PSAD(8)

📦 version 2.4.6, in alpine 3.24, debian bookworm, debian trixie, fedora 43, fedora 44, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

🎀 psad(8) 🎀 — The Port Scan Attack Detector 💅

okay so hi bestie, you've landed on the psad(8) page from the System Manager's Manual and honestly? you're about to have a great time. this is the port scan detective of your dreams and i'm gonna walk you through every single flag like we're texting at 2am. no skimming, no skipping, we're doing this properly. ✨

💖 NAME 💖

psad — The Port Scan Attack Detector 🕵️♀️

🌸 SYNOPSIS 🌸

psad [options]

that's it. that's the whole vibe. it's just psad plus whatever options you want. 🫶

🦋 DESCRIPTION 🦋

okay so here's the tea: psad eats iptables log messages for breakfast and uses them to detect, alert, and (optionally) block port scans and other sus traffic. 👑

for TCP scans, psad reads the TCP flags to figure out which type of scan it's looking at (syn, fin, xmas, etc.) and which corresponding command line options you'd hand to nmap to make such a scan happen. like, it can reverse-engineer the receipt. 😭

plus, psad flexes a whole bunch of TCP, UDP, and ICMP signatures that live inside the Snort intrusion detection system (peep http://www.snort.org/) to catch sketchy network traffic — probes for common backdoors, DDoS tools, OS fingerprinting attempts, and more. ✨

by default psad also throws alerts for snort rules that iptables detects directly, using a ruleset generated by fwsnort (http://www.cipherdyne.org/fwsnort/). this is the moment where psad can send alerts for application layer attacks. ate. 💅

psad ships with a set of highly configurable danger thresholds (with sensible defaults already set up for you, because she's thoughtful like that 🌈) so the administrator gets to define what actually counts as a port scan or other suspect traffic.

the email alerts from psad contain:

  • the scanning ip
  • the number of packets sent to each port
  • any TCP, UDP, or ICMP signatures that have been matched (e.g. "NMAP XMAS scan")
  • the scanned port range
  • the current danger level (from 1 to 5)
  • reverse dns info
  • whois information

psad also uses various packet header fields from TCP SYN packets to passively fingerprint remote operating systems — in a manner similar to the p0f fingerprinter — so it knows where scans are originating from. this needs the --log-tcp-options argument on your iptables logging rules. if you don't use that option, psad falls back to a fingerprinting method that uses packet length, TTL and TOS values, IP ID, and TCP window sizes. no cap. 🧚

by default psad reads all iptables log data from the /var/log/messages file. by parsing firewall log messages, psad gets a data stream representing packets that have been logged (and possibly dropped) by the running iptables policy. which means psad is fed a pure data stream containing exclusively packets the firewall already deemed unfit to enter the network. iconic. 🔥

psad is actually made of three daemons: psad, kmsgsd, and psadwatchd.

  • psad is responsible for processing all packets logged by the firewall and applying the signature logic to determine what type of scan has been leveraged against the machine and/or network.
  • kmsgsd (deprecated! ⚠️) reads all messages written to the /var/lib/psad/psadfifo named pipe and writes any message matching a particular regular expression (or string) to /var/log/psad/fwdata. kmsgsd is only used if the ENABLE_SYSLOG_FILE variable is disabled in psad.conf.
  • psadwatchd is a software watchdog that restarts either of the other two daemons if one dies for any reason. she's the friend who checks on everyone. 🫶

