Overview

This article details the uses of Portscan detection and steps to enable it.

The following sections are covered:

• Portscan Detection
• Configuration steps
• Logging
• Related information
• Feedback and contact

Applies to the following Sophos products and versions
Sophos UTM

Portscan Detection

Portscans are used by hackers to probe secured systems for available services. To intrude into a system or to start a Denial of Service (DoS) attack, attackers need information on network services. If this information is available, attackers might take advantage of the security deficiencies of these services.

Network services using the TCP and UDP Internet protocols can be accessed via special ports, and this port assignment is generally known, for example, the SMTP service is assigned to the TCP Port 25. Ports that are used by the services are referred to as open since it is possible to establish a connection to them, whereas unused ports are referred to as closed; every attempt to connect with them will fail.

The attacker tries to find the open ports with the help of a particular software tool, a port scanner. This program tries to connect with several ports on the destination computer. If it is successful, the tool displays the relevant ports as open and the attacker has the necessary information, showing which network services are available on the destination computer.

Since there are 65535 distinct and usable port numbers for the TCP and UDP Internet protocols, the ports are scanned at very short intervals. If the firewall detects an unusually large number of attempts to connect to services, especially if these attempts come from the same source address, the firewall is most likely being port scanned. If an alleged attacker performs a scan of hosts or services on your network, the portscan detection feature will recognize this. As an option, further portscans from the same source address can be blocked automatically.

A portscan is detected when a detection score of 21 points in a time range of 300 ms for one individual source IP address is exceeded. The detection score is calculated as follows:

• Scan of a TCP destination port less than 1024: 3 points
• Scan of a TCP destination port greater or equal 1024: 1 point
• Scan of ports 11, 12, 13, 2000: 10 points

Configuration steps

To enable portscan detection, proceed as follows:

1. Network Security > Intrusion Protection > Anti-Portscan Detection.
2. Enable the Portscan Detection by either clicking on the status icon, or enable. 
3. You may now edit the global settings.
4. Make one of the following choices under global settings.
• Log Event Only: No measures will be taken against the portscan, the event will be logged only.
• Drop Traffic: Further packets of the portscan will be silently dropped. A port scanner will report these as filtered.
• Reject Traffic:  Further packets of the portscan will be dropped, and an ICMP destination unreachable/port unreachable response will be sent to the originator. A port scanner will report these ports as closed.
5. Limit Logging:  Enable this option to limit logging. A portscan detection can generate many logs while a portscan is being carried out. Selecting this option will restrict logging to five lines per second.
6. Click Apply to save the settings. 

Logging

Logs can be found at Logging & Reporting > Intrusion Prevention System. From the command line they can be found at /var/log/ips.log.

When a portscan is detected the log will display like the example below:

Related information

• Sophos UTM: How to configure the Intrusion Prevention System (IPS)
  

Feedback and contact

If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article.
This is invaluable to us to ensure that we continually strive to give our customers the best information possible.