This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How works PSD?

I found the following rule in my iptables:

Chain PSD_MATCHER (2 references)
PSD_ACTION tcp -- anywhere anywhere psd weight-threshold: 21 delay-threshold: 300 lo-ports-weight: 3 hi-ports-weight: 1

Can anybody please explain?

Thanks
Barbara

This thread was automatically locked due to age.

0 Polluxxx over 23 years ago

PSD stands for Port Scan Detection.
PSD tries to detect portscans.
if Host A tries to oben many ports of Host B it is detected as a portscan and handled as configured.

hope that helps
kind regards

/polluxxx
Cancel
Vote Up 0 Vote Down

Cancel
0 siska over 23 years ago in reply to Polluxxx

I was especially interested in the meaning of this:
psd weight-threshold: 21
delay-threshold: 300
lo-ports-weight: 3
hi-ports-weight: 1

WHEN precisely ASL thinks a port request is a PSD?
Do you have documentation on this?

Thanks
Barbara
Cancel
Vote Up 0 Vote Down

Cancel