security/ddos-scan 20000325 NetBSD

"dds" is a program to scan for a limited set of distributed denial of service (ddos) agents.

At present, it scans for active instances of "trinoo", "Tribe Flood Network" ("TFN") and "stacheldraht" agents, which were compiled using the default values in known source distributions, such as those found at:

    http://packetstorm.securify.com/distributed/

It will *not* detect TFN2K agents.

For analyses of the three distributed denial of service attack tools it scans for, and the methods being used by dds to identify them, see:

    http://staff.washington.edu/dittrich/misc/trinoo.analysis
    http://staff.washington.edu/dittrich/misc/tfn.analysis
    http://staff.washington.edu/dittrich/misc/stacheldraht.analysis

See CHECKSUMS.asc for PGP signed MD5 checksums.