FLOW-DSCAN(1)

NAME
flow-dscan - detect scans from flow files

SYNOPSIS
flow-dscan [ -bBDh?lmpwW ] [ -d debuglevel ] [ -i inputfilterlist ] [ -I outputfilterlist ] [ -s statefile ] [ -t agertimeout ] [ -L suppressfile ] [ -O octettrigger ] [ -P packettrigger ] [ -S porttrigger ] [ -T timetrigger ]

DESCRIPTION
flow-dscan tries to detect host and port scans from flow logs. It does this by creating a table matching source IP to destination IP and destination port (for ports < 1024). By default, output is directed to syslog.

Includes an ager so it can be run continually without eating up an infinate ammount of memory. A suppress list can also be specified with a src ip, and optional protocol srcport and dstport. By disabling the ager and setting the dump state option this can be used to create a srcIP to dstIP/portmap<1024 table.

The statefile is just the internal hash table. It's a mapping of srcIP to dstIP's and ports < 1024.

    type=hash bucket depth flags srcIP
    H 0 1 0 152.171.152.171
    type=include nflows dstIP
    I  10777445 128.146.125.90
    type=hash bucket depth flags srcIP
    H 0 5 0 206.12.206.12
    type=include nflows dstIP
    I  4635135 128.146.161.7
    type=include nflows dstIP
    I  19387662 128.146.48.7
    type=port nports portnum
    P 1 53
-l can be used to load this statefile before processing the flows, use this for interrupted operation.

When running live, SIGHUP will reload the suppress list, and SIGUSR1 will dump state.

The ager runs every 1000 flows. It runs down a subset of the hash table each run, removing records that were created 90,000 flows prior to the current. Modify the ager timeout with -t.

The host scanner works by counting the length of the destination IP hash chain. If it goes above 64, then the src is considered to be scanning. Modify depth trigger with -D.

The port scanner works by keeping a bitmap of the destination port number < 1024 per destination IP. If it goes above 64, the src is considered to be port scanning the destination. Modify port trigger with -P.

When a src has been flagged as scanning it will not be reported again until the record is aged out and enough flows trigger it again.

It's currently clocking in at about 100,000 flows/sec when processing a compressed (-z6) flow file from a 2Gig ST32272W on FreeBSD-stable (around 2.2.7) w. the CAM SCSI on a PII/350 w. 128MB RAM. The ager probably still needs tuning, but it's keeping a 21,000,000 flow file under 160MB.

OPTIONS
Don't detach from the controlling terminal, and report results to stdout. Default is to run in the background and report to syslog. Like -b, but reports to syslog. I have no clue. Use the source, Luke. Help. Load state from a file. Enable the multicast filter. Dump state on exit. Filter www inbound replies. Filter WWW outbound. Set the debug level. Input filter interface list - only consider flows from these input interfaces. Output filter interface list - only consider flows to these output interfaces. Set the name of the state file for loading/dumping. Set the ager timeout. Longer timeouts detect slower scans, but consume more memory. Load a list of traffic to ignore (suppress) from a file. Useful for ignoring common false positives. Set the threshhold for reporting scans based on octet count. Set the threshhold for reporting scans based on packet count. Set the threshhold for reporting scans based on number of ports accessed. Set the threshhold for reporting flows that last "unusually long".

EXAMPLES
Locate port and host scans in rf, but ignore TCP replies from a busy MS web server

    echo "12.19.68.8 6 80 -" > dscan.suppress
    flow-dscan < rf
Same, but dump the internal state on exit to "statefile"

    flow-dscan -s statefile -p < rf

SEE ALSO
flow-capture(1), flow-cat(1), flow-connect(1), flow-dscan(1),flow-expire(1), flow-export(1), flow-fanout(1), flow-filter(1), flow-gen(1), flow-interfaces(1), flow-print(1), flow-profile(1), flow-receive(1), flow-search(1), flow-send(1), flow-sort(1), flow-stat(1),

BUGS
None known at this time.