Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a Port Scan; how does TR7 detect a source performing a port scan?
Short answer
A port scan is making systematic connection attempts to find which ports are open and which services are running on a target; it is mostly the reconnaissance stage of an attack. In TR7, the Port Scan rule located in the Malformed Flags & Scans box in the TCP band of the L4 DDoS Management screen works with trap logic: a target that is not served but that scanning tools try almost always is listened to; while the Status value of the rule is Block, all the traffic of the source that touches the trap is dropped for 60 seconds, and while it is Quarantine, for the Quarantine Time period. Addresses reported to have performed a port scan are also kept in the Port Scan category in the IP reputation database.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management | TCP → Malformed Flags & Scans → Port Scan | Catching the scanning source with a trap; Status: Disabled, Monitor, Block, Quarantine |
| Left Monitor Panel → Route Tables & L4 DDoS → route table → Dashboard → Suspicious Packets | L4 DDoS Packet Class — Port scan panel | Measurement of the packets coming to the trap (Measurement and dashboard) |
| Settings → General Settings → IP Intelligence & Reputation | IP Categories → Port Scan | Addresses reported to have performed a port scan |
| Bot/DDoS → IP Reputation Protection | Default rule list | Requests of addresses in the Port Scan category are blocked with 403 by default (Silent Drop on an L7 TCP vService) |
| Bot/DDoS → Bot Protection → Factors | Recon factor | The contribution of an address carrying a Port Scan record to the bot score |
How Does the Port Scan Rule Work in TR7?
- Trap: The rule looks not at the format of a packet but at the behavior of the source. Since no legitimate traffic goes to the trap target that is not served, a source that touches the trap is counted as having attempted a scan.
- Block: The packet that comes to the trap is dropped and the source is written to a 60-second list; during this time all the traffic of the source is dropped, whichever port or protocol it goes to. The time starts over at every new touch to the trap.
- Quarantine: In addition to Block, the source is taken into the quarantine list of the route table; the time comes from the Quarantine Time field (default 10 minutes).
- Monitor: Only the touches made to the trap are counted; the packet is not dropped, and the source is not written to the list.
- Exemption: Sources in the Whitelist & Known Peers box are not affected by the rule.
- Default: The default value of the rule is Block. If the rule is in Monitor mode, since it has no counterpart in legitimate traffic, the learning engine can suggest promoting it to enforcement even while Mode Promotion is off (why).
Common Misconceptions
- "Traffic coming to open ports is monitored for detection." The rule catches a source that touches a trap that is not served; it does not look at legitimate traffic on open ports.
- "The enforcement drops only the packet that goes to the trap." In Block mode, all the traffic of the source from that moment on is dropped for 60 seconds, and in Quarantine mode for the Quarantine Time period.
- "The number seen in Monitor is blocked scans." In Monitor mode the counter shows only the touches seen; no packet is dropped.
- "The Port Scan reputation category and the Port scan rule are the same thing." The rule catches a scan made against the device at that moment; the reputation category, on the other hand, consists of reports that the address has performed scans on other targets.
How it is done in the documentation
