Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a service-specific (SSH, FTP etc.) threshold value, there probably was an port scan or failed login from that source IP address.

Does anyone have experience with this or is there an alternative to establish a centralized brute force detection. It's about protecting a few hundred Linux hosts running different services accessible from the internet (SSH, FTP, HTTP, SMTP, IMAP, POP3).

Fail2ban is already in use but a centralized solution should also be installed.


This sounds like a very inefficient method, mostly because in netflow data you're lacking a lot of information. You only have source and destination IP's, protocols and (if relevant) port numbers, so there's no real way to distinguish valid requests from invalid requests, you're missing the payload for that, which is not available in netflow.

What you're describing are just assumptions on ways to detect attacks on some characteristics, which will most likely lead to a lot of false positives and missed attacks.

You need the payload to see what exactly the request was an IP address was doing. And since that often will be TLS, you need to look at end points where TLS is terminated.

If you don't have it, look into aggregating your fail2ban logs and deploying bans for IP addresses from identified attackers from those logs to all your machines.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.