Is it possible to detect a portscan with nc or a socket listener?

abefroman · 02-17-2017, 06:49 AM

Is it possible to detect a portscan with nc or a socket listener?

I ran

Code:

nc -k -v -l 3389

On one server, then:

Code:

nmap -O 55.55.55.55

on another server, and nmap detected the port as open, but nc didn't display anything.

If it did a telnet from the 2nd server it did show up on netcat however.

If there a way to get netcat to display info for a port scan?

Would a stock listener in Python or Perl work any better?

camp0 · 02-17-2017, 07:14 AM

Hi,

I don't think you can detect a port scanning by having just one process listening on one port. However, some port scanners do scanning at application layer, for check what type of apache version do you have for example, but from the perspective of nc I don't think you can detect a port scanning just by having one process listening in one port. Probably if you launch multiple instances of nc on different ports you can do it for sure.

Regards

ntubski · 02-17-2017, 03:33 PM

https://nmap.org/book/man-port-scanning-techniques.html

Quote:

SYN scan is the default[...] It is also relatively unobtrusive and stealthy since it never completes TCP connections
[...]
TCP connect scan is the default TCP scan type when SYN scan is not an option. This is the case when a user does not have raw packet privileges.[...]
Not only does this take longer and require more packets to obtain the same information, but target machines are more likely to log the connection. A decent IDS will catch either,[...]

IDS == Intrusion Detection System.

abefroman · 02-17-2017, 03:35 PM

Quote:

Originally Posted by ntubski

https://nmap.org/book/man-port-scanning-techniques.html

IDS == Intrusion Detection System.

What's a more basic way to log it rather than using an IDS? IE. there must be a way to do it with a single script, since an IDS doesn't have to be built into the kernel or anything.

ntubski · 02-17-2017, 05:19 PM

I guess tcpdump might work.

abefroman · 02-19-2017, 05:35 PM

What kind of socket listener does tcpdump use then? If must be utilizing some C++ function.,

ntubski · 02-19-2017, 06:13 PM

abefroman · 02-19-2017, 06:44 PM

Quote:

Originally Posted by ntubski

pcap

Is there a pcap library for Python, that would detect syn traffic?

ntubski · 02-19-2017, 07:34 PM

Quote:

Originally Posted by abefroman

Is there a pcap library for Python, that would detect syn traffic?

I'm sure there are. The key is to find something that lets you work with raw sockets, so can go beneath the TCP abstraction (AFAIK, pcap does allow this).

abefroman · 02-19-2017, 07:54 PM

Is it possible to do it with socket.socket?

I have the following but it seems to be picking up all traffic, rather than just port 5454, nor does the script show up on netstat on port 5454. (And it does seem to be detecting syn traffic).

Code:

import socket

try:
    s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
except socket.error as e:
    print('Socket creation failed. Error Code {} Message {}'.format(str(e[0]),str(e[1])))
    sys.exit()

#Include IP headers
server_address = ('11.11.11.11', 5454)
s.bind(('11.11.11.11', '5454'))
s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
while 1:
  packet = s.recvfrom(65565)
  print(packet)

ntubski · 02-20-2017, 07:52 AM

Quote:

Originally Posted by abefroman

Is it possible to do it with socket.socket?

I have the following but it seems to be picking up all traffic, rather than just port 5454, nor does the script show up on netstat on port 5454.

Yes, that's because the port number is part of the TCP abstraction. You should be able to use socket.setsockopt() to add filters as described here: https://www.kernel.org/doc/Documenta...ing/filter.txt

r3sistance · 02-20-2017, 08:07 AM

you can detect portscans using iptables, but you'd need to work around any current rules and use either the recent or limit modules. You can also mix in ipsets for more fun on it and iptables does have the ability to log activity too. It is the way I'd do it on a production server.

abefroman · 02-20-2017, 09:26 AM

Quote:

Originally Posted by ntubski

I'm sure there are. The key is to find something that lets you work with raw sockets, so can go beneath the TCP abstraction (AFAIK, pcap does allow this).

If you're talking about using accept_filter, that probably won't work because listen() needs to be called first. Especailly since it is a connectionless system (SYN / followed by reset).

abefroman · 02-20-2017, 07:25 PM

It seems I either have to pull the port out of the header and use an if statement, or scapy.sniff with a filter for the port.

Would one method be better than the other?

ntubski · 02-20-2017, 07:43 PM

Quote:

Originally Posted by abefroman

It seems I either have to pull the port out of the header and use an if statement, or scapy.sniff with a filter for the port.

Would one method be better than the other?

You're referring to http://www.secdev.org/projects/scapy....html#sniffing? I guess it's a nicer interface to the kernel filter I linked to before. That method would probably be better in terms of efficiency.