✨ OPTIONS ✨

  • -A, --Analyze-msgs — analyze an iptables logfile for scans and exit. this generates email alerts just like a normal running psad process would have for all logged scans. by default the psad data file /var/log/psad/fwdata is parsed for old scans, but you can point it at any file with the --messages-file command line option. for example, it might be useful to point psad at your /var/log/messages file.
  • --analysis-fields <search fields> — in --Analyze mode, restrict analysis to iptables log messages that have specific values for particular fields. examples include "SRC:1.2.3.4", "DST:10.0.0.0/24, and "TTL:64", and multiple fields are supported as a comma-separated list like "SRC:1.2.3.4, LEN:44, DST:10.0.0.0/24".
  • -i, --interface <interface> — specify the interface that psad will examine for iptables log messages. this interface will be the IN= interface for packets logged in the INPUT and FORWARD chains, and the OUT= interface for packets logged in the OUTPUT chain. 🌈
  • --sig-update — instruct psad to download the latest set of modified Snort signatures from http://www.cipherdyne.org/psad/signatures so psad can take advantage of signature updates before a new release is even made. she stays ahead of the drop. 💅
  • -O, --Override-config <file> — override config variable values that are normally read from the /etc/psad/psad.conf file with values from the specified file. multiple override config files can be given as a comma separated list.
  • -D, --Dump-conf — dump the current psad config to STDOUT and exit. various pieces of info like the home network, alert email addresses, and DShield user id are removed from the resulting output, so it's safe to send to others. 🫶
  • -F, --Flush — remove any auto-generated firewall block rules if psad was configured to automatically respond to scans (see the ENABLE_AUTO_IDS variable in psad.conf).
  • -S, --Status — display the status of any psad processes that may or may not be running. the status output contains a listing of the number of packets processed by psad, plus all IP addresses and corresponding danger levels that have scanned the network. 📊
  • --status-ip <ip> — display status information associated with ip, such as the protocol packet counters as well as the last 10 packets logged by iptables.
  • --status-dl <dl> — display status information only for scans that have reached a danger level of at least dl.
  • --status-summary — instruct psad to omit detailed IP information from --Status and --Analyze modes.
  • -m, --messages-file <file> — this option specifies the file that will be parsed in analysis mode (see the --Analyze-msgs option). the default path is the psad data file /var/log/psad/fwdata.
  • --CSV — instruct psad to parse iptables log messages out of /var/log/messages (by default, but this path can be changed with the -m option), and print the packet fields on STDOUT in comma-separate value format. this is useful for graphing iptables log data with AfterGlow (see http://afterglow.sourceforge.net/index.html). 📈
  • --stdin — acquire iptables log data from STDIN instead of the default /var/log/messages file.
  • --CSV-fields <tokens> — instruct psad to only include a specific set of iptables log message fields within the CSV output. AfterGlow accepts up to three fields for its graph data, so the most common usage of this option is "src dst dp" to print the source and destination IP addresses, and the destination port number.
  • -K, --Kill — kill the current psad process along with psadwatchd and kmsgsd. this is a quick and easy way to kill all psad processes without digging through the process table or appealing to the psad-init script. 💀
  • -R, --Restart — restart the currently running psad processes. this option preserves the command line options that were supplied to the original psad process.
  • -U, --USR1 — send a running psad process a USR1 signal. this causes psad to dump the contents of the %Scan hash to the file /var/log/psad/scan_hash.$$ where $$ represents the pid of the psad process. mostly useful for debugging, but it also lets the administrator peer into the %Scan hash — the primary data structure used to store scan data within system memory. 👀
  • -H, --HUP — send all running psad daemons a HUP signal. this instructs the daemons to re-read their respective configuration files without causing scan data to be lost in the process.
  • -B, --Benchmark — run psad in benchmark mode. by default benchmark mode simulates a scan of 10,000 packets (see the --packets option) and then reports the elapsed time. useful to see how fast psad can process packets on a specific machine. 🏎️
  • -p, --packets <packets> — specify the number of packets to analyze in --Analyze mode or use in --Benchmark mode. the default is 10,000 packets in --Benchmark mode, and unlimited in --Analyze mode.
  • -d, --debug — run psad in debugging mode. this automatically prevents psad from running as a daemon, and prints the contents of the %Scan hash and a few other things on STDOUT at crucial points as psad executes. 🐛
  • -c, --config <configuration-file> — by default all of the psad makes use of the configuration file /etc/psad/psad.conf for almost all configuration parameters. psad can be made to override this path by specifying a different file on the command line with the --config option.
