Hello World!
Slackware 11 and trying to figure out why my nmap scans are not being detected!
Scanning from a BSD box which I haved ssh'ed into, yet do not have
root, therefore using -sT.
With my DD-WRT firewall disabled:
Starting nmap 3.55 ( http://www.insecure.org/nmap/ ) at 2006-11-26 18:19 CST
Interesting ports on ******* (70.******):
(The 1643 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
Output of /var/log/snort/alerts.fast (with snort running):
{ICMP} 80.135.57.195 -> 192.168.1.107
11/26-18:30:03.875296 [**] [1:485:4] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {ICMP} 84.189.61.35 -> 192.168.1.107
11/26-18:30:23.851572 [**] [1:485:4] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {ICMP} 85.177.163.197 -> 192.168.1.107
11/26-18:34:50.420076 [**] [1:485:4] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {ICMP} 84.161.46.146 -> 192.168.1.107
11/26-18:35:10.440021 [**] [1:485:4] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {ICMP} 84.161.46.146 -> 192.168.1.107
Output of /var/log/messages (Portsentry -tcp running) Note ports below
1024 are monitored but I didn't want to post the entire log:
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: ERROR: could
not bind TCP socket: 6000. Attempting to continue
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 6001
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 6667
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 12345
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 12346
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 20034
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 27665
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 30303
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 32771
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 32772
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 32773
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 32774
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 31337
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 40421
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 40425
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 49724
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: Going into
listen mode on TCP port: 54320
Nov 26 18:14:54 MayorSlay portsentry[6939]: adminalert: PortSentry is
now active and listening.
As you can see Snort and Portsentry do not list any active scans!
snort.conf file:
bash-3.1# cat /etc/snort.conf
# Variable Definitions
var HOME_NET 192.168.1.0/24
var EXTERNAL_NET any
var HTTP_SERVERS $HOME_NET
var DNS_SERVERS $HOME_NET
var RULE_PATH /etc/rules
var HTTP_PORTS 80
# preprocessors
preprocessor frag2
preprocessor flow: stats_interval 0 hash 2
preprocessor stream4: detect_scans
preprocessor stream4_reassemble
preprocessor sfportscan: proto { all } \
memcap { 1000000 } \
sense_level { medium }
preprocessor arpspoof
# output modules
output alert_syslog: LOG_AUTH LOG_ALERT
output log_tcpdump: /var/log/snort/snort.log
output alert_fast: /var/log/snort/alert.fast
include classification.config
include reference.config
# Rules and include files
include $RULE_PATH/bad-traffic.rules
include $RULE_PATH/exploit.rules
include $RULE_PATH/scan.rules
include $RULE_PATH/finger.rules
include $RULE_PATH/ftp.rules
#include $RULE_PATH/telnet.rules
include $RULE_PATH/smtp.rules
include $RULE_PATH/rpc.rules
include $RULE_PATH/dos.rules
include $RULE_PATH/ddos.rules
include $RULE_PATH/dns.rules
#include $RULE_PATH/tftp.rules
#include $RULE_PATH/web-cgi.rules
#include $RULE_PATH/web-coldfusion.rules
#include $RULE_PATH/web- iis.rules
#include $RULE_PATH/web-frontpage.rules
#include $RULE_PATH/web- misc.rules
include $RULE_PATH/web- attacks.rules
include $RULE_PATH/sql.rules
include $RULE_PATH/x11.rules
include $RULE_PATH/icmp.rules
include $RULE_PATH/netbios.rules
include $RULE_PATH/misc.rules
include $RULE_PATH/attack-responses.rules
#include $RULE_PATH/myrules.rules
include $RULE_PATH/virus.rules
include $RULE_PATH/bleeding-exploit.rules
include $RULE_PATH/bleeding-dos.rules
include $RULE_PATH/bleeding.rules
include $RULE_PATH/bleeding- virus.rules
include $RULE_PATH/bleeding-scan.rules
include $RULE_PATH/bleeding-malware.rules
End of Snort Output:
*** interface device lookup found: eth0
***
Initializing Network Interface eth0
Var 'eth0_ADDRESS' defined, value len = 25 chars, value =
192.168.1.0/255.255.255.0
Decoding Ethernet on interface eth0
--== Initialization Complete ==--
,,_ -*> Snort! <*-
o" )~ Version 2.6.0.2 (Build 85)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html
(C) Copyright 1998-2006 Sourcefire Inc., et al.
Not Using PCAP_FRAMES
Nmap output with DD-Wrt firewall enabled:
-bash-2.05b$ nmap -sT -T Insane -P0 ******
Starting nmap 3.55 ( http://www.insecure.org/nmap/ ) at 2006-11-26 18:32 CST
Interesting ports on *****:
(The 1658 ports scanned but not shown below are in state: filtered)
PORT STATE SERVICE
22/tcp open ssh
5190/tcp closed aol
Nmap run completed -- 1 IP address (1 host up) scanned in 23.213 seconds
IPtables Rules:
INPUT ACCEPT [807016:470977329]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [945501:637847219]
-A INPUT -s 127.0.0.1 -p udp -m udp --dport 6001:6063 -j ACCEPT
-A INPUT -s 127.0.0.1 -p tcp -m tcp --dport 6001:6063 -j ACCEPT
-A INPUT -s 127.0.0.1 -p udp -m udp --dport 6000 -j ACCEPT
-A INPUT -s 127.0.0.1 -p tcp -m tcp --dport 6000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m udp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 0:1023 -j DROP
-A INPUT -p udp -m udp --dport 0:1023 -j DROP
-A INPUT -p icmp -j DROP
-A INPUT -p tcp -m tcp --dport 6000 -j DROP
-A INPUT -p udp -m udp --dport 6000 -j DROP
-A INPUT -s 80.145.78.142 -j DROP
-A INPUT -s 85.224.102.97 -j DROP
-A INPUT -s 64.229.230.187 -j DROP
-A INPUT -s 70.77.139.20 -j DROP
-A INPUT -s 142.162.207.180 -j DROP
-A INPUT -s 81.181.34.204 -j DROP
-A INPUT -s 88.7.236.81 -j DROP
-A INPUT -p tcp -m tcp --dport 6001:6063 -j DROP
-A INPUT -p udp -m udp --dport 6001:6063 -j DROP
-A INPUT -p udp -m udp --dport 2049 -j DROP
-A INPUT -p tcp -m tcp --dport 2049 -j DROP
Any Ideas?
Regards,
Douglas Duckworth
