From owner-freebsd-ipfw@FreeBSD.ORG  Thu May 12 13:12:43 2005
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6D51B16A4CE
	for <freebsd-ipfw@freebsd.org>; Thu, 12 May 2005 13:12:43 +0000 (GMT)
Received: from smtp.freemail.gr (smtp.freemail.gr [213.239.180.35])
	by mx1.FreeBSD.org (Postfix) with ESMTP id ED48A43D3F
	for <freebsd-ipfw@freebsd.org>; Thu, 12 May 2005 13:12:42 +0000 (GMT)
	(envelope-from dionch@freemail.gr)
Received: by smtp.freemail.gr (Postfix, from userid 101)
	id 52936BC0FE; Thu, 12 May 2005 16:12:41 +0300 (EEST)
Received: from R3B (vdp2048.ath03.dsl.hol.gr [62.38.169.49])by
	smtp.freemail.gr (Postfix) with ESMTP id 44B4FBC0ECfor
	<freebsd-ipfw@freebsd.org>; Thu, 12 May 2005 16:12:29 +0300 (EEST)
Message-ID: <006501c556f4$371a3300$0100000a@R3B>
From: "Chris Dionissopoulos" <dionch@freemail.gr>
To: <freebsd-ipfw@freebsd.org>
References: <00a901c556e3$766ae8d0$0100030a@admin>
Date: Thu, 12 May 2005 16:11:44 +0300
MIME-Version: 1.0
Content-Type: text/plain;format=flowed;charset="koi8-r";reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Subject: Re: syn scan
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: Chris Dionissopoulos <dionch@freemail.gr>
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 12 May 2005 13:12:43 -0000

> Is it possible to detect and/or disable nmap SYN scan with ipfw?
> I've added rule follow below, it catchs some packets from nmap but not all
>
> deny tcp from any to me dst-port 22,25,53,80,443 \
>                                       tcpflags 
> syn,!fin,!ack,!psh,!rst,!urg
> \
>                                       tcpoptions mss,window,!sack,ts,!cc
> may be is't rigth way to intrusion detection/prevention system, may be
> snort?
>
Try snort + snortsam (ipfw2) plugin.
http://www.snortsam.net/



____________________________________________________________________
http://www.freemail.gr - δωρεάν υπηρεσία ηλεκτρονικού ταχυδρομείου.
http://www.freemail.gr - free email service for the Greek-speaking.