Re: Port scan detection with pf

> I found that iptables has (via patch-o-matic) a option to build a

Blech. It is a nightmare doing portscan detection in-kernel. You have to track states _far_ too long after they've expired. It ends up consuming tons of memory which we just can't afford to dedicate to it in-kernel.

You'd be better off writing something to monitor pflog0 to watch for blocked packets and blocking those hosts. You'd be on your own as to a whitelisting valid hosts. I haven't seen anything that can set up a good whitelist without tens of hours of manual work and I haven't met a good FW admin yet who wasn't also a damn lazy bastard (me included).

.mike Received on Sat Nov 30 17:29:08 2002