Re: analysis of auditable port scanning techniques

[Henrik Nordstrom <hno () HEM PASSAGEN SE>]

Dan Harkless wrote:

> Well, there's a feature request for auth/ident/tap daemons running on OSes
> (if any) that can distinguish after-the-fact between connections that
> originated locally and those that originated remotely.  Assuming that
> doesn't break RFCs 931 / 1413, of course (I'd re-read them right now to
> check, if I had the time)...

Well, the simple fix would to deny queries for ports where there is a
local service listening on the same interface/IP (or "ANY").

--
Henrik Nordstrom