Port Scanners: The Good and The Bad
Every morning, while drinking coffee, one of my daily task is to keep an eye on my logs. Keeping logs is critical to help you to investigate incidents and, sometimes, to prevent some of them. That's why I'm collecting a huge amount of data. Besides miscellaneous tools and scripts, I'm receiving a daily overview of my firewalls traffic via a DShield report. Every days, I see that IP addresses are scanning my network. Today, I went deeper and tried to get the good and the bad from this report. The firewalls protect classic devices and applications (home network, collocated servers, websites and other public services).
Port scanning is an activity that has always induced debates. The classic question is: "Do we have to take care about port scans?". I already had discussions with peers about this topic and different point of views are always defended. Some people argue that port scanning is a normal activity and it will never decrease. For them, creating incidents related to port scans is way too much time consuming. Others are feeling offended and track them continuously.
Even if you don't track them, port scans must be logged because they can be part of a reconnaissance phase and be followed by a much deeper attack against your infrastructure. It could be useful to use them later as evidences. So, the next question is: can we reduce the noise and filter good VS. bad port scanners?
They are official port scanners operated by companies, non-profit organizations or security researchers. Some examples on top of my list:
- SHODAN (identified with PTR records: xxxxxx.shodan.io)
- ShadowServer project (identified with PTR records: scan-xxx.shadowserver.org)
- Rapid7's Sonar project (IP range: 71.6.216.32/27)
Do you know other Internet scanners like these? Feel free to share them.
Xavier Mertens
ISC Handler - Freelance Security Consultant
rootshell.be
truesec.be
Comments
www
Nov 17th 2022
6 months ago
EEW
Nov 17th 2022
6 months ago
qwq
Nov 17th 2022
6 months ago
mashood
Nov 17th 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
5 months ago
isc.sans.edu
Dec 3rd 2022
5 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
isc.sans.edu
Dec 26th 2022
5 months ago
isc.sans.edu
Dec 26th 2022
5 months ago