17 September 2008 | 5,096 views

psad – Intrusion Detection and Log Analysis with iptables

Prevent Network Security Leaks with Acunetix

psad is a collection of three lightweight system daemons (two main daemons and one helper daemon) that run on Linux machines and analyze iptables log messages to detect port scans and other suspicious traffic. A typical deployment is to run psad on the iptables firewall where it has the fastest access to log data.

psad incorporates many signatures from the Snort intrusion detection system to detect probes for various backdoor programs (e.g. EvilFTP, GirlFriend, SubSeven), DDoS tools (mstream, shaft), and advanced port scans (FIN, NULL, XMAS) which are easily leveraged against a machine via nmap.

When combined with fwsnort and the Netfilter string match extension, psad is capable of detecting many attacks described in the Snort rule set that involve application layer data. In addition, psad makes use of various packet header fields associated with TCP SYN packets to passively fingerprint remote operating systems (in a manner similar to p0f) from which scans originate.

For more information, see the complete list of features offered by psad.

psad is developed around three main principles:

  • Good network security starts with a properly configured firewall.
  • A significant amount of intrusion detection data can be gleaned from firewalls logs, especially if the logs provide information on nearly every field of the network and transport headers (and even application layer signature matches as in Netfilter’s case).
  • Suspicious traffic should not be detected at the expense of trying to also block such traffic.

You can download psad v2.1.4 here:

psad-2.1.4.tar.gz (Source tar)
psad-2.1.4-1.i386.rpm (i386 binary RPM).

Or read more here.



Recent in Countermeasures:
- StegExpose – Steganalysis Tool For Detecting Steganography In Images
- Twitter Patents Technique To Detect Mobile Malware
- Passera – Generate A Unique Strong Password For Every Website

Related Posts:
- Samhain v.2.5.9c – Open Source Host-Based Intrusion Detection System (HIDS)
- OSSEC HIDS – Open Source Host-based Intrusion System
- Suricata – Open Source Next Generation Intrusion Detection and Prevention Engine

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 119,194 views
- Password Hasher Firefox Extension - 117,048 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,562 views

Advertise on Darknet

One Response to “psad – Intrusion Detection and Log Analysis with iptables”

  1. Goodpeople 22 September 2008 at 6:59 am Permalink

    a lightweight ids.. good news for home users..