Port Scan Attack Detector 2.1.1 (Default branch) |
|
|
The Port Scan Attack Detector (psad) is a
collection of three system daemons that are
designed to work with the Linux iptables
firewalling code to detect port scans and other
suspect traffic. It features a set of highly
configurable danger thresholds (with sensible
defaults), verbose alert messages, email alerting,
DShield reporting, and automatic blocking of
offending IP addresses. Psad incorporates many of
the packet signatures included in Snort to detect
various kinds of suspicious scans, and implements
the same passive OS fingerprinting algorithm used
by p0f.
License: GNU General Public License (GPL)
Changes:
A new feature whereby iptables log data can be acquired just by parsing an existing file (/var/log/messages by default) that is written to by syslog was added. Better installation support was provided for various Linux distributions, including Fedora 8 and Ubuntu. Situations where either the /var/log/psad/fwdata file or the /var/log/messages file (whichever syslog is writing iptables log messages to) gets rotated are now handled automatically.
|
