portscandetector

[ask_you]

can anyone give me an idea about how to develop a portscandetector??

[ThatsAlok]

here is your idea first create a socket connection using CSocket or CAsyncSocket in mFC or use core Socket api's now check each port in computer. if you socket connected to that port mean the port is open else it is not.:) I Think It will Work Alok Gupta visit me at http://www.thisisalok.tk

[Henry miller]

If you want to check for someone port scanning your machine you open a bunch of ports on your machine where nothing is running. If something hits several of them you know you are beind port scanned. More complex is to listen for all packets, and decode the raw packets. Look for connection attempts, and if you see multipul connections you know you are being port scanned. The hard part is telling the difference between acidental connections to your machine (someone who intended a different machine but typed the wrong address), and a port scan. Portscanners may run with several machines over a long time, hoping the port scan will not trip your detector instead it looks like the former.

[ask_you]

Can u suggest me an algorithm to do so.. i know the basics of detection. just watching on closed ports is also a type of ports can detection but it gives lots of false positives.. i need some advances level help..

[Henry miller]

Not myself. Google around, I know there are open source programs that attempt to do this. Read their code. (but watch the license)

[gamitech]

yes but what if the ports do not accept all connections gabby

[ThatsAlok]

ok i agree with you inthis topic. yeah it possible that if the port don't allow to connect we can't do any thing i think i have to work on it thanks for suggestion I Think It will Work ----------------------------- Alok Gupta visit me at http://www.thisisalok.tk