Contributed by jose on from the interesting-tricks dept.
By using openBSD's packet filter pf one can utilize the NAT address pools added into OpenBSD 3.3 to aid in distributed port scanning.
http://www.networkpenetration.com/pfdistnatscan.html "
Now that's an interesting use of PF, and a quick way to learn the idea of NAT pools in PF.
(Comments are closed)
By Matt () on
When I read distributed port scanning, I thought it was a method to do something like
nmap $someaddressrange
and have those queries broken up amongst several computers who share the workload, each scan a section of $someaddressrange, and then comine their results, thus reducing the amount of work any one machine had to do, and getting the results faster.
This seems like more of an obfuscation technique to mess with IDSs. You could potentially set up a very large address pool, scan a remote host, and make that host think it is being port scanned by many different hosts at once. (right?)
Regardless of my interpretation, it's still pretty interesting. Food for thought and all that.
Comments
By Matt Burke () matt@NOSPAMbotchitt.com on mailto:matt@NOSPAMbotchitt.com
This completely obliterates software such as portsentry.
The technique described in the article requires hogging a large IP range to be of any effective use.
Comments
By Jeroen () on
I can think of a lot other usefull uses of spare IPv4 addresses and therefore hope that large IPv4 ranges are not used for this matter only nor i hope people want large IPv4 ranges only for this matter.
PortSentry is not *that* usefull anyways, especially not on IPv4 (dunno if it's ported to IPv6). If an IPv4 address is spoofed during sending it will block that spoofed IPv4 address as if it was configured in the context as you said. Oops.
By Clint () spam@rules.com on mailto:spam@rules.com