4

if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything. is there any solution to that ? maybe using the windows fw on ach workstation to monitor ? Is there a way to create maybe a user defined rule using a default windows firewall, that detects when theres many attempts to connect to the host using many ports and then create a security event? anything like that can be enforced using gpo or something ?

2

Unsure of what you're asking so I will answer based on what I do understand:

if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything.

This makes little sense. If there is a port scan on the same NETWORK and it does not reach the firewall, it is not detectable by anything? Consider the following internal network:

Network     10.10.10.0
Subnet      255.255.255.0
Router      10.10.10.1
Firewall    10.10.10.2

If I am on 10.10.10.3 and scan 10.10.10.4 my port scan may or may not be detected on the firewall depending on your configuration. Once upon a time, there was "PortMagic" port scan detector for Windows, but I would not install that on ANYTHING but a home PC. It is not a commercial tool, and even if it was, you would likely confuse your users or make them paranoid.

Secondly, attackers can mangle portscanning by using decoys, and unless you configure these automated tools properly, you're doing more harm than good. For example, if you configured an automatic block, consider I scan your machine with the IP of 10.10.10.10 with the following syntax:

nmap -sS -vvv -D 10.10.10.2,10.10.10.1 10.10.10.10

-D 10.10.10.2,10.10.10.1 these decoys that I am using will be blocked by 10.10.10.10 which means that machine will be offline. Just because a machine is being portscanned, doesn't mean someone WILL hack that machine. It all boils down to whether or not the machine is vulnerable, and whether or not that vulnerability is EXPLOITABLE.

Think of a house. Every house has windows. Every house is vulnerable. Your house has a security guard on duty, with Rottweilers inside a fence around the perimeter. I can assure you that your house is not exploitable. At least not as easy as the house without any protections. However, even this analogy is not that great because some houses have more windows than others. What is behind those windows? (e.g. what services are you running that someone can exploit.)

2

In short, you will have to use a packet sniffer in order to detect traffic that is not destined for your computer. This requires that your network interface be set in 'monitor' mode in order to take advantage of the way networks route packets. Not all wireless cards can do this, you will have to see if yours is compatible.

Two examples of network sniffers are Wireshark and tcpdump.

If you wanted to go one step further, use an IDS like Snort, as shown in these network topology examples. This would be the optimal way for you to identify and protect against malicious traffic destined for your network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.