Grant Taylor wrote:
On 09/23/08 01:51, bahamin takhtaei wrote:
Do you know How to use iptables against Portsweep attacks?
There use to be a Port Scan Detection (psd) match extension that would
help detecting this easier. I.e. did it look like a system was
initiating a port scan, and if so, handle it accordingly (drop /
reject / tar pit / etc.). I don't know what the current state of the
psd match is, so you will have to find out.
FWIW, my Netgear DG834N has this in a chain called DOS:
SCAN all -- anywhere anywhere psd weight-threshold: 21 delay-threshold: 300 lo-ports-weight: 3 hi-ports-weight: 1
Netgear make their source available so you could try looking there.
jch
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
