Skip to content

Commit b674bb9

Browse files
skeptichackerskeptichacker
committed
First commit
1 parent b6301f4 commit b674bb9

File tree

7 files changed

+759
-27
lines changed

7 files changed

+759
-27
lines changed

‎Changelog

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
Release 0.5.1, 08-04-2010
2+
Fixes in TCP full-connect scan detection
3+
Better logging functions
4+
License changed to GPL v2.0
5+
6+
Moving repository to Github, 27-07-2013
7+
8+
9+
10+

‎LICENSE

Lines changed: 1 addition & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1 @@
1-
Copyright (c) 2013, pythonhacker
2-
All rights reserved.
3-
4-
Redistribution and use in source and binary forms, with or without modification,
5-
are permitted provided that the following conditions are met:
6-
7-
Redistributions of source code must retain the above copyright notice, this
8-
list of conditions and the following disclaimer.
9-
10-
Redistributions in binary form must reproduce the above copyright notice, this
11-
list of conditions and the following disclaimer in the documentation and/or
12-
other materials provided with the distribution.
13-
14-
Neither the name of the {organization} nor the names of its
15-
contributors may be used to endorse or promote products derived from
16-
this software without specific prior written permission.
17-
18-
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
19-
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20-
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21-
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
22-
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23-
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24-
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
25-
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26-
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27-
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1+
Check http://opensource.org/licenses/BSD-3-Clause

‎README

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
Introduction
2+
------------
3+
This package provides "Pyscanlogd", a port-scanning
4+
detection tool entirely written in Python. PyScanLog
5+
is inspired by scanlogd {http://www.openwall.com/scanlogd}.
6+
7+
Licensing
8+
---------
9+
The code is released under New BSD License.
10+
11+
Dependencies
12+
------------
13+
The code is dependent upon pypcap and dpkt. However there
14+
are problems with automatic installation of these packages
15+
through setup.py, so they are not added as dependencies
16+
into setup.py.
17+
18+
Instead either use your system's package manager to
19+
install the dependencies or visit their respective
20+
project pages to build from the latest source tarball.
21+
22+
pypcap: https://code.google.com/p/pypcap/
23+
dpkt: http://code.google.com/p/dpkt/
24+
25+
In Ubuntu, these dependencies can be installed by
26+
27+
$ sudo apt-get install python-pcap python-dpkt
28+
29+
Installation
30+
------------
31+
$ sudo python setup.py install
32+
33+
Usage
34+
-----
35+
To run with default options just run the tool as root.
36+
All scans are logged to the console.
37+
38+
$ sudo pyscanlogd
39+
listening on eth0:
40+
[2010-03-17 16:41:06]: TCP syn scan (flags:6) from 172.16.220.124 to 172.16.220.214 (ports:143,199,5900,256,111,1723,21,25,554,80,22)
41+
42+
To log to a file pass the "-f" option.
43+
To run as daemon pass the "-d" option.
44+
45+
Note: When running as daemon, if -f option is not provided,
46+
no output is printed to stdout.
47+
48+
$ sudo pyscanlogd -d -f "/var/log/scanlogd.log"
49+
Daemonizing...
50+
$ listening on eth0:
51+
52+
Currently there is no option to a specific interface.
53+
By default pyscanlogd listens to the active interface
54+
in promiscous mode.
55+

‎entry.py

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
# -- coding: utf-8
2+
3+
class ScanEntry(object):
4+
""" Port scan entry """
5+
6+
def __init__(self, hash):
7+
self.src = 0
8+
self.dst = 0
9+
self.zombie = 0
10+
self.timestamp = 0
11+
self.timediffs = []
12+
# Average of time-stamps
13+
self.time_avg = 0.0
14+
# Standard deviation in time-stamps
15+
self.time_sd = 0.0
16+
self.logged = False
17+
self.type = ''
18+
self.flags_or = 0
19+
# SCTP
20+
self.chunk_type = 0
21+
self.weight = 0
22+
self.ports = []
23+
self.proto = 0
24+
self.next = None
25+
self.hash = hash
26+
27+
def update_time_sd(self):
28+
""" Update standard deviation of time differences """
29+
30+
num = float(len(self.timediffs))
31+
if num>0:
32+
mean = 1.0*sum(self.timediffs)/num
33+
sd = pow(sum([pow((x - mean), 2) for x in self.timediffs])/num, 0.5)
34+
self.time_sd = sd
35+
self.time_avg = mean
36+
37+
class EntryLog(dict):
38+
""" Modified dictionary class with fixed size, which
39+
automatically removes oldest items, for storing port
40+
scan entry logs """
41+
42+
# This will work only if the value is an object storing
43+
# its key in the 'hash' attribute and links to other
44+
# objects usin the 'next' attribute.
45+
def __init__(self, maxsz):
46+
self.oldest = None
47+
self.last = None
48+
self.maxsz = maxsz
49+
super(EntryLog, self).__init__()
50+
51+
def __setitem__(self, key, value):
52+
if not self.__contains__(key) and len(self)==self.maxsz:
53+
# Remove oldest
54+
if self.oldest:
55+
self.__delitem__(self.oldest.hash)
56+
self.oldest = self.oldest.next
57+
58+
super(EntryLog, self).__setitem__(key,value)
59+
60+
if self.last:
61+
self.last.next = value
62+
self.last = value
63+
else:
64+
self.last = value
65+
self.oldest = self.last
66+
67+
68+
class RecentScanEntry(object):
69+
""" Recent scan entry class, storing
70+
most recent scan entries """
71+
72+
def __init__(self, scan, is_scan=True):
73+
self.src = scan.src
74+
self.dst = scan.dst
75+
self.zombie = scan.zombie
76+
self.type = scan.type
77+
self.flags_or = scan.flags_or
78+
self.ports = scan.ports[:]
79+
self.timestamp = scan.timestamp
80+
self.is_scan = is_scan
81+
82+
def __eq__(self, entry):
83+
return ((self.src==entry.src) and (self.dst==entry.dst) and \
84+
(self.type==entry.type))
85+

0 commit comments

Comments
 (0)