fields  in  square  brackets  are  optional; sport, TOS, and TTL will only be displayed if they were
       constant during the scan.

       The flags field represents TCP control bits seen in packets coming to the system from the address of  the
       scan.  It is a combination of eight characters, with each corresponding to one of the six defined and two
       reserved TCP control bits (see RFC 793). Control bits that were always set are encoded with an  uppercase
       letter,  and  a lowercase letter is used if the bit was always clear. A question mark is used to indicate
       bits that changed from packet to packet.

INTERFACES

       In order to do its job, scanlogd needs a way to obtain raw IP packets that  either  come  to  the  system
       scanlogd  is  running  on,  or  travel across a network segment that is directly connected to the system.
       Current versions of scanlogd can be built with support for one of several packet capture interfaces.

       scanlogd is aware of the raw socket interface on Linux, libnids, and libpcap.

       The use of libpcap alone is discouraged. If you're on a system other than Linux and/or  want  to  monitor
       the  traffic  of  an entire network at once, you should be using libnids in order to handle fragmented IP
       packets.

COMPILE-TIME DEFAULTS

       At least 7 different privileged or 21 non-privileged ports, or a weighted combination of those,  have  to
       be  accessed  with no longer than 3 seconds between the accesses to be treated as a scan.  If more than 5
       scans are detected within 20 seconds, that event will be logged and logging will be stopped temporarily.

       Logging is done with a facility of daemon and a priority level alert.

       scanlogd should be started as root since it needs access to a packet capture interface.  By  default,  it
       chroots  to  /var/empty  and  switches  to running as user scanlogd after the packet capture interface is
       initialized.

EXIT STATUS

       If the daemon couldn't start up successfully, it will exit with a status of 1.

USAGE

       You're expected to create a dummy user for scanlogd to run as. Make sure you allocate unique UID and  GID
       to the user.

       In most cases, scanlogd should be started from a rc.d script on system startup.

       In /etc/syslog.conf you may use something like:

       daemon.alert   /var/log/alert

SECURITY NOTES

       As  the  name indicates, scanlogd only logs port scans.  It does not prevent them.  You will only receive
       summarized information in the system's log.

       Obviously, the source address of port scans can be spoofed.  Don't take any action against the source  of
       attacks  unless other evidence is available.  Sometimes IP addresses are shared between many people; this
       is  the  case  for  ISP  shell  servers,  dynamic  dialup  pools,  and  corporate  networks  behind   NAT
       (masquerading).

BUGS

       Due  to  the nature of port scans, both false positives (detecting a scan when there isn't one) and false
       negatives (not detecting a scan when there's one) are possible. In particular, false positives occur when
       many small files are transferred rapidly with passive mode FTP.

AUTHORS

       Solar Designer <solar at openwall.com>
       Steffen Dettmer <steffen at dett.de> wrote the initial version of this manual page.

SEE ALSO

       syslog(3), syslog.conf(5), libnids(3), pcap(3)
       scanlogd home page: http://www.openwall.com/scanlogd/
       Phrack Magazine, issue 53, article 13