Discovering ICMP and TCP SYN/port scans
Scanning is the process of sending packets to network devices in order to see who is answering the ping requests, to look for listening TCP/UDP ports, and to find out which types of resources are shared on the network, including system and application resources.
Getting ready
A scanning attack is usually detected by users complaining about slow network responses, by management systems that discover an unusual load on servers or communication lines, or when the attack is implemented by Security Information and Event Management Systems (SIEM) that identify suspicious usage patterns. In these cases, locate the Wireshark with a port-mirror as close as possible to the area that you suspect is infected, and start the capture.
How to do it...
To discover the problem, follow these steps:
- Start Wireshark with capture on the interface that is close to the problem:
- If the line to the internet becomes slow, port-mirror the line
- If a server becomes slow, port-mirror...
