Detect port scan

984 Views Asked by At

I want to detect if there was a port scan done by analyzing a pcap file. I can't understand the correct algorithm . Will be like be like one source ip mapping to different IP ?Will that be consider as port scanning ? Will appreciate if you could guide me on this. I am doing this in java with jnetpcap library

1

There are 1 best solutions below

0
On

Firstly I wouldn't expose my PC to the internet without a firewall in which case there is no chance to be scanned.

Most router/firewalls can tell you it has been port scanned.

If you want to detect port scanning you need to look for patterns in the connecting IP address over multiple ports. What could as a pattern varies based on the port scanner. i.e. scanners deliberately take steps to avoid detection so you can't say there is one simple pattern you can look for.