psad – Intrusion Detection and Log Analysis with iptables

Outsmart Malicious Hackers

psad is a collection of three lightweight system daemons (two main daemons and one helper daemon) that run on Linux machines and analyze iptables log messages to detect port scans and other suspicious traffic. A typical deployment is to run psad on the iptables firewall where it has the fastest access to log data.

psad incorporates many signatures from the Snort intrusion detection system to detect probes for various backdoor programs (e.g. EvilFTP, GirlFriend, SubSeven), DDoS tools (mstream, shaft), and advanced port scans (FIN, NULL, XMAS) which are easily leveraged against a machine via nmap.

When combined with fwsnort and the Netfilter string match extension, psad is capable of detecting many attacks described in the Snort rule set that involve application layer data. In addition, psad makes use of various packet header fields associated with TCP SYN packets to passively fingerprint remote operating systems (in a manner similar to p0f) from which scans originate.

For more information, see the complete list of features offered by psad.

psad is developed around three main principles:

  • Good network security starts with a properly configured firewall.
  • A significant amount of intrusion detection data can be gleaned from firewalls logs, especially if the logs provide information on nearly every field of the network and transport headers (and even application layer signature matches as in Netfilter’s case).
  • Suspicious traffic should not be detected at the expense of trying to also block such traffic.

You can download psad v2.1.4 here:

psad-2.1.4.tar.gz (Source tar)
psad-2.1.4-1.i386.rpm (i386 binary RPM).

Or read more here.

Posted in: Countermeasures, Network Hacking, Security Software

, , , , , , ,

Recent in Countermeasures:
- PwnBin – Python Pastebin Search Tool
- Microsoft Azure Web Application Firewall (WAF) Launched
- mongoaudit – MongoDB Auditing & Pen-testing Tool

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,641 views
- Password Hasher Firefox Extension - 118,164 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,805 views

One Response to psad – Intrusion Detection and Log Analysis with iptables

  1. Goodpeople September 22, 2008 at 6:59 am #

    a lightweight ids.. good news for home users..