19.10 How Defenders Detect Scanning

By Ravindra Bagale Last updated: 27 September 2026

Aata attacker chi topi kadhun defender chi ghala. Pratyek scan network var paaul khuna sodto. Defender la te disla pahije aani thambavta ala pahije.

Signal	What it looks like	Tool that catches it
Many ports from one IP in seconds	SYN to port 1, 2, 3 ... from one source	Snort/Suricata port-scan rules, firewall logs
Half-open connections	SYN, SYN-ACK, then RST (no ACK)	IDS, `tcpdump`
ARP sweeps	One MAC asking for a whole range	`arpwatch`, Dynamic ARP Inspection
Service banners grabbed	Short connections to many services, often failed logins	Service logs, `/var/log/secure`, web access logs
Cloud-side	Rejected traffic to your instances	AWS VPC Flow Logs, GuardDuty port-probe findings

Defences that reduce what a scanner can find:

Open only the ports you really need – on AWS, keep security groups tight (for example SSH 22 only from your own IP, never 0.0.0.0/0).
Stop and remove services you do not use (sudo service vsftpd stop, sudo yum remove vsftpd).
Hide version banners: ServerTokens Prod and ServerSignature Off in Apache, server_tokens off; in Nginx (you configured these servers in Chapters 7–8).
Use an IDS/IPS and tools like fail2ban to block IPs that scan or brute-force.
Watch the logs – this is exactly the SOC work you will do in Part 11.

See it yourself on the lab: on a Linux target you own, capture traffic while you scan it from Kali.

# on the target VM (or your own EC2 instance)
sudo tcpdump -n -i eth0 'tcp[tcpflags] & tcp-syn != 0' | head -50
# on Kali, in another window
sudo nmap -sS 192.168.56.20

You will see a flood of SYN packets from Kali's IP to different ports – that is exactly the pattern an IDS alerts on.

Ravindra Bagale's Tip

Company madhe "hacker" peksha "defender" chya jagaa jast aahet – SOC analyst, security engineer. Mhanun pratyek attack shiktana swatahla vichara: "he mi logs madhe kasa pakdu?" Interview madhe he uttar dila tar tumhi baki candidates peksha pudhe asta.

Lab

Run tcpdump on Metasploitable 2 (or on your own EC2 instance with your laptop as the scanner) while you run a SYN scan from Kali. Save 20 lines of the capture in your notes and label the pattern. Then on your EC2 instance, restrict SSH to "My IP" in the security group and scan again from another network to confirm port 22 now shows filtered.