This post will show you how to configure Port Scan Attack Detector (or PSAD) to ignore specific IP ranges.
What is PSAD?
PSAD is a collection of lightweight system daemons that run on Linux. You use PSAD to analyze the ‘
Examples of PSAD Alerts
Here are some examples of PSAD email alerts:
[psad-alert] DL3 src: 192.168.1.103 dst: ap-op-mars.local
NetRange: 192.168.0.0 – 192.168.255.255
Comment: This is a computer on the local network.
[psad-alert] DL2 src: google-public-dns-a.google.com dst: ap-op-mars.local
NetRange: 126.96.36.199 – 188.8.131.52
Comment: Google DNS services is interacting with the local pc.
[psad-alert] DL5 src: thehost.com dst: thehost.com
NetRange: 127.0.0.0 – 127.255.255.255
Comment: This is the local pc.
How to Ignore IP Ranges in PSAD
Open the PSAD /etc/psad/auto_dl file and add the following lines:
127.0.0.0/8 0; # Ignore on server calls
192.168.0.0/16 0; # Ignore home network
184.108.40.206/9 0; #ignore goodle dns
Restart PSAD when you updated the auto_dl file:
sudo service psad restart
Adjusting the IP rules for PSAD is quite easy! Need more help? Then read ‘blocking port scan attack‘ by OpenToDo for some brilliant in-depth information.
I hope you liked this post. If so, please click the like button and you will receive a million years of good Luck! Feel free to read other great posts at https://anto.online/.