@@ -55,100 +55,100 @@ <h2>Full example</h2>
55
55
56
56
# Whether to consider UDP "connections" for scan detection.
57
57
# Can lead to false positives due to UDP fanout from some P2P apps.
58
- const suppress_UDP_scan_checks = F &redef;
58
+ const suppress_UDP_scan_checks = F & redef;
59
59
60
- const activate_priv_port_check = T &redef;
61
- const activate_landmine_check = F &redef;
62
- const landmine_thresh_trigger = 5 &redef;
60
+ const activate_priv_port_check = T & redef;
61
+ const activate_landmine_check = F & redef;
62
+ const landmine_thresh_trigger = 5 & redef;
63
63
64
- const landmine_address: set[addr] &redef;
64
+ const landmine_address: set[addr] & redef;
65
65
66
- const scan_summary_trigger = 25 &redef;
67
- const port_summary_trigger = 20 &redef;
68
- const lowport_summary_trigger = 10 &redef;
66
+ const scan_summary_trigger = 25 & redef;
67
+ const port_summary_trigger = 20 & redef;
68
+ const lowport_summary_trigger = 10 & redef;
69
69
70
70
# Raise ShutdownThresh after this many failed attempts
71
- const shut_down_thresh = 100 &redef;
71
+ const shut_down_thresh = 100 & redef;
72
72
73
73
# Which services should be analyzed when detecting scanning
74
74
# (not consulted if analyze_all_services is set).
75
- const analyze_services: set[port] &redef;
76
- const analyze_all_services = T &redef;
75
+ const analyze_services: set[port] & redef;
76
+ const analyze_all_services = T & redef;
77
77
78
78
# Track address scaners only if at least these many hosts contacted.
79
- const addr_scan_trigger = 0 &redef;
79
+ const addr_scan_trigger = 0 & redef;
80
80
81
81
# Ignore address scanners for further scan detection after
82
82
# scanning this many hosts.
83
83
# 0 disables.
84
- const ignore_scanners_threshold = 0 &redef;
84
+ const ignore_scanners_threshold = 0 & redef;
85
85
86
86
# Report a scan of peers at each of these points.
87
87
const report_peer_scan: vector of count = {
88
88
20, 100, 1000, 10000, 50000, 100000, 250000, 500000, 1000000,
89
- } &redef;
89
+ } & redef;
90
90
91
91
const report_outbound_peer_scan: vector of count = {
92
92
100, 1000, 10000,
93
- } &redef;
93
+ } & redef;
94
94
95
95
# Report a scan of ports at each of these points.
96
96
const report_port_scan: vector of count = {
97
97
50, 250, 1000, 5000, 10000, 25000, 65000,
98
- } &redef;
98
+ } & redef;
99
99
100
100
# Once a source has scanned this many different ports (to however many
101
101
# different remote hosts), start tracking its per-destination access.
102
- const possible_port_scan_thresh = 20 &redef;
102
+ const possible_port_scan_thresh = 20 & redef;
103
103
104
104
# Threshold for scanning privileged ports.
105
- const priv_scan_trigger = 5 &redef;
105
+ const priv_scan_trigger = 5 & redef;
106
106
const troll_skip_service = {
107
107
25/tcp, 21/tcp, 22/tcp, 20/tcp, 80/tcp,
108
- } &redef;
108
+ } & redef;
109
109
110
110
const report_accounts_tried: vector of count = {
111
111
20, 100, 1000, 10000, 100000, 1000000,
112
- } &redef;
112
+ } & redef;
113
113
114
114
const report_remote_accounts_tried: vector of count = {
115
115
100, 500,
116
- } &redef;
116
+ } & redef;
117
117
118
118
# Report a successful password guessing if the source attempted
119
119
# at least this many.
120
- const password_guessing_success_threshhold = 20 &redef;
120
+ const password_guessing_success_threshhold = 20 & redef;
121
121
122
- const skip_accounts_tried: set[addr] &redef;
122
+ const skip_accounts_tried: set[addr] & redef;
123
123
124
124
const addl_web = {
125
125
81/tcp, 443/tcp, 8000/tcp, 8001/tcp, 8080/tcp, }
126
- &redef;
126
+ & redef;
127
127
128
- const skip_services = { 113/tcp, } &redef;
128
+ const skip_services = { 113/tcp, } & redef;
129
129
const skip_outbound_services = { 21/tcp, addl_web, }
130
- &redef;
130
+ & redef;
131
131
132
132
const skip_scan_sources = {
133
133
255.255.255.255, # who knows why we see these, but we do
134
- } &redef;
134
+ } & redef;
135
135
136
- const skip_scan_nets: set[subnet] = {} &redef;
136
+ const skip_scan_nets: set[subnet] = {} & redef;
137
137
138
138
# List of well known local server/ports to exclude for scanning
139
139
# purposes.
140
- const skip_dest_server_ports: set[addr, port] = {} &redef;
140
+ const skip_dest_server_ports: set[addr, port] = {} & redef;
