Repository navigation
wiki: document inbound port scan detection - #1693
Open
NRGLine4Sec wants to merge 1 commit into
Open
NRGLine4Sec wants to merge 1 commit into
NRGLine4Sec wants to merge 1 commit into
Conversation
Seven pages for the port scan detection proposed in evilsocket#1584: an overview and how to turn it on, the settings, the coverage measured on real nmap captures, the limits, the cost, how to verify it, and the internals. The sidebar lists them under Configuration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 18, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adds the documentation of the inbound port scan detection proposed in #1692 (feature request #1584) to the wiki: seven pages, four screenshots and a sidebar entry under Configuration.
The pages describe a feature that is not merged yet, so this should only be merged after #1692, and changed along with it if the feature changes during review.
Pages
Port-Scan-Detection: what it does, what you see, how to turn it on and check that it works.Port-Scan-Detection-Settings: every setting, and the blocking policy.Port-Scan-Detection-Coverage: which nmap techniques are detected, measured on a corpus of real nmap captures.Port-Scan-Detection-Limits: what it does not detect, and why.Port-Scan-Detection-Cost: the measured cost per packet, and the budgets that bound it.Port-Scan-Detection-Verifying: how to check it on your own machine with real scans.Port-Scan-Detection-Internals: how the code is organised, for developers.They are the pages already published in the wiki of my fork, so they can be read as they will render: Port Scan Detection.
The screenshots go in
wiki/images/, which theUpdate wikiworkflow moves toimages/in the wiki, where the pages link to them. Links between pages are relative, so nothing points to my fork.The
Update wikijob may fail on this PR: it runs onpull_requestand tries to push to the wiki, which the token of a PR from a fork cannot do. It runs again with write access once the PR is merged.🤖 Generated with Claude Code