📄 flow-dscan.html
字号:
<HTML><HEAD><TITLE>flow-dscan</TITLE><METANAME="GENERATOR"CONTENT="Modular DocBook HTML Stylesheet Version 1.71"></HEAD><BODYCLASS="REFENTRY"BGCOLOR="#FFFFFF"TEXT="#000000"LINK="#0000FF"VLINK="#840084"ALINK="#0000FF"><H1><ANAME="AEN1"><SPANCLASS="APPLICATION">flow-dscan</SPAN></A></H1><DIVCLASS="REFNAMEDIV"><ANAME="AEN6"></A><H2>Name</H2><SPANCLASS="APPLICATION">flow-dscan</SPAN> -- Detect scanning and other suspicious network activity.</DIV><DIVCLASS="REFSYNOPSISDIV"><ANAME="AEN10"></A><H2>Synopsis</H2><P><BCLASS="COMMAND">flow-dscan</B> [-bBhlmpwW] [-d<TTCLASS="REPLACEABLE"><I> debug_level</I></TT>] [-D<TTCLASS="REPLACEABLE"><I> iplist_depth</I></TT>] [-s<TTCLASS="REPLACEABLE"><I> state_file</I></TT>] [-i<TTCLASS="REPLACEABLE"><I> input_filter</I></TT>] [-L<TTCLASS="REPLACEABLE"><I> suppress_list</I></TT>] [-o<TTCLASS="REPLACEABLE"><I> output_filter</I></TT>] [-O<TTCLASS="REPLACEABLE"><I> excessive_octets</I></TT>] [-P<TTCLASS="REPLACEABLE"><I> excessive_flows</I></TT>] [-S<TTCLASS="REPLACEABLE"><I> port_scan_trigger</I></TT>] [-t<TTCLASS="REPLACEABLE"><I> ager_timeout</I></TT>]</P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN34"></A><H2>DESCRIPTION</H2><P>The <BCLASS="COMMAND">flow-dscan</B> utility is used to detect suspiciousactivity such as port scanning, host scanning, and flows with unusually high octets or packets. A source and destination suppresslist is supported to help prevent false alarms due to hosts such asnameservers or popular web servers that exchange traffic with a largenumber of hosts. Alarms are logged to syslog or stderr. The internalstate of flow-dscan can be saved and loaded to allow for interrupted operation.</P><P><BCLASS="COMMAND">flow-dscan</B> will work best if configured to only watch only inbound or outboundtraffic by using the input or output interface filter option.</P><P>The host scanner works by counting the length of the destination IPhash chain. If it goes above 64, then the src is considered tobe scanning.</P><P>The port scanner works by keeping a bitmap of the destination portnumber < 1024 per destination IP. If it goes above 64, the src isconsidered to be port scanning the destination.</P><P>When a src has been flagged as scanning it will not be reported againuntil the record is aged out and enough flows trigger it again.</P><P>A SIGHUP signal will instruct flow-dscan to reload the suppress list.</P><P>A SIGUSR1 signal will instruct flow-dscan to dump its internal state.</P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN45"></A><H2>OPTIONS</H2><P></P><DIVCLASS="VARIABLELIST"><DL><DT>-b</DT><DD><P>Do not detach and run in the background. Alerts go to stderr.</P></DD><DT>-B</DT><DD><P>Do not detach and run in the background. Alerts go to syslog.</P></DD><DT>-d<TTCLASS="REPLACEABLE"><I> debug_level</I></TT></DT><DD><P>Enable debugging.</P></DD><DT>-D<TTCLASS="REPLACEABLE"><I> iplist_depth</I></TT></DT><DD><P>Depth of IP host list for detecting host scanning.</P></DD><DT>-h</DT><DD><P>Display help.</P></DD><DT>-i<TTCLASS="REPLACEABLE"><I> input_filter</I></TT></DT><DD><P>Input interface filter list.</P></DD><DT>-I<TTCLASS="REPLACEABLE"><I> output_filter</I></TT></DT><DD><P>Output interface filter list.</P></DD><DT>-l</DT><DD><P>Load state from <TTCLASS="FILENAME">/var/tmp/dscan.state</TT> or the filenamespecified with -s.