port scan detector

[Anonymous]

i want to develop a port scan detector... can any1 help me on this... how to do it???

[bmw5002]

We wont develop your program for you. I suppose you could monitor the ports for connections, but then when you put nMap portscanner into the picture it might get a little harder. nMap doesnt actually try to connect to the port to see if its open. I think it uses arp requests or something, its been awhile since i used/read about it. So that will require some more programming.

[Antony M Kancidrowski]

A suppose a solution would be to either write an NDIS driver of your own or use WinPCap[^]. You could then analyse the incoming packets for patterns that would suggest a port scan is happening. Ant. I'm hard, yet soft.
I'm coloured, yet clear.
I'm fruity and sweet.
I'm jelly, what am I? Muse on it further, I shall return! - David Williams (Little Britain)

[Antony M Kancidrowski]

I didn't think that nMap detected port scanning, rather it used various port scanning techniques to Map the network!? Ant. I'm hard, yet soft.
I'm coloured, yet clear.
I'm fruity and sweet.
I'm jelly, what am I? Muse on it further, I shall return! - David Williams (Little Britain)

[bmw5002]

I never said nMap detected portscanning. I meant that trying to detect nMap portscans would be hard.

[Antony M Kancidrowski]

Sorry, I misunderstood your post. You are quite right. nMap uses various port scanning techniques most of which would need so sort of packet analysis (pattern matching) in order to detect them. Ant. I'm hard, yet soft.
I'm coloured, yet clear.
I'm fruity and sweet.
I'm jelly, what am I? Muse on it further, I shall return! - David Williams (Little Britain)