mrash/psad — Issue #4: Add signatures for knockknock and fwknop traffic
Author: mrash
Created: 2012-01-16 01:55:29+00:00
State: open

Given the behavior of both knockknock and fwknop, it should be possible to write psad signatures to detect both pieces of software. For example, non-zero TCP ACK fields along with non-default TCP window sizes within the TCP SYN packets that knocknock produces should be detectable. For fwknop, looking for the default UDP port of 62201 combined with the minimum expected data length should be a good indicator.