Who scanned, and how wide

Measure the scan

Two numbers describe a scan: who did it (the source address) and how wide it was (how many different ports). To measure the width, take the destination ports, keep only the unique ones, and count them:

tshark -r /home/student/case/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e tcp.dstport 2>/dev/null | sort -n | uniq | wc -l

In the terminal

student@vulntech:~$ tshark -r /home/student/case/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e tcp.dstport 2>/dev/null | sort -n | uniq | wc -l
12

And the scanner itself is simply the source address on all those SYN packets:

tshark -r /home/student/case/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e ip.src 2>/dev/null | sort -u

In the terminal

student@vulntech:~$ tshark -r /home/student/case/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e ip.src 2>/dev/null | sort -u
203.0.113.66

Tip: One source, one target, many ports, all SYN, all within seconds — that is the fingerprint of a scan, and now you can both spot it and size it.