PSD参数的意义

gmhejob1

能给讲讲PSD参数的意义吗？····不明白其意义，也不会应用·······

artico

我也想了解，有知道的朋友请说明一下，谢谢

b128777

1. in ROS took this command from the demo2.mt.lv:

add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment="detect and drop port scan connections" disabled=no



2. For English

From Netfilter.org:

3.12 psd patch
This patch by Dennis Koslowski adds a new match that will attempt to detect port scans.
In its simplest form, psd match can be used as follows :


# iptables -A INPUT -m psd -j DROP

# iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP all -- anywhere anywhere psd weight-threshold: 21 delay-threshold: 300 lo-ports-weight: 3 hi-ports-weight: 1

Supported options for psd match are :

[--psd-weight-threshold threshold]

-> Portscan detection weight threshold
[--psd-delay-threshold delay]

-> Portscan detection delay threshold
[--psd-lo-ports-weight lo]

-> Privileged ports weight
[--psd-hi-ports-weight hi]

-> High ports weight
[--psd-hi-ports-weight hi]


Values here appear as the MT documentation with the exception of Delay Threshold which is 300 here and 3s in the MT documentation.
I'd suggest a review of the web documentation for IPTABLES and PSD for more information.




3. For chinese
　　CONFIG_IP_NF_MATCH_PSD, 支持端口扫描检测(PSDortScanDetection). 可以检测TCP和UDP端口扫描. 它源自Solar Designer磗 scanlogd.

　　支持的选项:

　　--psd-weight-threshold

　　从同一主机发往不同目的端口的TCP/UDP包的总的优先级，被用来作为端口扫描次序

　　--psd-delay-threshold

　　由同一主机发往不同目的端口的包的延迟 (in hundredths of second) ，用来作为可能的端口扫描子次序

　　--psd-lo-ports-weight

　　特权目的端口的优先级，即目标端口(<=1024)的优先级

　　--psd-hi-ports-weight

　　非特权目的端口的优先级(>1024).

　　举例：iptables -A INPUT -m psd -j DROP

　　CONFIG_IP_NF_MATCH_RPC,支持两个模块ip_conntrack_rpc_udp和ip_conntrack_rpc_tcp (用来分别跟踪UDP和TCP的端口映射请求)，在iptabIe 中添加record_rpc(用来匹配是否包的源地址已经发过端口映射请求，或者是一个新的发往端口映射的GET请求，以允许RPC过滤)