Feasibility of Detecting TCP-SYN Scanning at a Backbone router
Presented at the the IEEE American Control Conference in June 2004

Khushboo Shah
Department of Electrical Engineering
University of Southern California

Stephan Bohacek
Department of Electrical and Computer Engineering
University of Delaware

Andre Broido
Cooperative Association for Internet Data Analysis - CAIDA
San Diego Supercomputer Center,
University of California, San Diego

IP address and TCP/UDP port scanning are critical components of many network attacks. Such scanning allows attackers to spread a self-propagating worm or collect detailed information about end-hosts in preparation for attacks. This paper investigates an algorithm to detect TCP-SYN scanning. Special care is taken to detect even stealthy scanners. Attackers are detected by tracking the number of half-open connections generated by each source. However, a source is only tracked until it is clear that it is not currently scanning. The computational load of this method is analyzed and it is found that the method is not computationally intensive and is suitable for online detection of scanning even on backbone links. Specifically, on a backbone link investigated it was found that the total number of sources that needs to be tracked at any one time is at most a few thousand.