DocsAttack Types

Port Scanning

One VM probing many ports on other machines.

A VM probes many ports on other machines looking for services to attack. Scanning is often the first sign of a compromised VM and the most common reason for abuse reports. Frabs counts the distinct ports each VM tries and limits new connections when it scans.

Detectors (16)

Detector	Measures	Warning	Incident	Critical
TCP Port Scan	Distinct destination ports (ports)	100 in 1 min	500 in 5 min	1,000 in 10 min
UDP Port Scan	Distinct destination ports (ports)	100 in 1 min	500 in 5 min	1,000 in 10 min
SYN Scan	Distinct destination ports (ports)	100 in 1 min	500 in 5 min	1,000 in 10 min
Connect Scan	Distinct destination ports (ports)	100 in 1 min	500 in 5 min	1,000 in 10 min
FIN Scan	Packets with FIN, NULL or XMAS flag patterns per second (pkt/s)	10 in 1 min	100 in 1 min	1,000 in 1 min
NULL Scan	Packets with FIN, NULL or XMAS flag patterns per second (pkt/s)	10 in 1 min	100 in 1 min	1,000 in 1 min
XMAS Scan	Packets with FIN, NULL or XMAS flag patterns per second (pkt/s)	10 in 1 min	100 in 1 min	1,000 in 1 min
ACK Scan	Distinct destination ports (ports)	100 in 1 min	500 in 5 min	1,000 in 10 min
Window Scan	Distinct destination ports (ports)	100 in 1 min	500 in 5 min	1,000 in 10 min
Maimon Scan	Packets with FIN, NULL or XMAS flag patterns per second (pkt/s)	10 in 1 min	100 in 1 min	1,000 in 1 min
SCTP Scan	Distinct destination ports (ports)	100 in 1 min	500 in 5 min	1,000 in 10 min
ICMP Scan	Distinct destination addresses (addresses)	100 in 5 min	1,000 in 10 min	5,000 in 30 min
Mixed Protocol Scan	Distinct destination ports (ports)	100 in 1 min	500 in 5 min	1,000 in 10 min
Randomised Port Scan	Distinct destination ports (ports)	100 in 1 min	500 in 5 min	1,000 in 10 min
Vertical Port Scan	Distinct destination ports (ports)	100 in 1 min	500 in 5 min	1,000 in 10 min
Horizontal Port Scan	Distinct destination addresses (addresses)	100 in 5 min	1,000 in 10 min	5,000 in 30 min

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.

PreviousDDoS & Flooding NextHost & Network Discovery