Trace the Port Scan: Spotting a Port-Sweep in Firewall Logs
Le défi
Votre pare-feu a enregistre une rafale d'activite. Cache dans le trafic autorise normal, un hote interne frappe a des dizaines de ports differents sur un seul serveur en quelques secondes - un balayage de ports qui cartographie ce qui est ouvert. Filtrez les connexions refusees, trouvez la source qui touche de nombreux ports de destination distincts, et soumettez son IP.
Ce que tu vas apprendre
- Filter firewall logs by action to isolate denied connections
- Correlate source IP with destination port to spot enumeration
- Recognise the many-ports-one-target signature of a port scan
- Distinguish a scan from normal many-source service traffic
- Attribute the scan to a single internal host
Compétences testées
Prérequis
- Understanding of TCP ports and common service port numbers
- Familiarity with allow/deny firewall actions
Comment ça marche
Before an attacker can exploit a service, they need to know which services are listening. The fastest way to find out is a port scan: send a connection probe to many ports on a target and see which ones answer. On a firewall, most of those probes hit ports with no listening service or no allow rule, so they are denied - and that produces a very distinctive log shape.
Filter to action:DENY and the pattern is unmistakable: a single source, 10.0.0.66, opens connections to one destination, 10.0.0.10, on a long sequence of different ports - 21, 22, 23, 25, 53, 445, 3306, 3389, 5432, 6379, and many more, all inside roughly twenty seconds. Normal traffic looks nothing like this: each legitimate client talks to one expected service port (443, 80) and is allowed. The defining feature of a scan is one source, one target, many distinct ports, in a short window.
The skill is to correlate two columns at once. A single denied connection means nothing; dozens of denials from the same source to the same host across a fan of ports is enumeration. SIEM rules detect scans exactly this way - by counting distinct destination ports per source over a sliding time window.
Erreurs fréquentes
- Looking at one column in isolation. The dport alone or the src alone is noise; the scan only appears when you correlate source, target, and the spread of ports.
- Assuming every DENY is the attacker. A few denies are normal; the scanner is the source responsible for the dense fan of distinct ports.
- Picking the destination host.
10.0.0.10is the victim being scanned, not the scanner - submit the source. - Stopping at one allowed port. A couple of the scanned ports (22, 80, 443) are allowed; that does not change the fact that the source swept the whole range.
Comment s'en protéger
Port scans are reconnaissance, and catching them early gives you a head start before exploitation. The same distinct-port-per-source count you used can be an automated alert.
- Alert when one source contacts more than a handful of distinct ports on a single host inside a short time window.
- Use rate limiting or scan-detection on the firewall to throttle or block sources that probe many ports.
- Segment the network so an internal host cannot freely reach every port on every server.
- Close or firewall off unused service ports so there is nothing to enumerate.