About Port and IP Address Scans
Attackers frequently look for open ports as starting points to launch network attacks. A port scan is TCP or UDP traffic that is sent to a range of ports. These ports can be in sequence or random, from 0 to 65535. An IP scan is TCP or UDP traffic that is sent to a range of network addresses. Port scans examine a computer to find the services that it uses. IP address scans examine a network to see which network devices are on that network.
For more information about ports, go to About Ports.
How the Firebox Identifies Network Scans
An IP address space scan is identified when a computer sends a specified number of packets to different IP addresses assigned to a Firebox interface. To identify a port scan, your Firebox counts the number of packets sent from one IP address to any Firebox interface IP address. The addresses can include the primary IP addresses and any secondary IP addresses configured on the interface. If the number of packets sent to different IP addresses or destination ports in one second is larger than the number you select, the source IP address is added to the Blocked Sites list.
When the Block Port Scan, Block IP Scan or Auto-block source IP of unhandled external packets check boxes are selected, all inbound traffic is examined by the Firebox. You cannot disable these features for specified IP addresses, specified Firebox interfaces, or different time periods.
To Protect Against Port Scan and IP Address Scans
The default configuration of the Firebox blocks network scans. You can change the settings for this feature, and change the maximum allowed number of address or port scans per second for each source IP address (the default value is 10).
To block attackers more quickly, you can set the threshold for the maximum allowed number of address or port scans per second to a lower value. However, if you set the number too low, the Firebox might identify legitimate network traffic as an attack and deny the traffic. You are less likely to block legitimate network traffic if you use a higher number, but the Firebox must send TCP reset packets for each connection it drops. This uses bandwidth and resources on the Firebox and provides the attacker with information about your firewall.
- Select Firewall > Default Packet Handling.
The Default Packet Handling page appears.
- Select or clear the Block Port Scan and the Block IP Scan check boxes.
- Type the maximum number of address or port scans to allow per second from the same IP address. The default for each is 10 per second. This means that a source is blocked if it initiates connections to 10 different ports or hosts within one second.
- Click Save.
To protect against network port probes, from Policy Manager:
- Click
.
Or, select Setup > Default Threat Protection > Default Packet Handling.
The Default Packet Handling dialog box appears.
- Select or clear the Block Port Scan and the Block IP Scan check boxes.
- Click the arrows to select the maximum number of address or port scans to allow per second from the same IP address. The default for each is 10 per second. This means that a source is blocked if it initiates connections to 10 different ports or hosts within one second.
- Click OK.