Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When someone tries to a blacklisted port, I'd like that IP address to be blocked at the firewall, for everything. Even port 80. Essentially I have a webserver, and see folks walking through ports to see what's available. Obviously, they're up to no good and I'd like to slam the door on them. Is there a script that can do this? Even if it's cron based, that's fine...

share|improve this question
    
This is probably a question for ServerFault. –  Steven Lu Dec 30 '09 at 19:59

1 Answer 1

up vote 2 down vote accepted

You're probably looking for psad.

psad is a collection of three lightweight system daemons (two main daemons and one helper daemon) that run on Linux machines and analyze iptables log messages to detect port scans and other suspicious traffic. A typical deployment is to run psad on the iptables firewall where it has the fastest access to log data.

alt text

And here is a great tutorial on Detecting And Blocking Port Scan Attacks In Real Time.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.