topic Re: The SPL search command about port scanning in Splunk Search

The SPL search command about port scanning

xsstest — Tue, 29 Sep 2020 13:54:36 GMT

Now I'm doing a port scan alert Policy.

Port scanning is a hacker's attack method。I can see its activity track in the firewall。I can see the source IP（scan_sip）, source port and destination IP（scan_dip）, destination port。Too many ports connected log on the firewall。

I passed the following method to extract the port scan behavior.

Set a time range, for example: 60s. And the interval between each event can not be greater than 7s. There are more than 40 elements in the collection. I think he is port scan, how do i search for such events?

I only need scan_sip, scan_dip, the number of elements in the collection

use "transaction"？

Re: The SPL search command about port scanning

dineshraj9 — Tue, 02 May 2017 07:23:55 GMT

Yes, try using transaction command this way -

<your search> | transaction maxpause=7s maxspan=60s scan_sip scan_dip | where eventcount >=40

Re: The SPL search command about port scanning

xsstest — Tue, 02 May 2017 09:56:54 GMT

ok.now, How do I count the number of collections?

I want to get this result：

scan_sip      scan_dip      count

1.1.1.1        2.2.2.2             45

Re: The SPL search command about port scanning

dineshraj9 — Tue, 02 May 2017 10:00:35 GMT

eventcount field gets added automatically as part of transaction command -

<your search> | transaction maxpause=7s maxspan=60s scan_sip scan_dip | where eventcount >40 | rename eventcount as count | table scan_sip scan_dip count

Re: The SPL search command about port scanning

xsstest — Fri, 05 May 2017 02:08:14 GMT

good ! thank you!

Re: The SPL search command about port scanning

xsstest — Tue, 29 Sep 2020 13:58:01 GMT

If the scan_port (the port following the scan_ip field) is all the same, how do I exclude this group of events