What is psad?
The Port Scan Attack Detector (psad) is a collection of three lightweight system daemons written in Perl and C that are designed to work with the Linux Netfilter firewalling code to detect port scans and other suspect traffic. It features a set of highly configurable danger thresholds (with sensible defaults provided), verbose alert messages that include the source, destination, scanned port range, begin and end times, TCP flags and corresponding nmap options, email alerting, DShield reporting, and automatic blocking of offending IP addresses via dynamic configuration of iptables firewall rulesets. In addition, psad incorporates many of the TCP, UDP, and ICMP signatures included in Snort to detect highly suspect scans for various backdoor programs (e.g. EvilFTP, GirlFriend, SubSeven), DDoS tools (mstream, shaft), and advanced port scans (SYN, FIN, XMAS) which are easily leveraged against a machine via nmap. Psad also implements the same passive OS fingerprinting algorithm used by p0f t
