In an internal network, all machines are firewalled from each other. The firewall has port scan detection and blocking mechanism (say, psd
module of iptables
).
Question: What are the ways I can block internal port scans while avoiding DoS threat? Say, an internal attacker might impersonate/spoof the domain server's IP address while port scanning the network and get the domain server's IP blocked on the firewall. How do I avoid that?
I know that IP spoofing attacks from outside trying to impersonate internal address (and vice-versa) can be prevented via ingress/egress filtering. But what about only internal addresses?
Another way to prevent this is TCP packet numbering (same Wikipedia link). But what about non-TCP scans?
What other strategies are available?