This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Question: Limiting portscan alerts [7.504]

Using Astaro 7.504, with "Limit notifications" enabled in Management-Notifications...

While doing some tests with NMAP (against a single IP), I managed to trigger the portscan detection system, and triggered 311 alerts in the ips.log.

Shortly thereafter, I received exactly 100 emails about portscans detected.

Although 100

This thread was automatically locked due to age.

0 BarryG over 15 years ago

I did some more extensive scans with "Limit notifications" turned off, and again received exactly 100 emails.

Does "Limit notifications" do anything?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 bhodge over 15 years ago in reply to BarryG

Hi BarryG

The limit logging option is time based, it limits entries to 5 line per second.

I suggest you check out th -T and --scan-delay switches in nmap (under Timing and Performance) to avoid this issue during future testing.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 15 years ago

Hi, I'm asking about Limit Notifications, which is a different setting than Limit Logging.

Thanks,
Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 bhodge over 15 years ago in reply to BarryG

hey BarryG,

Sorry stupid mistake
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 15 years ago

Anyone from Astaro care to comment?
Other users seem to be having DOS problems possibly related, e.g.
https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/39861
and
https://community.sophos.com/products/unified-threat-management/astaroorg/f/64/t/57645

Barry
Cancel
Vote Up 0 Vote Down

Cancel