4

I am interested in detecting any nmap scans directed on a (my) GNU/Linux host. I would like to use snort in combination with barnyard2 and snorby for this, or if possible to perform a signature-based detection on snort unified2 logs. I noticed a similar packet to the following pops up when performing a nmap -A scan:

[    0] 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 08 00  ................
[   16] 45 00 00 A2 5C 63 40 00 78 FF 39 03 B9 1E A6 45  E...\c@.x.9....E
[   32] 05 27 08 D3 50 72 69 6F 72 69 74 79 20 43 6F 75  .'..Priority Cou
[   48] 6E 74 3A 20 39 0A 43 6F 6E 6E 65 63 74 69 6F 6E  nt: 9.Connection
[   64] 20 43 6F 75 6E 74 3A 20 38 0A 49 50 20 43 6F 75   Count: 8.IP Cou
[   80] 6E 74 3A 20 32 0A 53 63 61 6E 6E 65 72 20 49 50  nt: 2.Scanner IP
[   96] 20 52 61 6E 67 65 3A 20 38 34 2E 32 34 32 2E 37   Range: 84.242.7
[  112] 36 2E 36 36 3A 31 38 35 2E 33 30 2E 31 36 36 2E  6.66:185.30.166.
[  128] 36 39 0A 50 6F 72 74 2F 50 72 6F 74 6F 20 43 6F  69.Port/Proto Co
[  144] 75 6E 74 3A 20 31 30 0A 50 6F 72 74 2F 50 72 6F  unt: 10.Port/Pro
[  160] 74 6F                                            to

What's the packet above? Does it have to do with nmap, solely? (I highly doubt that)

Unfortunately snort configured with sfPortscan isn't as effective and/or accurate as I want it to be (Scans are detected but due to some reason I can't see details about it, such as source/destination :: http://i.imgur.com/sPCS13b.png , http://i.imgur.com/9BGkkQv.png . I have iptables configured with --hitcount and --seconds which makes "stream5: Reset outside window" pop up, thus I can detect a few scans.).

What are my options here?

2

Have you looked at the emerging threats ruleset? Specifically their scan rules?

You will never detect detect scans with 100% accuracy. Generally speaking, thresholding is useful. On border firewalls on a large network, I look at e.g. number of distinct hosts contacted by a some remote host over a certain period. On a single host, the number of distinct ports on that host in a given period. On the iptables front, a good option is logging DROPed packets. You could do this in snort too. The basic idea is just to monitor some ports that you do not have open. Contact on those ports is by definition unsolicited. (Okay, so that deviates a little bit from the goal of just detecting nmap scans...)

1
  • Great idea (logging dropped packets)! Thanks.
    – niemal010
    Nov 8 '14 at 14:41
1

Do you want to detect an nmap scan as an academic exercise, or are you trying to actually detect attackers who are performing a port scan? The latter can be extremely difficult, since an attacker can slow down the scan and/or distribute the scan across a number of clients in order to defeat any heuristics that you might implement. So, be aware that if this is your goal you're going "down the rabbit hole" :-\

Secondly, And are you simply interested in having the capability of detecting a scan or are you interested in the underlying details of how that can be accomplished? In other words, do you just want to get this done or are you studying this topic?

For the former, there are various IDS tools that you can install such as Snort and Bro, and numerous commercial offerings. Understand however that they will likely only be able to detect certain types of scans, such as a scan of monotonically increasing TCP port numbers, for example.

For the latter, if you want to understand what network traffic is generated by typical nmap scans so that you can then look for those patterns, then I suggest running nmap - perhaps over a small number of ports - and examining the traffic that it generates using a sniffer such as tcpdump. You can then implement signatures/rules within whatever system you're building.

Hope this helps!

2
  • What I am trying to accomplish is detecting potential reconnaissance oriented actions. Not only I am trying to understand (studying) the details of how that can be accomplished, but I also want the capability to do so. I already have snort installed. Greg Browser's answer regarding logging and monitoring dropped packets is a smart and good way to accomplish this, it seems. Thank you for your effort and answer.
    – niemal010
    Nov 8 '14 at 14:56
  • No worries. I suspect that many attackers will only scan for the ports that they are subsequently interested in attacking. So 80/443/etc. And since you're probably listening on those ports, they wouldn't show up as drops. I think the days when people scan 1-1024 or 1-65535 are long gone...
    – user90703
    Nov 8 '14 at 17:21
0

The passive operating system identifier, p0f, can identify nmap scans, at least of some types. Bear in mind that nmap can do a lot of different types of scans from simple ping scans to very exotic. What you're asking might not be 100% possible.

1
  • I believe that's pretty much what I got right now (snort), thanks for answering though. Also, I have seen servers filtering/resisting scans in a really effective way. Probably it's not 100% possible, but you could get up to 90 plus.
    – niemal010
    Nov 8 '14 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.