Im considering programming a script to scan a system log in search for an entry indicative of a port scan, in doing so, potentially giving me a heads-up if anyone is taking interest in me.

I already have a program like this which alerts me through the notification centre on the event of an SSH Authentication failure, however im unsure specifically which system log i would be looking at and what exactly the entry for a detected port scan would look like.

There are also some other considerations i must take into account first, such as: does OS X even record port scans? and are port scans so common on the internet that such a program would be pointless?

In summary: Which System log would record a port scan and what would the entry syntax look like?

Thank you in advance.

  • 1
    There is no standard log of port scans for operating systems, including OSX. You can have a firewall with specific portscan detection, OSX's firewall has an option for that as well, and you can turn on firewall logging for those kind of things too. By default, only things that could be simply 'network errors' are acted upon and sometimes logged (such as rate limits and unexpected TCP window shrinks). – John Keates Jun 25 '16 at 1:49
  • Im using OSX 10.11, and have scoured the firewall and no option regarding port scan detection and logging. Are additional firewall configuration options accessible by the command line? – user4493605 Jun 27 '16 at 9:12
  • Yes, only from the command line. The firewall in OSX is very advanced, but for end-users a very simple on/off interface works best, so that's what Apple put in the GUI. – John Keates Jun 27 '16 at 12:52
  • Quick addition: OSX has an ApplicationFirewall and ipfw. The ApplicationFirewall is what you configure using the GUI, and is basically a socket-based firewall. ipfw is the 'hardcore' firewall that you use for the not-so-basic things. ApplicationFirewall (that's what the component in OSX is called) can't override ipfw, if something is blocked by ipfw, ApplicationFirewall won't process it anymore. – John Keates Jun 27 '16 at 16:17

Scanned my device using 3 seperate port scanners and 1 System.log entry remains common between them:

Kernal[0]: Limiting closed port RST response1

  • 1
    That only works with specific scans. Take nmap for example, it can do so many scans with so many parameters that a standard TCP/IP stack won't care. – John Keates Jun 25 '16 at 1:48
  • In addition: that's a TCP/IP stack message you got there, from the kernel, not a firewall log ;-) – John Keates Jun 27 '16 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .