Cfrtjryk

I am interested in detecting any nmap scans directed on a (my) GNU/Linux host. I would like to use snort in combination with barnyard2 and snorby for this, or if possible to perform a signature-based detection on snort unified2 logs. I noticed a similar packet to the following pops up when performing a nmap -A scan:

[    0] 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 08 00  ................

[   16] 45 00 00 A2 5C 63 40 00 78 FF 39 03 B9 1E A6 45  E...c@.x.9....E

[   32] 05 27 08 D3 50 72 69 6F 72 69 74 79 20 43 6F 75  .'..Priority Cou

[   48] 6E 74 3A 20 39 0A 43 6F 6E 6E 65 63 74 69 6F 6E  nt: 9.Connection

[   64] 20 43 6F 75 6E 74 3A 20 38 0A 49 50 20 43 6F 75   Count: 8.IP Cou

[   80] 6E 74 3A 20 32 0A 53 63 61 6E 6E 65 72 20 49 50  nt: 2.Scanner IP

[   96] 20 52 61 6E 67 65 3A 20 38 34 2E 32 34 32 2E 37   Range: 84.242.7

[  112] 36 2E 36 36 3A 31 38 35 2E 33 30 2E 31 36 36 2E  6.66:185.30.166.

[  128] 36 39 0A 50 6F 72 74 2F 50 72 6F 74 6F 20 43 6F  69.Port/Proto Co

[  144] 75 6E 74 3A 20 31 30 0A 50 6F 72 74 2F 50 72 6F  unt: 10.Port/Pro

[  160] 74 6F                                            to

What's the packet above? Does it have to do with nmap, solely? (I highly doubt that)

Unfortunately snort configured with sfPortscan isn't as effective and/or accurate as I want it to be (Scans are detected but due to some reason I can't see details about it, such as source/destination :: http://i.imgur.com/sPCS13b.png , http://i.imgur.com/9BGkkQv.png . I have iptables configured with --hitcount and --seconds which makes "stream5: Reset outside window" pop up, thus I can detect a few scans.).

What are my options here?

Have you looked at the emerging threats ruleset? Specifically their scan rules?

You will never detect detect scans with 100% accuracy. Generally speaking, thresholding is useful. On border firewalls on a large network, I look at e.g. number of distinct hosts contacted by a some remote host over a certain period. On a single host, the number of distinct ports on that host in a given period. On the iptables front, a good option is logging DROPed packets. You could do this in snort too. The basic idea is just to monitor some ports that you do not have open. Contact on those ports is by definition unsolicited. (Okay, so that deviates a little bit from the goal of just detecting nmap scans...)

Do you want to detect an nmap scan as an academic exercise, or are you trying to actually detect attackers who are performing a port scan? The latter can be extremely difficult, since an attacker can slow down the scan and/or distribute the scan across a number of clients in order to defeat any heuristics that you might implement. So, be aware that if this is your goal you're going "down the rabbit hole" :-

Secondly, And are you simply interested in having the capability of detecting a scan or are you interested in the underlying details of how that can be accomplished? In other words, do you just want to get this done or are you studying this topic?

For the former, there are various IDS tools that you can install such as Snort and Bro, and numerous commercial offerings. Understand however that they will likely only be able to detect certain types of scans, such as a scan of monotonically increasing TCP port numbers, for example.

For the latter, if you want to understand what network traffic is generated by typical nmap scans so that you can then look for those patterns, then I suggest running nmap - perhaps over a small number of ports - and examining the traffic that it generates using a sniffer such as tcpdump. You can then implement signatures/rules within whatever system you're building.

Hope this helps!

The passive operating system identifier, p0f, can identify nmap scans, at least of some types. Bear in mind that nmap can do a lot of different types of scans from simple ping scans to very exotic. What you're asking might not be 100% possible.