I ran over a response that stated running an IP/Port scanner (fing) could alert an administrator. I am a curious being and have run about a bajillion unmalicious network scans without any consequence and it's helped me connect to networking by finding the IP with the login page (ironic right?).
So as an entry level network engineer, I've never heard of anyone being alerted other than on Public IP's for port scanning. False triggers happen all the time though and setting up a trigger on WireShark isn't worth much when the admin returns from 1000 other more important jobs to find out the day before someone was being curious using a BYOD that's since been removed from the network, used in a lobby or has changed IP and MAC address if it was ever malicious.
Why, how and under what circumstance other than seeing DDOS on a specific port would port tracking or IP/port scanner detecting and tracking would ever be relevant or monitored? Thanks!