  • --signatures <signatures-file> — the iptables firewalling code included within the linux 2.4.x kernel series has the ability to distinguish and log any of the TCP flags present within TCP packets that traverse the firewall interfaces. psad makes use of this logging capability to detect several types of TCP scan signatures included within /etc/psad/signatures. these signatures were originally included within the snort intrusion detection system. new signatures can be included and modifications to existing signatures can be made to the signature file, and psad will import the changes upon receiving a HUP signal (see the --HUP command line option) without having to restart the psad process. psad also detects many UDP and ICMP signatures that were originally included within snort. 🧚
  • -e, --email-analysis — send alert emails when run in --Analyze-msgs mode. depending on the size of the iptables logfile, using the --email-analysis option could extend the runtime of psad by quite a bit, since normally both DNS and whois lookups will be issued against each scanning IP address. as usual these lookups can be disabled with the --no-rdns and --no-whois options respectively. 😭
  • -w, --whois-analysis — by default psad does not issue whois lookups when running in --Analyze-msgs mode. the --whois-analysis option overrides this behavior (when run in analysis mode) and instructs psad to issue whois lookups against IP addresses from which scans or other suspect traffic has originated. 🔍
  • --analysis-auto-block — turns on auto-blocking responses while you're in --Analyze-msgs mode. ngl bestie, this one is basically for the psad test suite only, where auto-blocking responses get tested and verified. that's the whole vibe. 🧪
  • --snort-type <type> — restricts which type of snort sids you're dealing with. the allowed types match the file names that get handed to snort rules files — think "ddos", "backdoor", "web-attacks" and friends. 🐍
  • --snort-rdir <snort-rules-directory> — you wanna hand-pick the directory where the snort rules files live? say it here. the default is /etc/psad/snort_rules. 📂
  • --passive-os-sigs <passive-os-sigs-file> — manually point at the path for the passive operating system fingerprinting signatures file. default? /etc/psad/posf. 💅
  • --auto-dl <auto-dl-file> — okay so sometimes certain IP addresses are repeat offenders and deserve a way higher danger level than they'd normally get. and also, some IP addresses can always be ignored depending on your network config (like the loopback interface 127.0.0.1 — iconic candidate for ignoring, tbh). /etc/psad/auto_dl is the interface that lets psad automatically increase, decrease, or straight up ignore scanning IP danger levels. you can make edits to auto_dl (it's installed by default in /etc/psad) and psad will import them with psad -H or by restarting the psad process. 🔥
  • --fw-search <fw_search-file> — by default, all of psad makes use of the firewall search config file /etc/psad/fw_search.conf for firewall search mode and search strings. but psad can override this path if you specify a different file on the command line with the --fw-search option. ✨
  • --fw-list-auto — lists every rule in iptables chains that psad uses in auto-blocking mode. 👑
  • --fw-analyze — analyzes the local iptables ruleset, sends any alerts if errors are discovered, and then dips out (exits). 🚨
  • --fw-del-chains — by default, if ENABLE_AUTO_IDS is set to "Y", psad will not delete the auto-generated iptables chains (peep the IPT_AUTO_CHAIN keywords in psad.conf) if the --Flush option is given. the --fw-del-chains option overrides that behavior and deletes the auto-blocking chains from a running iptables firewall. 😤
  • --fw-dump — tells psad to dump the contents of the iptables policy running on the local system. every IP address is stripped from the resulting output, so it's totally safe to post to the psad list or share with others. this option is most often used with --Dump-conf. 🫶
  • --fw-block-ip <ip> — specify an IP address or network to add to the iptables controls that psad auto-generates. this lets psad manage the rule timeouts. 🚫
  • --fw-rm-block-ip <ip> — specify an IP address or network to remove from the iptables controls that psad auto-generates. bye felicia 👋
  • --fw-file <policy-file> — analyze the iptables ruleset contained within policy-file instead of the ruleset currently loaded on the local system. 📄
  • --CSV-regex <regex> — tells psad to only print CSV data that matches the regex you supply. this regex gets matched against each of the entire iptables log messages. 🔍
  • --CSV-neg-regex <regex> — tells psad to only print CSV data that does not match the regex you supply. same deal, it negatively matches against each of the entire iptables log messages. 🙅
  • --CSV-uniq-lines — tells psad to only print unique CSV data. so like, every single line printed in --CSV mode will be unique. no dupes, no repeats, periodt. 💯
  • --CSV-max-lines <num> — caps the number of CSV-formatted lines psad spits out on STDOUT. super useful when you want AfterGlow graphs that aren't too cluttered. 🌈
