evilsocket / evilsocket/opensnitch

[Feature Request] Port Scan Detection Capability (similar to Portmaster implementation PR)

Open
#1,584 1 comment 0 reactions 0 assignees View on GitHub
feature
Dominant language
Python
Stars
14.1k
Forks
665
PR merge metrics
No merged PRs in 30d

Description

## Description
Add a **port scan detection capability** to OpenSnitch in order to detect suspicious inbound behaviors (e.g. multiple connection attempts across ports from a single source).

Port scanning is a very common reconnaissance technique and often an early indicator of malicious activity. Having this visibility directly in OpenSnitch would provide a useful security signal without requiring additional tooling.

## Reference
A similar feature is currently being discussed/implemented in Portmaster:
* [Feature/portscan detection · Pull Request #128 · safing/portmaster](https://github.com/safing/portmaster/pull/128)

This PR may provide useful ideas regarding detection heuristics and implementation approach.

## Rationale
Today, detecting port scans on Linux often requires external tools such as:
* psad: [psad - Intrusion Detection with iptables, iptables Log Analysis, iptables Policy Analysis](https://www.cipherdyne.org/psad/)
* PortSentry: [Sentry Tools download | SourceForge.net](https://sourceforge.net/projects/sentrytools/)
* scanlogd: [openwall/scanlogd: TCP port scan detection tool](https://github.com/openwall/scanlogd)

These tools are:
* relatively old or minimally maintained
* not integrated with modern endpoint monitoring workflows

Integrating this capability into OpenSnitch would:

* reduce dependency on legacy tools
* centralize network visibility (outbound + suspicious inbound activity)
* improve usability for both desktop and security-focused use cases

## Proposed Scope
* Detect multiple connection attempts to different ports within a configurable time window
* Track source IP and apply configurable thresholds
* Support TCP (UDP optional)
* Generate alerts in the UI with relevant context (source IP, ports, timestamp)
* Optional logging for further analysis

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.