ETHERSCAN(8)

NAME
etherscan - Real time network security monitoring

SYNONPSIS
etherscan [-u] [-i interface] [-f file] [-p] tcp_port_list

DESCRIPTION

Etherscan performs real time monitoring of an ethernet network, reporting any suspicious activities it may detect. Activities such as attempting to login to certain accounts, creating interactive shells via rsh, and unrecognized protocol commands are logged. The smtp driver attempts to detect interactive connections to the smtp port and reports these. There are several other checks performed besides these. The tcp_port_list parameter is a list of TCP services that should be monitored. By default, etherscan only monitors packets destined to that port. By prefacing a port with a plus (+), both sides of the session will be monitored. Drivers are currently available for monitoring telnet, rlogin, rsh, ftp and smtp. Only the telnet and ftp drivers have support for monitoring both sides of a session.

  OPTIONS

-i  Specify the interface to listen for TCP connection requests on. This defaults to the first interface.

-f  Specify the file where output records should go. The file is opened for appending. If not specified, output goes to stdout.

-u  Check UDP packets. This enables reporting of 'tftp' traffic, SunRPC traffic, and FSP servers. This switch should not be used if you have lots of RPC traffic (i.e., a local network). This is most useful for monitoring a link to the Internet.

-p  Run in non-promiscuous mode. This allows one to monitor traffic to/from a single host without putting a load on the host. Note that with SunOS 4.x, you can not log traffic originating from the monitoring host, so you will only see traffic to the host.

  DRIVERS

rlogin
    The rlogin driver reports attempts to login to certain accounts. The accounts are defined in the lognames.h file.

rsh The rsh driver reports remote shells to certain accounts (in lognames.h), and attempts to create interactive shells (i.e, csh -bif). It does not log root -> root shells (see monitors/rsh.c).

ftp The ftp driver reports attempts to login to certain accounts, commands executed before login, repeated USER commands, unknown FTP commands, attempts to execute certain commands during anonymous login, transfer of passwd, .rhosts, or .forward files (by name), or operations on filenames with unusual characters in them.

telnet
    The telnet driver reports attempts to login to certain accounts. If monitoring both sides of the session, it reports success or failure, attempts to intuit and report any continued attempts to login to any account. The telnet monitor also monitors the commands entered, and reports any suspicious commands.

smtp
    The smtp driver reports any suspicious commands (wiz, kill, debug), any unknown commands, attempts to mail to/from programs or files, or UNIX password files being sent (through examination of the body of the message). It also uses timing of text lines and packets per line statistics to attempt to recognize when someone has telneted to the SMTP port on a machine.

SEE ALSO
nit(4P), nit_pf(4M)

BUGS
On a busy network, or with a slow machine, packets may be dropped, which can cause lots of bogus output.

Etherscan's smtp module will generate excess output due to the timing heuristic not being completely reliable.