OSI Layer Attacks · Topic 5 of 5

Port Scan Detection and Prevention

Learn how port scans work, how the RouterOS psd matcher and TCP flag rules detect them, and how to block scanners with address lists and raw drops.

6 min

In a nutshell

A port scan probes many ports to find open services.
The matcher is psd and it has four values, in this order: weight threshold, delay threshold, low port weight, high port weight.
Low ports are below 1024 and get their own weight.

What it is

A port scan probes many ports on a host to find out which services are listening.

Scanning is the reconnaissance step of an attack. A scan does no harm by itself, but it tells the attacker where to attack next.

A router can notice a scan because one source touches many ports in a short time. It can then add that source to a blacklist.

How it works

Detection combines a counting matcher with rules that spot packets that no normal client sends.

Common scan types

Scan	What the scanner sends	What it learns
Connect or SYN scan	SYN packets to many ports	Open ports answer with SYN and ACK
NULL scan	TCP packets with no flags set	Closed ports reply in a different way than open ones
FIN scan	TCP packets with only FIN set	Same idea, using a flag that does not start a connection
XMAS scan	FIN, PSH and URG flags together	Same idea, with an unusual flag mix
UDP scan	UDP packets to many ports	Closed ports return ICMP port unreachable

The psd matcher

RouterOS has a matcher for port scan detection, called psd. It watches a source and gives each probed port a weight.

The value has four parts, in this order.

Part	Meaning
Weight threshold	The total weight that triggers the match
Delay threshold	The time window in which probes to different ports count as one scan
Low port weight	The weight of a probe to a low port
High port weight	The weight of a probe to a high port

Ports below 1024 are low ports, and the rest are high ports. Low ports usually get a higher weight, because services listen there.

/ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w
/ip firewall raw add chain=prerouting src-address-list=port-scanners action=drop

In the first rule a source that reaches the weight threshold is put in the port-scanners list. The raw rule then drops everything from that list before tracking. The numbers and timeouts in these examples are only example values.

The example uses protocol=tcp. Add a similar rule with protocol=udp if you also want to watch for UDP scans.

Dropping impossible TCP flags

Normal traffic never uses some flag combinations. Dropping them blocks the NULL, FIN and XMAS scans.

/ip firewall filter add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!ack action=drop
/ip firewall filter add chain=input protocol=tcp tcp-flags=fin,syn action=drop
/ip firewall filter add chain=input protocol=tcp tcp-flags=fin,rst action=drop
/ip firewall filter add chain=input protocol=tcp tcp-flags=fin,!ack action=drop
/ip firewall filter add chain=input protocol=tcp tcp-flags=fin,urg action=drop
/ip firewall filter add chain=input protocol=tcp tcp-flags=syn,rst action=drop
/ip firewall filter add chain=input protocol=tcp tcp-flags=rst,urg action=drop

The ! in front of a flag means that the flag must not be set. The first rule matches packets with none of the four main flags, which is a NULL scan.

You can put these rules in a custom chain and jump to it from the forward and input chains. This keeps the main chains short.

Baiting scanners

A scanner often touches ports where you run no service. You can make that a trap by adding any source that touches such a port to the blacklist.

/ip firewall filter add chain=input protocol=tcp dst-port=23,135,445 in-interface-list=WAN action=add-src-to-address-list address-list=port-scanners address-list-timeout=1d

Use the trap only for ports that no real user needs on that interface. A mistake can blacklist valid clients.

Slow the scanner down

The tarpit action holds a TCP connection open and answers slowly. A scanner that waits on every probe takes much longer to finish its work.

/ip firewall filter add chain=input protocol=tcp src-address-list=port-scanners action=tarpit

A plain drop costs the router less, so use tarpit only if you want to waste the scanner's time.

Checking and tuning

/ip firewall address-list print where list=port-scanners
/ip firewall filter print stats where action=add-src-to-address-list

The first command shows the detected sources. The second shows the counters of the detection rules, so you can see whether they match.

Exam tip

Keep your own admin addresses in a list that is accepted before the scan rules. A scan from your monitoring tool will not then get you blocked.

What to remember for the exam

Seven facts cover port scan defence.

A port scan probes many ports to find open services.
The matcher is psd and it has four values, in this order: weight threshold, delay threshold, low port weight, high port weight.
Low ports are below 1024 and get their own weight.
Detected sources go into an address list with a timeout and are dropped in raw.
NULL, FIN and XMAS scans use odd flag combinations that rules can drop.
The ! before a flag in tcp-flags means that the flag must not be set.
tarpit slows a scanner but costs more than drop.

Common mistakes

Four mistakes appear here.

Mixing up the psd values. The order is weight threshold, delay threshold, low port weight and then high port weight.

Setting the threshold too low. Busy but honest clients can look like scanners and get blocked.

Blocking your own monitoring. Network monitors probe many ports, so accept their addresses first.

Using a bait port that real users need. The trap then blacklists customers.

Watch out

A scan rule on the input chain does not protect hosts behind the router. Repeat the idea on the forward chain, or use the raw table, for traffic that goes through.

Check yourself

Work through these three questions.

What are the four values of the psd matcher?
They are the weight threshold, the delay threshold, the low port weight and the high port weight, in that order.
How can a NULL scan be dropped?
Use a rule with protocol=tcp tcp-flags=!fin,!syn,!rst,!ack and action=drop. A normal packet always has at least one of these flags.
Where is the best place to drop sources in the port-scanners list?
In the raw table, on the prerouting chain. Packets are then dropped before connection tracking.

Topic 5 of 5 in OSI Layer Attacks

Test yourself on OSI Layer Attacks

The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.