KILLSCAN rules

Last Updated : Aug 24, 2014 |
Prolog information
Metadata
Keywords:
  1. Remove the current IP from the portscan list.
  2. Any IP address sending packets with FIN, PSH, and URG flags set, but without SYN, RST, or ACK flags is added to the portscan list.
  3. Any IP address sending packets with SYN and RST flags set is added to the portscan list.
  4. Any IP address sending packets with FIN and SYN flags set is added to the portscan list.
  5. Any IP address sending packets with FIN flags set, but without SYN, RST, PSH, ACK, or URG flags is added to the portscan list.
  6. Any IP address sending packets with FIN, SYN, RST, PSH, ACK, and URG flags set is added to the portscan list.
  7. Any IP address sending packets without any FIN, SYN, RST, PSH, ACK, or URG flags set is added to the portscan list.
  8. Any IP address sending packets with FIN, SYN, RST, PSH, ACK, and URG flags set is added to the portscan list.
  9. Drop all packets from any IP in the portscan list.