141
141
142
142
# Reverse (SYN-ack) scans seen from these ports are considered
143
143
# to reflect possible SYN-flooding backscatter, and not true
144
144
# (stealth) scans.
145
145
const backscatter_ports = {
146
146
80/tcp, 8080/tcp, 53/tcp, 53/udp, 179/tcp, 6666/tcp, 6667/tcp,
147
- } &redef;
147
+ } & redef;
148
148
149
149
const report_backscatter: vector of count = {
150
150
20,
151
- } &redef;
151
+ } & redef;
152
152
153
153
global check_scan:
154
154
function(c: connection, established: bool, reverse: bool): bool;
@@ -174,14 +174,14 @@ <h2>Full example</h2>
174
174
# Indexed by scanner address, yields # distinct peers scanned.
175
175
# pre_distinct_peers tracks until addr_scan_trigger hosts first.
176
176
global pre_distinct_peers: table[addr] of set[addr]
177
- &read_expire = 15 mins &redef;
177
+ &read_expire = 15 mins & redef;
178
178
179
179
global distinct_peers: table[addr] of set[addr]
180
- &read_expire = 15 mins &expire_func=scan_summary &redef;
180
+ &read_expire = 15 mins &expire_func=scan_summary & redef;
181
181
global distinct_ports: table[addr] of set[port]
182
- &read_expire = 15 mins &expire_func=port_summary &redef;
182
+ &read_expire = 15 mins &expire_func=port_summary & redef;
183
183
global distinct_low_ports: table[addr] of set[port]
184
- &read_expire = 15 mins &expire_func=lowport_summary &redef;
184
+ &read_expire = 15 mins &expire_func=lowport_summary & redef;
185
185
186
186
# Indexed by scanner address, yields a table with scanned hosts
187
187
# (and ports).
@@ -196,23 +196,23 @@ <h2>Full example</h2>
196
196
global accounts_tried: table[addr] of set[string, string]
197
197
&read_expire = 1 days;
198
198
199
- global ignored_scanners: set[addr] &create_expire = 1 day &redef;
199
+ global ignored_scanners: set[addr] &create_expire = 1 day & redef;
200
200
201
201
# These tables track whether a threshold has been reached.
202
202
# More precisely, the counter is the next index of threshold vector.
203
203
global shut_down_thresh_reached: table[addr] of bool &default=F;
204
204
global rb_idx: table[addr] of count
205
- &default=1 &read_expire = 1 days &redef;
205
+ &default=1 &read_expire = 1 days & redef;
206
206
global rps_idx: table[addr] of count
207
- &default=1 &read_expire = 1 days &redef;
207
+ &default=1 &read_expire = 1 days & redef;
208
208
global rops_idx: table[addr] of count
209
- &default=1 &read_expire = 1 days &redef;
209
+ &default=1 &read_expire = 1 days & redef;
210
210
global rpts_idx: table[addr,addr] of count
211
- &default=1 &read_expire = 1 days &redef;
211
+ &default=1 &read_expire = 1 days & redef;
212
212
global rat_idx: table[addr] of count
213
- &default=1 &read_expire = 1 days &redef;
213
+ &default=1 &read_expire = 1 days & redef;
214
214
global rrat_idx: table[addr] of count
215
- &default=1 &read_expire = 1 days &redef;
215
+ &default=1 &read_expire = 1 days & redef;
216
216
}
217
217
218
218
global thresh_check: function(v: vector of count, idx: table[addr] of count,
@@ -388,7 +388,7 @@ <h2>Full example</h2>
388
388
{ # XXXXX
389
389
390
390
if ( orig !in distinct_peers )
391
- distinct_peers[orig] = set() &mergeable;
391
+ distinct_peers[orig] = set() & mergeable;
392
392
393
393
if ( resp !in distinct_peers[orig] )
394
394
add distinct_peers[orig][resp];
@@ -448,15 +448,15 @@ <h2>Full example</h2>
448
448
if ( orig !in distinct_ports || service !in distinct_ports[orig] )
449
449
{
450
450
if ( orig !in distinct_ports )
451
- distinct_ports[orig] = set() &mergeable;
451
+ distinct_ports[orig] = set() & mergeable;
452
452
453
453
if ( service !in distinct_ports[orig] )
454
454
add distinct_ports[orig][service];
455
455
456
456
if ( |distinct_ports[orig]| > = possible_port_scan_thresh &&
457
457
orig !in scan_triples )
458
458
{
459
- scan_triples[orig] = table() &mergeable;
459
+ scan_triples[orig] = table() & mergeable;
460
460
add possible_scan_sources[orig];
461
461
}
462
462
}
@@ -469,7 +469,7 @@ <h2>Full example</h2>
469
469
service !in distinct_low_ports[orig] )
470
470
{
471
471
if ( orig !in distinct_low_ports )
472
- distinct_low_ports[orig] = set() &mergeable;
472
+ distinct_low_ports[orig] = set() & mergeable;
473
473
474
474
add distinct_low_ports[orig][service];
475
475
@@ -494,10 +494,10 @@ <h2>Full example</h2>
494
494
if ( orig in possible_scan_sources )
495
495
{
496
496
if ( orig !in scan_triples )
497
- scan_triples[orig] = table() &mergeable;
497
+ scan_triples[orig] = table() & mergeable;
498
498
499
499
if ( resp !in scan_triples[orig] )
500
- scan_triples[orig][resp] = set() &mergeable;
500
+ scan_triples[orig][resp] = set() & mergeable;
501
501
502
502
if ( service !in scan_triples[orig][resp] )
503
503
{
0 commit comments