  • --CSV-start-line <num> — picks the beginning line number to start parsing out of the iptables log file in --CSV output mode. great for when the log file is extremely large and you only wanna start parsing at a specific place inside it. the default is to begin parsing at the beginning of the file. ⭐
  • --CSV-end-line <num> — picks the ending line number to stop parsing the iptables log file in --CSV output mode. also great for extremely large log files when you do not want psad to process the entire thing. 🛑
  • --gnuplot — enters Gnuplot mode, where psad parses an iptables logfile and creates .gnu and .dat files that are suitable for graphing with Gnuplot. the various --CSV command line arguments apply to plotting an iptables log with Gnuplot too. 📊
  • --gnuplot-template <file> — use a template file for all the Gnuplot graphing directives (conventionally a .gnu file). normally psad builds all the graphing directives based on various --gnuplot command line arguments, but the --gnuplot-template switch lets you override that behavior. 🎀
  • --gnuplot-file-prefix <file> — sets a prefix for the .gnu, .dat, and .png files generated in --gnuplot mode. so when you're visualizing attacks captured in an iptables logfile (say you're interested in port scans), you could use this option to have psad create the two files portscan.dat, portscan.gnu, and Gnuplot will create an additional file portscan.png when the portscan.gnu file is loaded. chef's kiss 👩‍🍳
  • --gnuplot-x-label <label> — sets the label associated with the x-axis. 📈
  • --gnuplot-x-range <range> — sets the x-axis range. 📉
  • --gnuplot-y-label <label> — sets the label associated with the y-axis. 🦋
  • --gnuplot-y-range <range> — sets the y-axis range. 🌸
  • --gnuplot-z-label <label> — sets the label associated with the z-axis (only if --gnuplot-3D is used). 🧊
  • --gnuplot-z-range <range> — sets the z-axis range (only if --gnuplot-3D is used). 💎
  • --gnuplot-3D — generates a Gnuplot splot graph. this produces a three-dimensional graph, bestie. we're going 3D. 🚀
  • --gnuplot-view — sets the viewing angle when graphing data in --gnuplot-3D mode. 🔭
  • --gnuplot-title <title> — sets the graph title for the Gnuplot graph. 👑
  • -I, --Interval <seconds> — specify the interval (in seconds) that psad should use to check whether or not packets have been logged by the firewall. psad uses a default of 15 seconds unless you specify a different value. ⏱️
  • -l, --log-server — use this one if psad is being executed on a syslog logging server. running psad on a logging server requires that check_firewall_rules() and auto_psad_response() not be executed, since the firewall probably isn't being run locally. 🖥️
  • -V, --Version — prints the psad version and exits. quick lil flex. 💅
  • --no-daemon — don't run psad as a daemon. this option will display scan alerts on STDOUT instead of emailing them out. 📬
  • --no-ipt-errors — okay so occasionally iptables messages written by syslog to /var/log/messages seem to not conform to the normal firewall logging format, if the kernel ring buffer used by klogd becomes full. psad will write these messages to /var/log/psad/errs/fwerrorlog by default. passing the --no-ipt-errors option makes psad ignore all such erroneous firewall messages. 😭
  • --no-whois — by default psad issues a whois query against any IP from which a scan has originated, but you can disable that with the --no-whois command line argument. 🕵️
  • --no-fwcheck — psad performs a rudimentary check of the firewall ruleset that exists on the machine where psad is deployed, to determine whether or not the firewall has a compatible configuration (i.e. iptables has been configured to log packets). passing --no-fwcheck or --log-server will disable this check. ✅
  • --no-auto-dl — disables auto danger level assignments. this instructs psad to not import any IP addresses or networks from the file /etc/psad/auto_dl. 🚮
  • --no-snort-sids — disables snort sid processing mode. this instructs psad to not import snort rules (for snort SID matching in a policy generated by fwsnort). 🐍
  • --no-signatures — disables psad signature processing. note that this is independent of snort SID matching in iptables messages generated by fwsnort, and also independent from the ICMP type/code validation routines. 🔕
  • --no-icmp-types — disables ICMP type and code field validation. 🌐
  • --no-passive-os — by default psad attempts to passively (i.e. without sending any packets) fingerprint the remote operating system from which a scan originates. passing the --no-passive-os option disables this feature. 🧬
  • --no-rdns — psad normally attempts to find the name associated with a scanning IP address, but this feature can be disabled with the --no-rdns command line argument. 🔎
  • --no-kmsgsd — disables startup of kmsgsd. this option is most useful for debugging with individual iptables messages, so that new messages are not appended to the /var/log/psad/fwdata file. 🐛
  • --no-netstat — by default, for iptables firewalls, psad determines whether or not your machine is listening on a port for which a TCP signature has been matched. specifying --no-netstat disables this feature. 🚪
  • -h, --help — prints a page of usage information for psad and exits. the classic. 🫶

