2

I ran over a response that stated running an IP/Port scanner (fing) could alert an administrator. I am a curious being and have run about a bajillion unmalicious network scans without any consequence and it's helped me connect to networking by finding the IP with the login page (ironic right?).

So as an entry level network engineer, I've never heard of anyone being alerted other than on Public IP's for port scanning. False triggers happen all the time though and setting up a trigger on WireShark isn't worth much when the admin returns from 1000 other more important jobs to find out the day before someone was being curious using a BYOD that's since been removed from the network, used in a lobby or has changed IP and MAC address if it was ever malicious.

Why, how and under what circumstance other than seeing DDOS on a specific port would port tracking or IP/port scanner detecting and tracking would ever be relevant or monitored? Thanks!

5
  • 4
    Port scans on your public network interfaces originating from the internet at large are indeed quite common, on your internal network(s) they should be rare and anomalous enough that they can be a valid alert from an IDS (intrusion detection system)
    – HBruijn
    May 20 '18 at 19:48
  • Thanks HBruijn. Would an IDS simply be looking for common ports being quickly queried by random packets in quick succession or is there a better way to detect a trace taking place? Are IDS systems most commonly on host machines or setup within specialized security equipment? Thanks :)
    – Tmanok
    May 22 '18 at 23:29
  • 1
    The placement of IDS sensors is a topic in itself security.stackexchange.com/a/17710/77995
    – HBruijn
    May 23 '18 at 8:06
  • Radicalistic :)
    – Tmanok
    May 23 '18 at 17:56
  • 1
    take a look at securityonion.net Dec 3 '19 at 18:20
3

An IDS or IPS that is in a place to observe your scanning traffic could be set to alert on scanning behavior. Depending on how well-tuned it is, and how slowly or quickly you perform your scanning, it may or not flip an alert. Such things are not common inside a corporate network, guest wifi of course is a different story. It can be a symptom of a malicious insider, or a compromised machine.

1
  • You provided the why, how and circumstances. Thx
    – Tmanok
    May 22 '18 at 23:27
3

Good point. Here is a how I would trace it. I would recommend that the network set up NetFlow monitoring. By capturing NetFlow you can meet the scale of most networks while using a minimum of storage.

There are two installation setups: Flow export from router or tap/span port. I prefer from a router as you will get to see inter-network traffic as opposed to just ingress/egress.

I like the open source tool SiLK from CERT, available as an RPM in the CERT Forensics repo - forensics.cert.org.

A typical single server installation looks like the image below. enter image description here Once installed and configured you will want to look for hosts that have hit many destination ports with a query using rwfilter. SiLK handbook available here : http://tools.netsa.cert.org/silk/analysis-handbook.pdf

A scanner can be found by looking at source IP and distinct destination ports. Something like :

rwfilter --proto=0- --type=all --pass=stdout | rwstats --fields=sip,dport 

Once you find that, look for where the scanning host may have gone:

rwfilter --proto=0- --type=all --pass=stdout --saddress=<SCANNERIP> | rwcut 
1

On your public interface I would think it is just noise. But on your internal network it is a red flag that something is worth looking in to.

I really like the Lockheed Martin Cyber Kill Chain https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf which breaks an intrusion in to 7 phases.

Picture form LMC https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html Source: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html

In the example of scanning it could be in the recon or action on objectives scenario. So I like to keep an eye on them in my internal networks.

2
  • 1
    Great post, but you didn't really explain how one could trace / detect a scan. Hence 1+ but no answer :)
    – Tmanok
    May 22 '18 at 23:27
  • 1
    @Tmanok Thanks for the feedback. I added some more info on how to detect and trace using NetFlow. Thanks!
    – Joe M
    May 23 '18 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.