FLOW-DSCAN(1)

💖 FLOW-DSCAN — the tea on spotting sus network behaviour 💖

okay bestie, gather round, because flow-dscan(1) is genuinely iconic and you're gonna be obsessed. this is the page for flow-dscan, and it's giving detect scanning and other suspicious network activity. periodt. 🔥

---

✨ SYNOPSIS ✨

flow-dscan [ -bBhlmpwW ]  [ -d debug_level ]  [ -D iplist_depth ]  [ -s
state_file ]  [ -i input_filter ]  [ -L suppress_list ]  [ -o
output_filter ]  [ -O excessive_octets ]  [ -P excessive_flows ]  [ -S
port_scan_trigger ]  [ -t ager_timeout ]

like look at her. so many little flags. she's a whole vibe. 🦋

---

🌸 DESCRIPTION 🌸

so flow-dscan is the utility you use to sniff out suspicious activity — think port scanning, host scanning, and flows that are just doing the most with unusually high octets or packets. 🙈

there's a source and destination suppress list too, which exists so you don't get false alarms from the popular kids — hosts like nameservers or busy web servers that literally talk to a zillion other hosts all day. no cap, without the suppress list you'd be drowning in alerts about them.

alarms get logged to syslog or stderr. and the internal state of flow-dscan can be saved and loaded, so if your operation gets interrupted you can just pick it back up. the way that works?? chef's kiss. 💅

pro tip from the manpage itself: flow-dscan will work best if you configure it to watch only inbound or only outbound traffic, using the input or output interface filter option. do that. she thrives that way. ✨

here's how the scanners actually work, and this part is important so don't skip it:

• the host scanner counts the length of the destination IP hash chain. if it goes above 64, then the src is considered to be scanning. 💀
• the port scanner keeps a bitmap of the destination port number < 1024 per destination IP. if it goes above 64, the src is considered to be port scanning the destination.
• once a src has been flagged as scanning, it will not be reported again until the record is aged out and enough flows trigger it again. she's not gonna spam you about the same host, she has boundaries. 🫶

and the signals, because signals are the moment:

• a SIGHUP signal will instruct flow-dscan to reload the suppress list.
• a SIGUSR1 signal will instruct flow-dscan to dump its internal state.

---

🎀 OPTIONS 🎀

okay this is the part everyone scrolls to. every single one, no skipping, bestie. 👑

• -b — do not detach and run in the background. alerts go to stderr.
• -B — do not detach and run in the background. alerts go to syslog.
• -d debug_level — enable debugging.
• -D iplist_depth — depth of IP host list for detecting host scanning.
• -h — display help.
• -i input_filter — input interface filter list.
• -I output_filter — output interface filter list.
• -l — load state from /var/tmp/dscan.state or the filename specified with -s.
• -L suppress_list — basename of suppress files. there are two suppress files, one for input and one for output traffic. the suppress file syntax is:

IP_address protocol source_port destination_port

a - can be used as a wildcard in the protocol, source_port, and destination_port fields. only a single protocol, source_port, and destination_port is supported per IP address. (yes really, one. she's simple like that. 🍓)

• -m — multicast address filter. use to ignore multicast addresses.
• -O excessive_octets — trigger an alert if a flow is processed with the octets field exceeding excessive_octets.
• -p — dump state to /var/tmp/dscan.state or the filename specified with -s.
• -P excessive_packets — trigger an alert if a flow is processed with the packets field exceeding excessive_packets.
• -s statefile — state filename. defaults to /var/tmp/dscan.state
• -S port_scan_trigger — number of ports a IP address must have used to be considered scanning.
• -t ager_timeout — how long to keep flows around. default to 90000. this is measured in flows processed. 👀
• -T excessive_time — trigger an alert if a flow is processed with the End-Start field exceeding excessive_time.
• -w — filter (ignore) candidate inbound www traffic, ie IP protocol 6, source port 80, and destination port > 1023.
• -W — filter (ignore) candidate outbound www traffic, ie IP protocol 6, destination port 80, and source port > 1023.

---

🌈 EXAMPLES 🌈

imagine a topology where 25 is the only output interface. run flow-dscan over the data in /flows/krc4. ignore www and multicast traffic, store the internal state in dscan.statefile on exit. use empty suppress list files dscan.suppress.src and dscan.suppress.dst.

heads up fr fr: the output produced by flow-dscan typically must be manually inspected by using flow-filter and flow-print. and many of the alerts will be false until the suppress lists are populated for the local environment. that's not a bug, that's just the vibe of a fresh setup. 💜

flow-cat /flows/krc4 | flow-dscan -I25 -b -m -s dscan.statefile -p -W

---

💀 BUGS 💀

okay so this is the part where we're honest. the ager should automatically become more aggressive when a low memory condition exists. there is no upper limit on the number of records that can be allocated. if the ager is not running often enough the host will be run out of memory.

so like... watch your memory, bestie. she will eat it. no cap. 😭

---

👑 AUTHOR 👑

Mark Fullmer <maf@splintered.net>

---

🦋 SEE ALSO 🦋

• flow-tools(1)

---

and that's the whole page, bestie!! this one's from the FLOW-DSCAN(1) manual, dated 26 Август 2010. go forth and catch those scanners. slay. 💅✨🎀