📁 FILES 📁

Okay bestie, here's the tea on every file psad is lowkey obsessed with. ☕💖 No skipping, fr fr.

  • /etc/psad/psad.conf — This is the main psad configuration file, and it's where all those config variables mentioned in the section below live. 👑
  • /etc/psad/fw_search.conf — Used to configure the strategy that both psad and kmsgsd employ to parse iptables messages. Using a configuration directive within this file, psad can be configured to parse all iptables messages or only those that match specific log prefix strings (see the --log-prefix option to iptables). ✨
  • /etc/psad/signatures — Contains the signatures psad uses to recognize nasty traffic. The signatures are written in a manner similar to the *lib signature files used in the snort IDS. 🚨
  • /etc/psad/icmp_types — Contains all valid ICMP types and corresponding codes as defined by RFC 792. By default, ICMP packets are validated against these values, and an alert will be generated if a non-matching ICMP packet is logged by iptables. 🦋
  • /etc/psad/snort_rules/*.rules — Snort rules files that are consulted by default unless the --no-snort-sids command line argument is given. 📜
  • /etc/psad/auto_dl — Contains a listing of any IP addresses that should be assigned a danger level based on any traffic that is logged by the firewall. The syntax is "<IP address> <danger level>" where <danger level> is an integer from 0 to 5, with 0 meaning to ignore all traffic from <IP address>, and 5 is to assign the highest danger level to <IP address>. 💅
  • /etc/psad/posf — Contains a listing of all passive operating system fingerprinting signatures. These signatures include packet lengths, ttl, tos, IP ID, and TCP window size values that are specific to various operating systems. 🎀

✨ PSAD CONFIGURATION VARIABLES ✨

okay bestie, this is the part where we go through the config variables one by one 🎀 and honestly? this is where you get to make psad yours. Every one of these lives somewhere and does something, and most of them come pre-set with sensible defaults for most network architectures during the install process, so you don't have to touch them. But if you wanna tune, this is the menu.

Most of the variables hang out in the psad config file /etc/psad/psad.conf, except FW_SEARCH_ALL and FW_MSG_SEARCH, which live in /etc/psad/fw_search.conf instead (iykyk why in a sec).

Wanna read more about psad config keywords? There's more at: http://www.cipherdyne.org/psad/config.html

💌 EMAIL_ADDRESSES

Comma-separated list of email addresses where your alert emails get sent. Default is "root@localhost".

🏠 HOSTNAME

The hostname of the machine psad is running on. This is what shows up in the email alerts psad generates, so make it a good one.

