Re: Scan of TCP 552-554

[Chris Shepherd <[EMAIL PROTECTED]>]

Quoting Rodrigo Barbosa <[EMAIL PROTECTED]>:
> > In this case, it may make sense to keep your traps on a honeypot box. I'm
> > having a bit of a difficult time understanding exactly what you mean
> > by 'hit my traps faster, so I can react faster'. React how? What would your
> > reaction to a port scan be? If you cite an example, I'll probably have a
> >much clearer idea about what kinds of traps you're talking about. :)
>
> Errr, filter the address or network on the border router ? That is one.
> Contact the admin of the network about the scan is another.

Why take that action for a port scan? You're going to be a very busy admin if
you do all that just for a simple port scan. Those things are unimportant, but
might be useful if logged, or better yet, dropped. :) There's nothing wrong
with a port scan in and of itself, it is just a simple check to see which
services you have listening.

A policy of having a live person react to a port scan is a little farther than
I'd be willing to go ever, which is why I simply have my firewall refuse to
talk on any port that doesn't have a service running. Closed ports are not a
security risk, nor are portscans. The security risks come into play on the
services you already are running. The biggest reason why someone in your shoes
might want to consider using DROP vs REJECT is that it offers a higher delay in
accessing those services. Regardless of your firewall, if you have a service in
place, that is far more likely to become the subject of attack, and wanting to
conceal those services from port scanning is a more intelligent approach (IMO)
than wanting to try and conceal the firewall's existence. The point of
intrusion shouldn't be at the firewall if it is properly configured, but
rather, the hosts behind it that are by necessity running servers (Apache or
IIS for example).

I'm not really sure you gain anything by making your firewall pretend to be a
live host, other than speed up target acquisition for an unfriendly host.

--
Chris Shepherd



---------------------------------------------------------------------------
----------------------------------------------------------------------------