flow-dscan(1)

1FLOW-DSCAN(1)                                                    FLOW-DSCAN(1)
2
3
4

NAME

6       flow-dscan - Detect scanning and other suspicious network activity.
7

SYNOPSIS

9       flow-dscan [ -bBhlmpwW ]  [ -d debug_level ]  [ -D iplist_depth ]  [ -s
10       state_file ]  [ -i input_filter ]  [ -L  suppress_list  ]   [  -o  out‐
11       put_filter  ]   [  -O  excessive_octets ]  [ -P excessive_flows ]  [ -S
12       port_scan_trigger ]  [ -t ager_timeout ]
13

DESCRIPTION

15       The flow-dscan utility is used to detect suspicious  activity  such  as
16       port  scanning,  host scanning, and flows with unusually high octets or
17       packets. A source and destination suppress list is  supported  to  help
18       prevent  false  alarms  due to hosts such as nameservers or popular web
19       servers that exchange traffic with a large number of hosts. Alarms  are
20       logged  to  syslog  or  stderr. The internal state of flow-dscan can be
21       saved and loaded to allow for interrupted operation.
22
23       flow-dscan will work best if configured to only watch only  inbound  or
24       outbound traffic by using the input or output interface filter option.
25
26       The  host  scanner  works  by counting the length of the destination IP
27       hash chain. If it goes above 64, then the src is considered to be scan‐
28       ning.
29
30       The port scanner works by keeping a bitmap of the destination port num‐
31       ber < 1024 per destination IP. If it goes above 64, the src is  consid‐
32       ered to be port scanning the destination.
33
34       When  a  src has been flagged as scanning it will not be reported again
35       until the record is aged out and enough flows trigger it again.
36
37       A SIGHUP signal will instruct flow-dscan to reload the suppress list.
38
39       A SIGUSR1 signal will instruct flow-dscan to dump its internal state.
40

OPTIONS

42       -b     Do not detach and run in the background. Alerts go to stderr.
43
44       -B     Do not detach and run in the background. Alerts go to syslog.
45
46       -d debug_level
47              Enable debugging.
48
49       -D iplist_depth
50              Depth of IP host list for detecting host scanning.
51
52       -h     Display help.
53
54       -i input_filter
55              Input interface filter list.
56
57       -I output_filter
58              Output interface filter list.
59
60       -l     Load state from /var/tmp/dscan.state or the  filename  specified
61              with -s.
62
63       -L suppress_list
64              Basename  of  suppress  files.  There are two suppress files for
65              input and output traffic. The suppress file syntax is
66
67              IP_address protocol source_port destination_port
68
69              A '-' can be used as a wildcard in  the  protocol,  source_port,
70              and   destination_port   fields.   Only   a   single   protocol,
71              source_port, and destination_port is supported per IP address.
72
73       -m     Multicast address filter. Use to ignore multicast addresses.
74
75       -O excessive_octets
76              Trigger an alert if a flow is processed with  the  octets  field
77              exceeding excessive_octets.
78
79       -p     Dump  state  to  /var/tmp/dscan.state  or the filename specified
80              with -s.
81
82       -P excessive_packets
83              Trigger an alert if a flow is processed with the  packets  field
84              exceeding excessive_packets.
85
86       -s statefile
87              State filename. Defaults to /var/tmp/dscan.state
88
89       -S port_scan_trigger
90              Number  of  ports  a  IP address must have used to be considered
91              scanning.
92
93       -t ager_timeout
94              How long to keep flows around. Default to 90000.  This  is  mea‐
95              sured in flows processed.
96
97       -T excessive_time
98              Trigger an alert if a flow is processed with the End-Start field
99              exceeding excessive_time.
100
101       -w     Filter (ignore) candidate inbound www traffic, ie IP protocol 6,
102              source port 80, and destination port > 1023.
103
104       -W     Filter  (ignore)  candidate outbound www traffic, ie IP protocol
105              6, destination port 80, and source port > 1023.
106

EXAMPLES

108       In a topology where 25 is the only output interface run flow-dscan over
109       the  data  in  /flows/krc4. Ignore www and multicast traffic, store the
110       internal state in dscan.statefile on  exit.  Use  empty  suppress  list
111       files dscan.suppress.src and dscan.suppress.dst. The output produced by
112       flow-dscan typically must be manually inspected  by  using  flow-filter
113       and  flow-print.   Many  of the alerts will be false until the suppress
114       lists are populated for the local environment.
115
116       flow-cat /flows/krc4 | flow-dscan -I25 -b -m -s dscan.statefile -p -W
117

BUGS

119       The ager should automatically become more aggressive when a low  memory
120       condition  exists.   There  is  no upper limit on the number of records
121       that can be allocated. If the ager is not running often enough the host
122       will be run out of memory.
123

AUTHOR

125       Mark Fullmer <maf@splintered.net>
126