🌐 HOME_NET

Defines the internal network(s) connected to the local system. This gets used in the signature matching code to figure out whether traffic matches snort rules — and those rules invariably contain a source and destination network, so yeah, this matters. You can list multiple networks as a comma-separated list, and each network should be in CIDR notation. Normally, the network(s) in HOME_NET should be directly connected to the machine running psad.

📦 IMPORT_OLD_SCANS

Keeps your scan data alive across restarts of psad, or even across reboots of the machine 💖 How? By importing the data in the filesystem cache that psad writes to during normal operation back into memory as psad starts up. That filesystem cache data lives in the directory /var/log/psad.

🔍 FW_SEARCH_ALL

Sets the search mode psad uses to parse iptables messages. By default this is "Y" because, like, normally most people want all iptables log messages parsed for scan activity. But if you set it to "N", psad will only parse the iptables log messages that match certain search strings appearing in iptables logs via the --log-prefix option. Super useful if you wanna restrict psad to only operate on specific iptables chains or rules. The strings it searches for are defined by the FW_MSG_SEARCH variable (see below 👇). And this one lives in /etc/psad/fw_search.conf because it's referenced by both psad and kmsgsd.

A set of search strings psad uses to identify iptables messages that should be parsed for scan activity. These search strings should match the log prefix strings you specified in your iptables ruleset with the --log-prefix option, and the default value is "DROP". Note that psad normally parses all iptables messages, so FW_MSG_SEARCH is only needed if FW_SEARCH_ALL (above) is set to "N". This variable is referenced by both psad and kmsgsd, so it lives in /etc/psad/fw_search.conf.

📜 SYSLOG_DAEMON

Tells psad which specific syslog daemon it should interface with. psad supports three: syslogd, syslog-ng, and metalog. Default value is syslogd.

🙈 IGNORE_PORTS

A list of port ranges and/or individual ports plus their corresponding protocols that psad should completely ignore. This is especially handy for ignoring ports that are part of a port knocking scheme (like fwknop — http://www.cipherdyne.org/fwknop/) for network authentication, because otherwise those log messages generated by the knock sequence might get interpreted as a scan 😭 You can specify multiple ports and/or port ranges as a comma-separated list, e.g. "tcp/22, tcp/61000-61356, udp/53".

🧠 ENABLE_PERSISTENCE

If "Y", psad will keep all scans in memory and not let them timeout. This helps you catch stealthy scans where an attacker tries to slip beneath IDS thresholds by only scanning a few ports over a long period of time 👑 It's set to "Y" by default.

⏳ SCAN_TIMEOUT

If ENABLE_PERSISTENCE is "N", then psad uses the value set by SCAN_TIMEOUT to remove packets from the scan threshold calculation. Default is 3600 seconds (1 hour).

🚨 DANGER_LEVEL{1,2,3,4,5}

psad uses a scoring system to keep track of how severe a scan gets (represented as a "danger level") over time. The DANGER_LEVEL{n} variables define the number of packets that must be dropped by the firewall before psad assigns the respective danger level to the scan. A scan can also get a danger level if it matches a particular signature contained in the signatures file. There are five possible danger levels, one being the lowest and five the highest.

Heads up though — several factors can influence how danger levels are calculated:

  • whether or not a scan matches a signature listed in /etc/psad/signatures
  • the value of PORT_RANGE_SCAN_THRESHOLD (see below)
  • whether or not a scan comes from an IP listed in the /etc/psad/auto_dl file
  • whether or not scans are allowed to timeout, as determined by SCAN_TIMEOUT above

If a signature is matched, or the scanning IP is listed in /etc/psad/auto_dl, then the corresponding danger level is automatically assigned to the scan.

📏 PORT_RANGE_SCAN_THRESHOLD

Defines the minimum difference between the lowest port and the highest port scanned before an alert is sent. Default is 1, which means at least two ports must be scanned to generate an alert.

