How to block IPscan + portscan?

iamthed · May 13, 2009, 2:08 PM

hello..
i wanna ask simple question.. is there any packages that provide to block the IP scan and portscan program?

and how to do it ??

thx

GruensFroeschli · May 13, 2009, 2:11 PM

Just dont open up any ports.
Per default everything gets blocked.

iamthed · May 13, 2009, 2:18 PM

@GruensFroeschli:

Just dont open up any ports.
Per default everything gets blocked.

so u mean u do nothing for rule because it's been block anyway?
how bout ipscan and portscan from inside network?
is there anyway to block it ?
i assume that u say bout "don't open up any port" it's for security from outside network?
is it ?

GruensFroeschli · May 13, 2009, 2:20 PM

Yes this is about security against the outside.

There is no firewall in this reality that can protect against attacks from the inside.
How do you imagine a firewall should provide protection against traffic that never passes through it?

iamthed · May 13, 2009, 2:28 PM

hmm.. u're right..
but i think someone must made it the protection from inside..
statistically the attacker comes from inside :-
not from the outside..

OOT i want to ask how do u know the traffic that should be blocked because it's containing virus or attacker that trying to attempt?
how u do the monitoring?
i've got no clue about the monitoring process which is i'm using ntop+sniffing