Portscan e file di LOG

[silvertech]

Ciao a tutti,

volevo porre un domanda sul portscan.
In ambiente Linux esiste un file di LOG che tiene traccia di tutti i portscan impartiti dagli utenti della rete verso il mio un server?

Ovvero chi interroga:

# nmap -sS xx.xx.xxx.xx

Riesco a beccare IP Adress di colui che ha inviato questa richiesta?

Grazie per l'aiuto.. Luca

[dAbOTZ]

Prova con iplog o scanlogd.

[dAbOTZ]

Un esempio per iplog (che trovo decisamente migliore di scanlogd):

# iplog -i eth0 --log-portscan -l scanlog &

<scan da un pc qualsiasi verso eth0>

# cat scanlog

Mar 4 12:07:48 iplog started.
Mar 4 12:08:55 TCP: port 35 connection attempt from athlon:3526
Mar 4 12:08:55 TCP: port 6 connection attempt from athlon:3496
Mar 4 12:08:55 TCP: echo connection attempt from athlon:3497
Mar 4 12:08:55 TCP: port 8 connection attempt from athlon:3498
Mar 4 12:08:55 TCP: discard connection attempt from athlon:3499
Mar 4 12:08:55 TCP: port 10 connection attempt from athlon:3500
Mar 4 12:08:55 TCP: systat connection attempt from athlon:3501
Mar 4 12:08:55 TCP: port 12 connection attempt from athlon:3502
Mar 4 12:08:55 TCP: port 4 connection attempt from athlon:3503
Mar 4 12:08:55 TCP: daytime connection attempt from athlon:3504
Mar 4 12:08:55 TCP: port 14 connection attempt from athlon:3505
Mar 4 12:08:55 TCP: port 15 connection attempt from athlon:3506
Mar 4 12:08:55 TCP: port 16 connection attempt from athlon:3507
Mar 4 12:08:55 TCP: qotd connection attempt from athlon:3508
Mar 4 12:08:55 TCP: port scan detected [ports 35,6,7,8,9,10,11,12,4,13,...] from athlon [ports 3526,3496,3497,3498,3499,...]