Chapter 3 – RouteFinder Software Operation
Multi-Tech RouteFinder RF650VPN User Guide
92
Portscan Detection (PSD)
From Network|Portscan Detection you can let the RouteFinder detect "portscans".
The Port Scan Detection menu lets you configure the RouteFinder's PSD (Portscan Detection) feature.
The Portscan Detection (PSD) feature lets you find out about possible attacks on your network.
Portscans are mostly used by remote attackers to probe a network for vulnerable services.
PSD can detect those scans and report them by email, as well as log them.
Portscan Detection Enable/Disable
1.
Open the Portscan Detection menu in the Network directory.
2.
Enable the PSD function with the Enable button next to Status. The default setting is enabled (green
traffic light).
3.
From the Action for portscanner traffic select menu, choose the action to be carried out against the
discovered portscanner:
Drop (blackhole): The network appears to have disappeared to the attacker.
Reject: The connection requests are rejected with “Destination unreachable“. The port is shown as
closed and the attacker has no access to the services.
Accept: No measure is taken against the portscanner.
If you selected Drop or Reject, the selected action remains active until the portscan traffic stops.
3.
Save the selection by clicking the Save button.
Note: Normal network activity such as traceroute or FTP traffic with many small files will also look like a
portscan to the PSD. To ensure smooth operation, you can exclude network source and destination
combinations from the PSD.
