anonfunc/xtables-addons
1
0
Fork 0
mirror of git://git.code.sf.net/p/xtables-addons/xtables-addons synced 2025-09-20 11:34:57 +02:00
Code Issues Releases Wiki Activity

xt_lscan: add --mirai option

Browse Source
This commit is contained in:
Jan Engelhardt
2021-01-20 03:06:11 +01:00
parent f59a4eb9d9
commit 43df040e05
4 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
extensions/libxt_lscan.man
View File

@@ -27,6 +27,11 @@ warranted single-direction data flows, usually bulk data transfers such as
FTP DATA connections or IRC DCC. Grab Scan Detection should only be used on
ports where a protocol runs that is guaranteed to do a bidirectional exchange
of bytes.
.TP
\fB\-\-mirai\fP
Match if the TCP ISN is equal to the IPv4 destination address; this is used
by the devices in the Mirai botnet as a form of TCP SYN scan, so you will
have to explicitly specify --syn for the rule.
.PP
NOTE: Some clients (Windows XP for example) may do what looks like a SYN scan,
so be advised to carefully use xt_lscan in conjunction with blocking rules,