What a scan looks like

One machine, knocking on every door

Before an attacker breaks in, they usually look around to see which services are running. They do this with a port scan: send a quick SYN (“are you there?”) to lots of different ports and see which ones answer.

On the wire this has a very recognisable shape: one source address firing SYN packets at many different destination ports in a short time. A normal connection touches one port; a scan touches dozens.

Let's list the destination ports that received a SYN, so the fan-out is obvious:

tshark -r /home/student/case/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e ip.dst -e tcp.dstport 2>/dev/null

In the terminal

student@vulntech:~$ tshark -r /home/student/case/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e ip.dst -e tcp.dstport 2>/dev/null
10.10.10.5	21
10.10.10.5	22
10.10.10.5	23
10.10.10.5	25
10.10.10.5	53
10.10.10.5	80
10.10.10.5	110
10.10.10.5	139
10.10.10.5	143
10.10.10.5	443
10.10.10.5	445
10.10.10.5	3389

Tip: The give-away is the spread: the same source hitting 21, 22, 23, 25, 80, 443, 3389 and more in seconds. No normal app does that.