Very Computer

by **highlande** » Mon, 11 Dec 2000 21:03:33

Hello
Does it exist scaner under linux which can scan many adreses
looking for a special one (for example with opened port 23) ?
What about scaners using SYNC method (not fully connecting)?
How can i secure before such scaner?
Are there any logs? What can i do?
Can I identify IP which scanned me?

Thanx
Michael

by **sver** » Tue, 12 Dec 2000 07:27:43

>Hello
> Does it exist scaner under linux which can scan many adreses
>looking for a special one (for example with opened port 23) ?
>What about scaners using SYNC method (not fully connecting)?
>How can i secure before such scaner?
>Are there any logs? What can i do?
>Can I identify IP which scanned me?

>Thanx
>Michael

try Portsentry from http://www.psionic.com - it can respond to
port scans for exapmle by adding an entry into /etc/hosts.deny
or adding a new ipchains rule... and yes, it does detect SYN stealth
scans too

by **Michael Erskin** » Tue, 12 Dec 2000 07:33:05

> Hello
> Does it exist scaner under linux which can scan many adreses
> looking for a special one (for example with opened port 23) ?

Yes, nmap.

Quote:> What about scaners using SYN method (not fully connecting)?

Yes, nmap.

Quote:> How can i secure before such scaner?

ipchains
man 5 hosts_access
tcpwrappers
scanlogd

Quote:> Are there any logs?

man syslogd
Check /var/log/*

Quote:> What can i do?
> Can I identify IP which scanned me?

In the logs.

Quote:
> Thanx
> Michael

--
Remember it's one piece of string, two bits of wood, three feathers, all
the rest is propaganda. The only accuracy requirement is to be able to hit
a Frenchman on a horse at 200 paces or on foot at 60.

Very Computer

scanning and security

scanning and security

scanning and security

scanning and security