Network port monitor ideas

[Tim Nelson]

I used to use PortSentry to monitor in-active ports for external scan detection. It work in conjunction with TCP-Wrappers to black list the offending source.

PortSentry was aquired by Cisco in the last couple years and is no longer available for minimal charge.

I am looking to see what others are using to detect active port scans on HPUX servers and take some action on them ?

Tripwire and HIDS are all after the intrusion detectors, hoping to find the before the intrusion.

Appreciate the ideas.

T.

[Steven E. Protter · Accepted solution]

Shalom,

http://www.fail2ban.org/

You might be able to compile this open source product.

Now it issues an iptables command under linux to temporarily block ip addresses doing nasty things.

You can probably convert those commands into ipfilter firewall commands.

The open source port guarding products from Linux are also another possible source of something you can compile to to the job.

SEP