1

I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor to detect different types of Scanning activities.

However, I was curious to know whether a better independent scan detection tool (not an IDS like Suricata or Bro) exists and if it exists, what are the reasons is it better than Snort Portscan Preprocessor or vice-versa?

Improve this question

1 Answer 1

Reset to default
1

Try looking into Scanlogd http://www.openwall.com/scanlogd/

Also look into psad (Port Scan Attack detector) http://cipherdyne.org/psad/

I havent tried using either of them. Though I am not sure how much better than Snort these will be, I am sure these allow for much higher degree of customization, which may help.

Improve this answer
1
  • 1
    Snort allows lots of tunning,like setting different sensing modes,thresholds,Time windows,etc. .In similar way can you elaborate on "higher degree of customization" ?
    – user10012
    Commented Jun 25, 2016 at 20:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .