Everywhere I read is to be careful using network scanners and that vulnerability scanners should only be used in active reconnaissance as scanners tend to be noisy.

How would a network administrator or security technician determine if one of these scanners was used? Could this be determined using log files or programs such as packet analyzers?

I have tried searching but I have had trouble finding anything on this. Mostly all I can find is on conducting such scans.


You can detect them with Intrusion Detection Systems if it's network being scanned.

If it's web server, you can look into access log and grep for errors.

Example IDS is Snort. It can run passively by reading forwarded packets from switch (switch port mirroring), or it can be in front of the network (act as a router).

For experimentation, Snort can be installed on the server itself although this one is not recommended

| improve this answer | |
  • Can you please clarify was isn't recommended? Using Snort for experimentation or using Snort as a real IDS? – Gavin Youker Dec 1 '16 at 6:55
  • I meant using Snort on the same server as e.g. webserver, nornally Snort should be dedicated instance. – Aria Dec 1 '16 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.