1

Is there any way to detect a scan on the local machine ( the pc that I'm using with a linux os -ubuntu-) from the network that I'm connected to?

I know that for the webservers we could check the apache log for some details that could notify the admin about some unseal behavior but for the this case where there isn't any webserver or a shared network service that I could follow its logs how can I find out if there is anyone who is scanning the device?

Improve this question

1 Answer 1

Reset to default
4

Scanlogd should be what you are looking for. However, this is TCP oriented.

scanlogd detects port scans and writes one line per scan via the syslog(3) mechanism. If a source address sends multiple packets to different ports in a short time, the event will be logged.

For most NMap scans Snort and p0f are both capable IDS. How to Detect NMAP Scan Using Snort is a guide about configuring Snort to detect: nmap -sP -p 22 192.168.1.105 among other scans.

Ping Scan [-sP] This scan type lists the hosts within the specified range that responded to a ping. It allows you to detect which computers are online, rather than which ports are open. Four methods exist within Nmap for ping sweeping.

The first method sends an ICMP ECHO REQUEST (ping request) packet to the destination system. If an ICMP ECHO REPLY is received, the system is up, and ICMP packets are not blocked. If there is no response to the ICMP ping, Nmap will try a "TCP Ping", to determine whether ICMP is blocked, or if the host is really not online.

A TCP Ping sends either a SYN or an ACK packet to any port (80 is the default) on the remote system. If RST, or a SYN/ACK, is returned, then the remote system is online. If the remote system does not respond, either it is offline, or the chosen port is filtered, and thus not responding to anything.

When you run an Nmap ping scan as root, the default is to use the ICMP and ACK methods. Non-root users will use the connect() method, which attempts to connect to a machine, waiting for a response, and tearing down the connection as soon as it has been established (similar to the SYN/ACK method for root users, but this one establishes a full TCP connection!)

The ICMP scan type can be disabled by setting -P0 (that is, zero, not uppercase o). Source

What's the most effective way to detect nmap scans speaks about this further.

Improve this answer
7
  • What abut the others scan types used in Nmap? is there any other tools that I can use to detect them ?
    – Barttttt
    Commented Aug 19, 2018 at 23:00
  • 1
    I have amended the post to include IDS for NMap.
    – safesploit
    Commented Aug 19, 2018 at 23:11
  • 2
    @UserXD Worth noting, there are different ways to scan a network which generate different levels of "heat." Louder approaches, such as NMap are easy to detect. Quiet approaches are much harder, and detecting them may lead to more false positives.
    – Cort Ammon
    Commented Aug 20, 2018 at 1:59
  • @CortAmmon would you mind explain more you idea? or help me to find some references for this ? thanks.
    – Barttttt
    Commented Aug 20, 2018 at 22:52
  • 1
    @UserXD "Any abnormal behavior" is impossible to detect, from an information-theoretic perspective. However, you can generally expect malware to be rather loud in its searches for new machines to infect, so the tools which detect nmap port scans are likely to detect the actions of malware. It's the pesky APT's that may try quiet low-heat approaches.
    – Cort Ammon
    Commented Aug 21, 2018 at 1:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .