Internet worms and other malicious code often scan firewalls to determine which ports are unprotected. While firewall users have access to their port scanning data in the form of log files, most do not make use of it. The Distributed Intrusion Detection System remotely monitors trends in worldwide port scanning, and the data it has collected is available at this site. The data can be used by Internet professionals for early detection of worms or for implementing improved security measures. Firewall users can contribute to this project by downloading the free DShield Client, which automatically sends log reports for inclusion in worldwide data or by submitting logs online via a Web interface.
Comments