How can I collect the opening packet in a port scan (ie, the SYN before the handshake is completed) using Packetbeat?
I'm using pcap with bpf_filter to select all TCP/IP traffic from a variety of ports. Unfortunately this does not capture port scans. The explanation (when I ran packetbeat -d "*" ) is that the non-FIN (ie, SYN packet) is discarded:
decoder.go:179: DBG Ignore empty non-FIN packet
When I dump to a file using the -dump argument I do see the packets listed there, however, they are not submitted to ElasticSearch because they are discarded.
This is the configuration that I'm using:
interfaces:
device: any
type: pcap
snaplen: 1514
buffer_size_mb: 10
bpf_filter: "port 23 or port 2323 or port 6789"