Is it possible to detect port scans on OSX at the kernel level? I would like to write a kext that detects the ip addresses of systems scanning my computers ports.
How exactly does a stealth scan work? Doesn't the kernel get notified when a port is accessed from outside?