Example time 🌸 suppose an ip repeatedly scans a single port for which there is no special signature in signatures. Then if PORT_RANGE_SCAN_THRESHOLD=1, psad will never send an alert for this "scan" no matter how many packets are sent to the port (i.e. no matter what the value of DANGER_LEVEL1 is). The reason for the default of 1 is that a "scan" usually means at least two ports are probed. But if you want psad to be extra paranoid 🫣 you can set PORT_RANGE_SCAN_THRESHOLD=0 to alert on scans to single ports — as long as the number of packets also exceeds DANGER_LEVEL1.

👀 SHOW_ALL_SIGNATURES

If "Y", psad will display all signatures detected from a single scanning IP since a scan was first detected, instead of just displaying newly-detected signatures. It's set to "N" by default. All signatures are listed in the file /etc/psad/signatures.

🐷 SNORT_SID_STR

The string kmsgsd will search for in iptables log messages that are generated by iptables rules designed to detect snort rules. Default is "SID". See fwsnort (http://www.cipherdyne.org/fwsnort/).

🛡️ ENABLE_DSHIELD_ALERTS

Enables dshield alerting mode ✨ This sends a parsed version of iptables log messages to dshield.org, which is a (free) distributed intrusion detection service. More info at http://www.dshield.org/

💀 IGNORE_CONNTRACK_BUG_PKTS

If "Y", all TCP packets that have the ACK or RST flag bits set will be ignored by psad, since usually we see such packets being blocked as a result of the iptables connection tracking bug. Note there are no signatures that make use of the RST flag, and very few that use the ACK flag.

📧 ALERT_ALL

If "Y", send email for all new bad packets instead of just when a danger level increases. ALERT_ALL is set to "Y" by default.

🔢 PSAD_EMAIL_LIMIT

The maximum number of emails that will be sent for a single scanning IP — default is 50. This variable gives you some protection from psad sending countless alerts if an IP scans your machine constantly. psad will send a special alert if an IP has exceeded the email limit. And if PSAD_EMAIL_LIMIT is set to zero, then psad will ignore the limit entirely and send alert emails indefinitely for any scanning ip 😭

🚦 EMAIL_ALERT_DANGER_LEVEL

The danger level a scan must reach before any alert is sent. Set to 1 by default.

⚠️ ENABLE_AUTO_IDS

psad has the capability of dynamically blocking all traffic from an IP that has reached a (configurable) danger level, by modifying iptables or tcpwrapper rulesets.

IMPORTANT: This feature is disabled by default 😤 because it's possible for an attacker to spoof packets from a well known (web)site in an effort to make it look as though the site is scanning your machine — and then psad will consequently block all access to it. Also, psad works by parsing firewall messages for packets the firewall has already dropped, so the "scans" are unsuccessful anyway. However, some administrators prefer to take this risk anyway, reasoning that they can always review which sites are being blocked and manually remove the block if necessary (see the --Flush option). Your mileage will vary.

🎯 AUTO_IDS_DANGER_LEVEL

Defines the danger level a scan must reach before psad will automatically block the IP (ENABLE_AUTO_IDS must be set to "Y").

🌸 EXAMPLES 🌸

ok so here's the tea, bestie — these are the actual command line arguments you could hand to psad in a few real-life situations 💅

✨ the no-notes, default-girlie run

Signature checking, passive OS fingerprinting, and automatic IP danger level assignments are enabled by default, no command line arguments needed. best for most situations, fr fr 🫶

# psad

✨ same energy, but the init script does it

Same as above, but this time we use the init script to start psad:

# /etc/init.d/psad start

✨ forensics mode, let's investigate

Use psad as a forensics tool to analyze an old iptables logfile — and just so you know, psad defaults to analyzing the /var/log/messages file if the -m option is not specified 👀

# psad -A -m <iptables logfile>

✨ forensics, but make it ONE ip only

Run psad in forensics mode, but limit its operations to a specific IP address "10.1.1.1":

# psad -A -m <iptables logfile> --analysis-fields src:10.1.1.1

✨ graph o'clock (AfterGlow era)

Generate graphs of scan data using AfterGlow 🌈:

