Configure PSAD to ignore certain IP ranges

This post will show you how to configure Port Scan Attack Detector (or PSAD) to ignore specific IP ranges.

PSAD - Port Scan Attack Detection

What is PSAD?

PSAD is a collection of lightweight system daemons that run on Linux. To detect port scans and other suspicious traffic, you use PSAD to analyze the ‘iptables‘ log messages. Visit http://cipherdyne.org/psad/ for more information about PSAD.

Examples of PSAD Alerts

Here are some examples of PSAD email alerts:

Home Network

[psad-alert] DL3 src: 192.168.1.103 dst: ap-op-mars.local
NetRange: 192.168.0.0 – 192.168.255.255
CIDR: 192.168.0.0/16
Comment: This is a computer on the local network.

Google DNS

[psad-alert] DL2 src: google-public-dns-a.google.com dst: ap-op-mars.local
NetRange: 8.0.0.0 – 8.127.255.255
CIDR: 8.0.0.0/9
Comment: Google DNS services are interacting with the local pc.

Local

[psad-alert] DL5 src: thehost.com dst: thehost.com
NetRange: 127.0.0.0 – 127.255.255.255
CIDR: 127.0.0.0/8
Comment: This is the local pc.

How to Ignore IP Ranges in PSAD

Open the PSAD /etc/psad/auto_dl file and add the following lines:

127.0.0.0/8         0;              # Ignore on server calls
192.168.0.0/16      0;          # Ignore home network
8.0.0.0/9           0;               #ignore goodle dns

Restart PSAD when you updated the auto_dl file:

sudo service psad restart

Wrapping up

Adjusting the IP rules for PSAD is quite easy! Need more help? Then read ‘blocking port scan attack‘ by OpenToDo for some brilliant in-depth information.

You may also be interested in



About the Authors

Anto's editorial team loves the cloud as much as you! Each member of Anto's editorial team is a Cloud expert in their own right. Anto Online takes great pride in helping fellow Cloud enthusiasts. Let us know if you have an excellent idea for the next topic! Contact Anto Online if you want to contribute.

Support the Cause

Support Anto Online and buy us a coffee. Anything is possible with coffee and code.

Buy me a coffee



About Anto Online

Having started his career in 1999 as a Desktop Support Engineer, Anto soon changed paths and became a developer. After several years of development experience, he transitioned into a consultant. As an enterprise application consultant for a leading SaaS software provider, Anto specializes in AWS's serverless technologies. By day, Anto focuses on helping customers leverage the power of serverless technologies. By night, he indulges his passion for cloud computing by playing with Python and trying out things that are currently beyond the scope of his work. Sometimes Anto needs help as there are not enough hours at night. So Anto relies on a team of fellow Cloud enthusiasts to help him out. Each one is a Cloud expert in their own right, and Anto takes great pride in helping them learn and grow.

View all posts by Anto Online →

Leave a Reply

Your email address will not be published.