Snort with Portscan Detection Preprocessor for Anomaly Alerting

This configuration enables the sfportscan preprocessor in Snort to detect various types of port scans, including TCP SYN, UDP, and ICMP scans. Internally, the preprocessor monitors connection attempts and tracks them using a sliding window algorithm based on source IP, destination IP, and protocol. It classifies scans into categories like portscan (single host scanning multiple ports), portsweep (multiple hosts scanning a single port), and distributed portscan (multiple sources scanning multiple destinations). It uses a memory cap and time window (e.g., 60 seconds) to detect anomalies, and generates alerts with the signature ID 1000001. In production, use this on external-facing interfaces to detect reconnaissance attempts before an attack, such as a penetration test or worm propagation. It is particularly useful in DMZ networks where servers are exposed to the internet. The security implication is that false positives can occur from legitimate network tools (e.g., nmap scans by security teams), so you should whitelist internal scanning IPs. Performance impact is moderate because the preprocessor must track many connections, which can use significant memory under heavy scan traffic (e.g., DDoS). Common pitfalls include not setting the correct proto for detection (e.g., ignoring UDP scans), or setting the time window too short, causing missed slow scans.

> System.Execute()

preprocessor sfportscan: proto { all } memcap 10000000 sense_level { high } scan_type { all } logfile /var/log/snort/portscan.log
# Exclude trusted IPs in snort.conf
preprocessor sfportscan: ignore_scanners { 10.0.0.0/8 } ignore_scanned { 10.0.0.0/8 }

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-DDF24EE9122B