The methods we will be discussing are simple in use and implementation. These more advanced IDS systems use traffic analysis and advance algorithms to determine if a probe has been conducted. Our approach will be somewhat simpler. There are a variety of different probes hackers will attempt. The first type we will prepare for is one of the most common, port scans.
Port scans are where an inidvidual attempts to connect to a variety of different ports.
This is one of the most popular information gathering methods used by hackers today as it identifies what ports and services are open. To detect these scans, we will build a system that emails us alerts whenever someone connects to a predetermined port. First, we identify three to five of the most commonly scanned ports. Then we select two to three systems to listen on these ports. When an intruder scans our network, he will most likely hit our systems listening on these ports.