"Sometimes, if a computer system is affected too much by a port scan, one can argue that the port scan was, in fact, a denial-of-service (DoS) attack, which is usually an offense. "
Rate limit target IP subnets. 0.1 second timeout per port per IP: ten ports on one IP delays a second, one port on everything in a /24 delays 25.5 seconds. It's useful without being abusive.
What kind of thing is legal to do once but not 65,535 times? //
Knock on someone's door? Once is fine, more than about 20 times [in a day] is likely to be seen as a nuisance. You'd have some sort of exclusion order long before you get to 2^16 times.
Legal, yes. Annoying, maybe. You could limit your liability by only allowing scanning of the origin IP, i.e. don't allow the entry of any IP the user wants to enter. That way, the visitor is scanning only his own machine, no one else's.
Comments
An usability upgrade would be to allow port ranges, for example I wanted to try 0-1023.
I've something like that for TODO. But I'm not sure whether that would be legal or not ?
What kind of thing is legal to do once but not 65,535 times?
Google for "scan ports" and you'll discover plenty of people offering this service already.
"Sometimes, if a computer system is affected too much by a port scan, one can argue that the port scan was, in fact, a denial-of-service (DoS) attack, which is usually an offense. "
http://www.sans.org/security-resources/idfaq/port_scanning_l...
Rate limit target IP subnets. 0.1 second timeout per port per IP: ten ports on one IP delays a second, one port on everything in a /24 delays 25.5 seconds. It's useful without being abusive.
You could require verification for >5 ports.
Knock on someone's door? Once is fine, more than about 20 times [in a day] is likely to be seen as a nuisance. You'd have some sort of exclusion order long before you get to 2^16 times.
Legal, yes. Annoying, maybe. You could limit your liability by only allowing scanning of the origin IP, i.e. don't allow the entry of any IP the user wants to enter. That way, the visitor is scanning only his own machine, no one else's.
Thanks, I'm also thinking of limiting the target IP to origin IP, at least for port-range (next feature) scans.