</P></DD><DT>-L<TTCLASS="REPLACEABLE"><I> suppress_list</I></TT></DT><DD><P>Basename of suppress files. There are two suppress files for input andoutput traffic. The suppress file syntax is</P><P>IP_address protocol source_port destination_port</P><P>A '-' can be used as a wildcard in the protocol, source_port,and destination_port fields. Only a single protocol, source_port, anddestination_port is supported per IP address.</P></DD><DT>-m</DT><DD><P>Multicast address filter. Use to ignore multicast addresses.</P></DD><DT>-O<TTCLASS="REPLACEABLE"><I> excessive_octets</I></TT></DT><DD><P>Trigger an alert if a flow is processed with the octets field exceeding<TTCLASS="REPLACEABLE"><I>excessive_octets</I></TT>.</P></DD><DT>-p</DT><DD><P>Dump state to <TTCLASS="FILENAME">/var/tmp/dscan.state</TT> or the filenamespecified with -s.</P></DD><DT>-P<TTCLASS="REPLACEABLE"><I> excessive_packets</I></TT></DT><DD><P>Trigger an alert if a flow is processed with the packets field exceeding<TTCLASS="REPLACEABLE"><I>excessive_packets</I></TT>.</P></DD><DT>-s<TTCLASS="REPLACEABLE"><I> statefile</I></TT></DT><DD><P>State filename. Defaults to <TTCLASS="FILENAME">/var/tmp/dscan.state</TT></P></DD><DT>-S<TTCLASS="REPLACEABLE"><I> port_scan_trigger</I></TT></DT><DD><P>Number of ports a IP address must have used to be considered scanning.</P></DD><DT>-t<TTCLASS="REPLACEABLE"><I> ager_timeout</I></TT></DT><DD><P>How long to keep flows around. Default to 90000. This is measured inflows processed.</P></DD><DT>-T<TTCLASS="REPLACEABLE"><I> excessive_time</I></TT></DT><DD><P>Trigger an alert if a flow is processed with the End-Start field exceeding<TTCLASS="REPLACEABLE"><I>excessive_time</I></TT>.</P></DD><DT>-w</DT><DD><P>Filter (ignore) candidate inbound www traffic, ie IP protocol 6, source port80, and destination port > 1023.</P></DD><DT>-W</DT><DD><P>Filter (ignore) candidate outbound www traffic, ie IP protocol 6, destinationport 80, and source port > 1023.</P></DD></DL></DIV></DIV><DIVCLASS="REFSECT1"><ANAME="AEN143"></A><H2>EXAMPLES</H2><DIVCLASS="INFORMALEXAMPLE"><ANAME="AEN145"></A><P></P><P>In a topology where 25 is the only output interface run flow-dscan overthe data in <TTCLASS="FILENAME">/flows/krc4</TT>. Ignore www and multicasttraffic, store the internal state in<TTCLASS="FILENAME">dscan.statefile</TT> on exit. Use empty suppress listfiles <TTCLASS="FILENAME">dscan.suppress.src</TT> and<TTCLASS="FILENAME">dscan.suppress.dst</TT>. The output produced by flow-dscantypically must be manually inspected by using flow-filter and flow-print.Many of the alerts will be false until the suppress lists are populatedfor the local environment.</P><P> <BCLASS="COMMAND">flow-cat /flows/krc4 | flow-dscan -I25 -b -m -s dscan.statefile -p -W</B></P><P></P></DIV></DIV><DIVCLASS="REFSECT1"><ANAME="AEN153"></A><H2>BUGS</H2><P>The ager should automatically become more aggressive when a low memorycondition exists.There is no upper limit on the number of records that can be allocated. Ifthe ager is not running often enough the host will be run out of memory.</P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN156"></A><H2>AUTHOR</H2><P>Mark Fullmer<TTCLASS="EMAIL"><<AHREF="mailto:maf@splintered.net">maf@splintered.net</A>></TT></P></DIV><DIVCLASS="REFSECT1"><ANAME="AEN163"></A><H2>SEE ALSO</H2><P><SPANCLASS="APPLICATION">flow-tools</SPAN>(1)</P></DIV></BODY></HTML>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -