Klaxon

So, Klaxon is this really handy tool that acts like a detector for scanning when it's booted from inetd. What's cool about it is that instead of actually running any actions, it just gives back a harmless error to the caller. Plus, it logs important info like the calling host, username, and what service they tried to access.

Detecting Port Scanner Attacks

This tool is super useful for spotting port scanner attacks, especially those nasty ones from tools like ISS and SATAN. It can help you keep an eye on any TCP or UDP service ports where you wouldn't expect much action. If you want to learn more about it, check out the Klaxon page here.

Understanding Ident Support

Now, let's talk about Ident support. Ident is sometimes called TAP and it's based on RFC931. If the machine trying to scan supports this protocol (usually coming from inet), you'll get a username along with the hostname of the machine trying to attack you. But here's a heads-up: this info should be taken with caution because Ident can be easily faked!

Tweaking Timeout Settings

The default timeout for checking if the remote machine supports Ident is set at 3 seconds. If you need to change that, you can adjust it in the Makefile. The great thing is both ident-full and ident-free versions of Klaxon are built from one single Makefile.

Compatibility with Different Systems

You'll be happy to know that Klaxon compiles right out of the box on various systems like Solaris2.X, SunOS4.1.X, Digital Unix 3.2*, Linux, HPUX, AIX, and probably others too!