Trace the Port Scan: Spotting a Port-Sweep in Firewall Logs
O desafio
Seu firewall registrou uma rajada de atividade. Escondido no trafego permitido normal, um host interno bate em dezenas de portas diferentes em um unico servidor em segundos - uma varredura de portas mapeando o que esta aberto. Filtre as conexoes negadas, encontre a origem que toca muitas portas de destino distintas, e envie o IP dela.
O que você vai aprender
- Filter firewall logs by action to isolate denied connections
- Correlate source IP with destination port to spot enumeration
- Recognise the many-ports-one-target signature of a port scan
- Distinguish a scan from normal many-source service traffic
- Attribute the scan to a single internal host
Habilidades testadas
Pré-requisitos
- Understanding of TCP ports and common service port numbers
- Familiarity with allow/deny firewall actions
Como funciona
Before an attacker can exploit a service, they need to know which services are listening. The fastest way to find out is a port scan: send a connection probe to many ports on a target and see which ones answer. On a firewall, most of those probes hit ports with no listening service or no allow rule, so they are denied - and that produces a very distinctive log shape.
Filter to action:DENY and the pattern is unmistakable: a single source, 10.0.0.66, opens connections to one destination, 10.0.0.10, on a long sequence of different ports - 21, 22, 23, 25, 53, 445, 3306, 3389, 5432, 6379, and many more, all inside roughly twenty seconds. Normal traffic looks nothing like this: each legitimate client talks to one expected service port (443, 80) and is allowed. The defining feature of a scan is one source, one target, many distinct ports, in a short window.
The skill is to correlate two columns at once. A single denied connection means nothing; dozens of denials from the same source to the same host across a fan of ports is enumeration. SIEM rules detect scans exactly this way - by counting distinct destination ports per source over a sliding time window.
Erros comuns
- Looking at one column in isolation. The dport alone or the src alone is noise; the scan only appears when you correlate source, target, and the spread of ports.
- Assuming every DENY is the attacker. A few denies are normal; the scanner is the source responsible for the dense fan of distinct ports.
- Picking the destination host.
10.0.0.10is the victim being scanned, not the scanner - submit the source. - Stopping at one allowed port. A couple of the scanned ports (22, 80, 443) are allowed; that does not change the fact that the source swept the whole range.
Como se proteger
Port scans are reconnaissance, and catching them early gives you a head start before exploitation. The same distinct-port-per-source count you used can be an automated alert.
- Alert when one source contacts more than a handful of distinct ports on a single host inside a short time window.
- Use rate limiting or scan-detection on the firewall to throttle or block sources that probe many ports.
- Segment the network so an internal host cannot freely reach every port on every server.
- Close or firewall off unused service ports so there is nothing to enumerate.