Every connection, summarised
Zeek summarises each connection into one line in conn.log (a tab-separated table). The connection state column is gold: SF is a normal, finished connection, while S0 means a SYN was sent and nothing came back — exactly what a port scan looks like:
cat /srv/soc-data/nids/conn.logIn the terminal
student@vulntech:~$ cat /srv/soc-data/nids/conn.log #fields ts id.orig_h id.resp_h id.resp_p proto service conn_state 1773130200.0 203.0.113.66 10.10.10.5 22 tcp - S0 1773130200.0 203.0.113.66 10.10.10.5 80 tcp - S0 1773130200.0 203.0.113.66 10.10.10.5 443 tcp - S0 1773130200.0 203.0.113.66 10.10.10.5 445 tcp - S0 1773130200.0 203.0.113.66 10.10.10.5 3389 tcp - S0 1773130290.0 10.10.10.5 10.10.10.1 53 udp dns SF
A row of S0 connections from one source to many ports is the same scan you saw in the packet capture, now summarised by the sensor.