This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Anti-Portscan Not Detecting a Definite Scan

I have seen an ongoing portscan in my Firewall Live Log. Every 11 or 12 seconds the same IP address sends a SYN packet and each time the destination port is incremented by 1. This has been going on for several days now. But my UTM 9 (9.001-18) does not report this and it is clearly a scan in progress.

IPS is on, Anti-Portscan is on, Notifications of Portscans is enabled for email, and I do receive email notifications such as "successful Webadmin login", Executive Reports, etc.

If I hadn't decided to look at the live log, I would have no idea this was happening.

This thread was automatically locked due to age.

Parents

0 BarryG over 13 years ago

Hi,

re log file aggregation and analysis...

Splunk seems to be one of the most well-known (commercial, but has a free version without alerting)

There are some free tools as well. I haven't tried them yet...

OSSIM
ZenOSS
(both of the above do much more than logging and event correlation, but it is one of their main features)

Cisco MARS seems to be reaching End-of-Life, fwiw.
I know the one we have at work is EOL already.
We weren't using most of the advanced features, so we are replacing it with a syslog-ng server for now, and will be adding on one or more of the open-source tools later.

Also see
http://www.quora.com/What-are-the-best-free-alternatives-to-Splunk
http://devopsangle.com/2012/04/19/8-splunk-alternatives/
for some nice lists of applications.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 robertobrinsky over 13 years ago in reply to BarryG

Thanks for the responses. I am also looking at OSSEC to see what it can do, but will look into the others as well.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 robertobrinsky over 13 years ago in reply to BarryG

Thanks for the responses. I am also looking at OSSEC to see what it can do, but will look into the others as well.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 robertobrinsky over 13 years ago in reply to robertobrinsky

So, after doing a Whois, I reported the offending IP Address to the ISP (Rackspace). Lo and behold, the scan has stopped. That's a first as far as I'm concerned. I'm sure I won' hear back from Rackspace but it seems they put a stop to it and enforced their abuse policy.
Cancel
Vote Up 0 Vote Down

Cancel