The ultimate stealth tool [linux only]

psad: the Port Scan Attack Detector

[+] Version: 3.0
By Michael Rash ([url=mailto:mbr@cipherdyne.org]mbr@cipherdyne.org[/url])
URL: http://www.cipherdyne.org/psad/

Usage: psad [options]

Options:

-A,--Analyze-msgs- Analyze iptables logfile and exit.
--stdin- In --Analyze-msgs mode, acquire iptables
log data from STDIN.
-e,--email-analysis- Send emails for scans detected in
offline analysis mode.
-m,--messages-file <file>- Specify the path to the iptables logfile
(for --Analyze-msgs mode).
-i,--interface <intf>- Restrict detection to IN interface (for
INPUT and FORWARD chains) or OUT
interface (for OUPUT chain).
--sig-update- Download the latest set of psad
signatures from:
http://www.cipherdyne.org/
--reputation-feeds-update- Download the latest reputation feed data.
Use --reputation-list to list all
configured reputation feeds.
--reputation-feeds-list- List all configured reputation feeds.
-w,--whois-analysis- Enable whois lookups when running in
offline --Analyze-msgs mode.
--dns-analysis- Enable reverse DNS lookups in
--Analyze-msgs mode.
--fw-analyze- Analyze the local iptables ruleset and
exit.
--fw-list-auto- List the contents of any iptables chains
(for auto-blocking rules).
--List- Synonym for --fw-list-auto (emulates
iptables command line).
--fw-b-ip<ip>- Add an IP/network to the auto-blocking
chains.
--fw-rm-b-ip<ip>- Remove an IP/network from the auto-
blocking chains.
--fw-file <rules file>- Analyze the iptables ruleset contained
within <rules file> instead of a running
policy.
--fw-del-chains- Delete iptables chains used by psad for
auto-blocking rules.
-X- Synonym for --fw-del-chains (emulates
iptables command line).
--fw-dump- Dump a sanitized version of the local
iptables policy.
--fw-include-ips- Include all IPs/nets in iptables dump
(--fw-dump) output.
--snort-rdir <rule dir>- Path to snort rules directory.
--debug,- Run psad in debugging mode.
--debug-sid <sid>- Debug a specific Snort rule.
-D,--Dump-conf- Dump psad configuration on STDOUT and
exit.
-l,--log-server- psad is being run on a syslog logging
server.
-F,--Flush- Remove any auto-generated firewall
block rules (emulates iptables command
line).
-K,--Kill- Kill all running psad processes.
-R,--Restart- Restart all running psad processes.
-S,--Status- Displays the status of any currently
running psad processes.
--restrict-ip <IP or net>- Only process packets that have this IP
or network as the src or dst.
--status-ip <IP address>- View status for a specific IP.
--status-dl- Display status information for only
those scans that have reach at least
(from 1 to 5).
--status-summary- Only display summary status output in
--Status and --Analyze modes.
-B,--Benchmark- Run psad in benchmark mode.
--packets <number>- Specify number of packets to use in
--Analyze (default is unlimited) or
--Benchmark (default is 10,000) modes.
-U,--USR1- Send a running psad process a USR1
signal (generates a dump of psad
data structures on STDOUT).
-H,--HUP- Send all psad daemons a HUP signal to
have them re-import configs.
--get-next-rule-id- Display the next available rule ID and
exit.

--gnuplot- Parse iptables log data and produce a
file suitable for plotting with Gnuplot.
--gnuplot-graph-style- Set the Gnuplot graph style (e.g.
"dots", "lines", "linespoints", etc.).
--gnuplot-file-prefix- Use a prefix for the .gnu, .dat, and
.png files that are generated in Gnuplot
mode.
--gnuplot-interactive- Do not add the terminal directive to the
Gnuplot .gnu file, so when Gnuplot loads
the file it will graph the data in an
interactive window.
--gnuplot-title- Set the Gnuplot graph title.
--gnuplot-legend-title- Set the Gnuplot legend title.
--gnuplot-x-label- Set the x-axis label.
--gnuplot-x-range- Set the x-axis range.
--gnuplot-y-label- Set the y-axis label.
--gnuplot-y-range- Set the y-axis range.
--gnuplot-z-label- Set the z-axis label.
--gnuplot-z-range- Set the z-axis range.
--gnuplot-sort-style- Set the psad sorting style to either
"time" or "value" (defaults to "value").
--gnuplot-3D- Create three-dimensional Gnuplot graph.
--gnuplot-view- Set the viewing angle.
--gnuplot-grayscale- Only use grayscale colors.
--gnuplot-template <file>- Use a template file for all Gnuplot
directives.
--gnuplot-dat-file- Specify path to .dat output file.
--gnuplot-plot-file- Specify path to .gnu output file.
--gnuplot-png-file- Specify path to .png output file.

--CSV- Parse iptables log messages and dump
fields to stdout in csv format.
--CSV-fields <fields>- Restrict --CSV output to a list of
specfic fields.
--CSV-unique-lines- Only print unique lines in CSV output.
--CSV-max-lines <num>- Specify the maximum number of CSV output
lines to print.
--CSV-start-line [*]- Starting line within iptables log file.
--CSV-end-line [*]- Ending line within iptables log file.
--CSV-regex <regex>- Require iptables log messages to match
an additional regex in --CSV mode.
--CSV-neg-regex <regex>- Require iptables log messages to
not match an additional regex in --CSV
mode.
--plot-separator <str>- Specify a separator string between plot
fields (in --gnuplot or --CSV plot
modes (the default is a comma for CSV
formatted output).

--signatures <sigs file>- Manually specify the path to the psad
signatures file.
--snort-type- Restrict psad to look for specific Snort
sids such as those in ddos.rules or
backdoor.rules.
--passive-os-sigs <sigs file> - Manually specify the path to the passive
os fingerprinting sigs.
--auto-dl- Import auto-danger level file for
automatic IP danger level increases or
decreses.
--analysis-write-data- Write data to filesystem from -A mode
(the disk IO involved in this step can
take a long time).
-c,--config <config file>- Use <config file> instead of the normal
config file located at
/etc/psad/psad.conf.
-O, --Override-config <str>- Allow config variables from the normal
/etc/psad/psad.conf to be superseded with values
from the specified file(s).
-I,--Interval <seconds>- Configure the check interval from the
command line to override the 5 second
default.
-v,--verbose- Run in verbose mode.
-V,--Version- Print the psad version and exit.

--no-snort-sids- Disable examination for snort sids
(such as those generated by fwsnort) in
iptables log messages.
--no-reputation-feeds- Disable reputation feed comparisons.
--no-signatures- Disable psad signature processing
(independent of snort sid matching).
--no-icmp-types- Disable icmp type/code validation.
--no-auto-dl- Disable auto danger level assignment.
--no-daemon- Do not run as a daemon.
--no-ipt-errors- Do not write errors to the error log.
--no-whois- Disable whois lookups.
--no-fwcheck- Disable firewall rules verification.
--no-rdns- Disable name resolution against scanning
IP addresses.
--no-kmsgsd- Disable startup of kmsgsd (useful for
debugging with an existing file of
iptables log messages).
--no-port-lookup- Disable local port lookups for scan
signatures.
--no-netstat- Synonym for --no-port-lookup.
-h--help- Display usage on STDOUT and exit.