42. Evading IDS, Firewalls and Honeypots – Detection Games
42.4 Slow Scans, Timing, Port Knocking – Nmap vs Blue Rate Alerts
Nmap timing (-T0 … -T5) aapan Chapter 19 lab madhe OWN target var baghitla. Red hope: slow = below IDS "scan" burst rule. Blue hope: longer window + firewall logs + Zeek/Suricata by_src thresholds + netflow.
Port knocking (concept): real SSH port stays filtered until a secret sequence of closed-port hits; then firewalld/iptables opens 22 for that IP. Sounds clever; actually security through obscurity if it replaces keys/MFA. Blue still sees the knocks in pcap. Don't hide production SSH only behind a knock; do use VPN + key + firewalld source allow-list.
Blue detections that actually work in SME lab:
- Suricata / Snort rules for "many unique ports from one src" (threshold /
detection_filter) firewalld--set-log-denied=allthen read/var/log/messages- Nmap
-T2against OWN box should still leave denied / alert crumbs – prove it - Rate-limit SSH with firewalld / fail2ban (hardening chapter) – complementary
# Kali → OWN lab only (standard educational scan, not an evasion kit)
nmap -sS -T2 -p 21,22,80,443,3306 192.168.56.20
# Optional slightly broader but still polite – OWN target only
nmap -sS -T3 -p 1-100 192.168.56.40
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Slow SYN scan hoping burst SIDs stay quiet | Long-window unique-port counts; netflow; keep denied logs |
| Port-knock then SSH with stolen key | Log knocks; prefer VPN + key + MFA; no knock-only |
| Scans from many IPs (lab: don't) | Correlate in SIEM; block lists with care (false drop risk) |
Ravindra Bagale's Tip
Students -T0 "stealth" samajtat. Stealth ≠ invisible; stealth = slower pancake. SOC with 24-hour unique-dport charts still baghte. Interview madhe "I use -T2 on my lab to test whether logs catch slow scans." He lakshat theva.
Lab
From Kali 192.168.56.10, nmap -sS -T2 -p 22,80 192.168.56.20 (host-only). On Blue VM, sudo tail firewall denied log or Suricata fast.log. Paste 5 matching lines into notes with timestamp. If empty – promiscuous / wrong interface / HOME_NET – debug Blue, don't add evasion flags.