# psad --CSV --CSV-fields src dst dp --CSV-max 1000 -m <iptables
logfile> | perl afterglow.pl -c color.properties | neato -Tgif -o
iptables_graph.gif

✨ relocating the config files

The psad.conf, signatures, and auto_dl files are normally located within the /etc/psad/ directory, but the paths to each of these files can be changed 🎀

# psad -c <config file> -s <signatures file> -a <auto ips file>

✨ syslog server life

Disable the firewall check and the local port lookup subroutines; most useful if psad is deployed on a syslog logging server:

# psad --log-server --no-netstat

✨ speed is the main character

Disable reverse dns and whois lookups of scanning IP addresses; most useful if speed of psad is the main concern 🏃‍♀️💨

# psad --no-rdns --no-whois

🧚 DEPENDENCIES 🧚

ok so psad requires that iptables is configured with a "drop and log" policy for any traffic that is not explicitly allowed through. this is, like, the whole vibe of a secure network configuration — because all traffic that has not been explicitly allowed should be blocked by the firewall ruleset, periodt 🔥

By default, psad attempts to determine whether or not the firewall has been configured in this way. you can turn that feature off with the --no-fwcheck or --log-server options. and the --log-server option is super useful if psad is running on a syslog logging server that is separate from the firewall 👑

For more info on compatible iptables rulesets, check the FW_EXAMPLE_RULES file that is bundled with the psad source distribution 📂

also: psad by default parses the /var/log/messages file for all iptables log data.

👀 DIAGNOSTICS 👀

The --debug option can be used to display crucial information about the psad data structures on STDOUT as a scan generates firewall log messages. and btw, --debug disables daemon mode execution. noted 📝

Another, more effective way to peer into the runtime execution of psad is to send (as root) a USR1 signal to the psad process, which will cause psad to dump the contents of the %Scan hash to /var/log/psad/scan_hash.$$ where $$ represents the pid of the psad process 💫

💜 SEE ALSO 💜

iptables(8), kmsgsd(8), psadwatchd(8), fwsnort(8), snort(8), nmap(1), p0f(1), gnuplot(1)

👑 AUTHOR 👑

Michael Rash <mbr@cipherdyne.org>

🫶 CONTRIBUTORS 🫶

Many people who are active in the open source community have contributed to psad. See the CREDITS file in the psad sources, or visit http://www.cipherdyne.org/psad/docs/contributors.html to view the online list of contributors 🌟

💀 BUGS 💀

Send bug reports to mbr@cipherdyne.org. Suggestions and/or comments are always welcome as well 💌

ok now for the big one, and it's giving chaos: for iptables firewalls as of Linux kernel version 2.4.26, if the ip_conntrack module is loaded (or compiled into the kernel) and the firewall has been configured to keep state of connections, occasionally packets that are supposed to be part of normal TCP traffic will not be correctly identified due to a bug in the firewall state timeouts — and hence dropped 😭 Such packets will then be interpreted as a scan by psad even though they are not part of any malicious activity. false alarm energy, truly.

Fortunately, an interim fix for this problem is to simply extend the TCP_CONNTRACK_CLOSE_WAIT timeout value in linux/net/ipv4/netfilter/ip_conntrack_proto_tcp.c from 60 seconds to 2 minutes, and a set of kernel patches is included within the patches/ directory in the psad sources to change this. (Requires a kernel recompile of course; see the Kernel-HOWTO.) Also, by default the IGNORE_CONNTRACK_BUG_PKTS variable is set to "Y" in psad.conf which causes psad to ignore all TCP packets that have the ACK bit set unless the packets match a specific signature.

🌈 DISTRIBUTION 🌈

psad is distributed under the GNU General Public License (GPL), and the latest version may be downloaded from: http://www.cipherdyne.org/ — also, Snort is a registered trademark of Sourcefire, Inc. ™️

and that's the whole page, bestie, you made it to the end 🎉 this one's from the Linux manual pages, March 2009, and it's page PSAD(8) — slay, go read your logs, ily 💖🦋✨

📦 where this page comes from