Scanning detection, Single Packet Authorization

2011-10-11 Thread Cezary Cieplinski
Dear All, I am new member here, also noob in OpenBSD. And have some simple question. Can you please tell me if there any technique to detect port scanning. Is there any PF feature which I can use? Or any independent package similar to linux psad? I am also interested in port knocking is there any

Re: Scanning detection, Single Packet Authorization

2011-10-11 Thread Fred Crowson
On 11 October 2011 13:36, Cezary Cieplinski forsakenli...@gmx.com wrote: Dear All, I am new member here, also noob in OpenBSD. And have some simple question. Can you please tell me if there any technique to detect port scanning. Is there any PF feature which I can use? Or any independent

Re: Scanning detection, Single Packet Authorization

2011-10-11 Thread Peter N. M. Hansteen
Fred Crowson fred.crow...@gmail.com writes: PF has excellent logging capabilities - which should help in detecting port scanning, and if you read the src tracking part of the man page it should prove useful. Very true. The various state tracking options can help detect and head off various

Re: Scanning detection, Single Packet Authorization

2011-10-11 Thread Kevin Chadwick
On Tue, 11 Oct 2011 14:31:01 +0100 Fred Crowson wrote: Port knocking has been discussed many times on the mailing list: Single packet authorisation is a lot more useful and less falible than port knocking, though you could do similar with ssh, some magic and have the benefit of lots of clients