1

I run the following iptables commands to detect and log a port scan:

iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 -j LOG --log-prefix "Port Scan on INPUT: "
iptables -A FORWARD -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A FORWARD -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 -j LOG --log-prefix "Port Scan on FORWARD: "

And this works great! However, when I run a port scan on all 65535 ports, my log file grows by 33 megabytes. This is because iptables will log once after the 20th new port connection and every other connection after that.

What type of command would I have to run to log only after the first 20 connections were made or every time 20 connections are made?

2

I figured out a way to do it:

iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 -m limit --limit 1/m --limit-burst 1  -j LOG --log-prefix "Port Scan on INPUT: "
iptables -A FORWARD -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A FORWARD -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 -m limit --limit 1/m --limit-burst 1 -j LOG --log-prefix "Port Scan on FORWARD: "

Basically, I put a limit of 1 minute on the rule after it is hit the first time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.