Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Imagine that I have to pentest a server that implements portscan detection based on the number of packets received to different ports in a time interval.

I don't know that the server is implementing this protection, I don't want my IP to be blocked and I want to be as fast as possible without being blocked.

How can I detect that the server is implementing this protection? Can I estimate the threshold where my IP will be blocked?

share|improve this question

1 Answer

up vote 3 down vote accepted

Logically you cannot know at which point the server will block you until you actually reach the threshold and be blocked. This is not something that the server will advertise.

If you have a spare IP, you can increase the number of packets per second until you are blocked, at which point you know what threshold not to cross with your other IP.

Good firewalls are likely to use more complex heuristics, depending not only on the number of packets but also the target ports. Chances are that you can work out the actual firewall heuristics by burning a few IP, but you cannot guess it a priori.

share|improve this answer
Do you know any tool to automate this process? I know that with NMap or hping2 I could elaborate a script but I would like to know if already exists any tool. – kinunt Feb 14 at 11:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.