Simple policy to detect ICMP Scans

Following functionality are provided by the script

1) Package identifies icam scanning 

Installation

bro-pkg install bro/initconf/icmp-scans
or @load icmp-scans/scripts

Detailed Notes:

Detail Alerts and descriptions: Following alerts are generated by the script:

Heuristics are simple: check for different kinds icmp connections and if they cross a certain threshold generate notice.

(This version uses broker::auto_publish. I do intend to update the script to use cluster_hrw events which are more efficient as well as meaningful in this case.

This should generate following Kinds of notices:

Example notice:

1) ICMP::AddressMaskScan - An address mask request message reveals the subnet mask used by the
target host. This information is useful when mapping networks and
identifying the size of subnets and network spaces used by organizations.

2) ICMP::ICMPAddressScan - Primarily flags ICMP echo-request/replies also known as ping scanning.

3) ICMP::InfoRequestScan - The ICMP information request message was intended to support self-configuring
systems such as diskless workstations at boot time, to allow them to discover
their network address. Protocols such as RARP, BOOTP, or DHCP do so more
robustly, so type 15 messages are rarely used.

4) ICMP::TimestampScan - A timestamp request message requests system time information from the target
host. The response is in a decimal format and is the number of milliseconds
elapsed since midnight GMT.

5) ICMP::ScanSummary - general summaries of ICMP scan. How many hosts over how much time.

Ref: http://etutorials.org/Networking/network+security+assessment/Chapter+4.+IP+Network+Scanning/4.1+ICMP+Probing/