Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
flow-dscan(1)		    General Commands Manual		 flow-dscan(1)

       flow-dscan -- Detect scanning and other suspicious network activity.

       flow-dscan   [-bBhlmpwW]	  [-d  debug_level]   [-D  iplist_depth]   [-s
       state_file]  [-i	input_filter]  [-L suppress_list]  [-o	output_filter]
       [-O  excessive_octets]	[-P  excessive_flows]	[-S port_scan_trigger]
       [-t ager_timeout]

       The flow-dscan utility is used to detect	suspicious  activity  such  as
       port  scanning,	host scanning, and flows with unusually	high octets or
       packets.	 A source and destination suppress list	is supported  to  help
       prevent	false  alarms  due to hosts such as nameservers	or popular web
       servers that exchange traffic with a large number of hosts.  Alarms are
       logged  to  syslog  or stderr.  The internal state of flow-dscan	can be
       saved and loaded	to allow for interrupted operation.

       flow-dscan will work best if configured to only watch only  inbound  or
       outbound	traffic	by using the input or output interface filter option.

       The  host  scanner  works  by counting the length of the	destination IP
       hash chain.  If it goes above 64, then the  src	is  considered	to  be

       The port	scanner	works by keeping a bitmap of the destination port num-
       ber < 1024 per destination IP.  If it goes above	64, the	src is consid-
       ered to be port scanning	the destination.

       When  a	src has	been flagged as	scanning it will not be	reported again
       until the record	is aged	out and	enough flows trigger it	again.

       A SIGHUP	signal will instruct flow-dscan	to reload the suppress list.

       A SIGUSR1 signal	will instruct flow-dscan to dump its internal state.

       -b	 Do not	detach and  run	 in  the  background.	Alerts	go  to

       -B	 Do  not  detach and run in the	background.  Alerts go to sys-

       -d debug_level
		 Enable	debugging.

       -D iplist_depth
		 Depth of IP host list for detecting host scanning.

       -h	 Display help.

       -i input_filter
		 Input interface filter	list.

       -I output_filter
		 Output	interface filter list.

       -l	 Load state from /var/tmp/dscan.state or the  filename	speci-
		 fied with -s.

       -L suppress_list
		 Basename of suppress files.  There are	two suppress files for
		 input and output traffic.  The	suppress file syntax is

		 IP_address protocol source_port destination_port

		 A '-' can be used as a	wildcard in the	protocol, source_port,
		 and   destination_port	  fields.   Only  a  single  protocol,
		 source_port, and destination_port is  supported  per  IP  ad-

       -m	 Multicast address filter.  Use	to ignore multicast addresses.

       -O excessive_octets
		 Trigger an alert if a flow is processed with the octets field
		 exceeding excessive_octets.

       -p	 Dump state to /var/tmp/dscan.state or the filename  specified
		 with -s.

       -P excessive_packets
		 Trigger  an  alert  if	 a  flow is processed with the packets
		 field exceeding excessive_packets.

       -s statefile
		 State filename.  Defaults to /var/tmp/dscan.state

       -S port_scan_trigger
		 Number	of ports a IP address must have	used to	be  considered

       -t ager_timeout
		 How  long  to	keep flows around.  Default to 90000.  This is
		 measured in flows processed.

       -T excessive_time
		 Trigger an alert if a flow is processed  with	the  End-Start
		 field exceeding excessive_time.

       -w	 Filter	(ignore) candidate inbound www traffic,	ie IP protocol
		 6, source port	80, and	destination port > 1023.

       -W	 Filter	(ignore) candidate outbound www	traffic, ie IP	proto-
		 col 6,	destination port 80, and source	 port >	1023.

       In a topology where 25 is the only output interface run flow-dscan over
       the data	in /flows/krc4.	 Ignore	www and	multicast traffic,  store  the
       internal	 state	in  dscan.statefile  on	exit.  Use empty suppress list
       files dscan.suppress.src	and dscan.suppress.dst.	 The  output  produced
       by flow-dscan typically must be manually	inspected by using flow-filter
       and flow-print.	Many of	the alerts will	be false  until	 the  suppress
       lists are populated for the local environment.

	 flow-cat /flows/krc4 |	flow-dscan -I25	-b -m -s dscan.statefile -p -W

       The  ager should	automatically become more aggressive when a low	memory
       condition exists.

       There is	no upper limit on the number of	records	that can be allocated.
       If  the	ager  is  not running often enough the host will be run	out of

       Mark Fullmer




Want to link to this manual page? Use this URL:

home | help