<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-port-scanning
description: >-
  Detect and classify network port scanning activity using Suricata, iptables logging, connection tracking, and behavioral analysis to identify reconnaissance attempts.
domain: cybersecurity
subdomain: network-security
tags:
  - port-scan
  - reconnaissance
  - nmap-detection
  - ids
  - scan-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1046"]
  nist-csf: ["DE.CM-1", "DE.AE-2"]
  uuid: 96f1c446-df16-48b8-8cf4-cd234df62d72
---

# Detecting Port Scanning

## Overview

Port scanning is the most common reconnaissance technique and often precedes exploitation.
Detection relies on identifying anomalous connection patterns: many destinations from one source,
SYN-only packets, connection resets, and scanning tool signatures. Effective detection balances
sensitivity with false positive management.

Mode: `[MODE: BLUE]` for detection; `[MODE: RED]` for understanding evasion.

## Prerequisites

| Requirement | Details |
|---|---|
| Suricata or Snort with scan detection enabled | Required |
| iptables with connection tracking and logging | Required |
| Network flow data for large-scale scan detection | Required |
| SIEM for alert correlation | Required |
| Baseline of normal connection patterns | Required |

## Key Concepts

### Scan Types and Detection

```
Scan Type Detection:
├── SYN Scan (-sS)
│   └── Detect: SYN without completing handshake (RST after SYN-ACK)
├── Connect Scan (-sT)
│   └── Detect: Many short-lived completed connections
├── FIN/Xmas/Null Scan
│   └── Detect: Unusual TCP flag combinations
├── UDP Scan (-sU)
│   └── Detect: ICMP port unreachable responses
├── ACK Scan (-sA)
│   └── Detect: ACK to closed ports (firewall mapping)
└── Slow Scan
    └── Detect: Distributed connections over long time window
```

### Suricata Scan Detection

```yaml
# SYN scan detection — many SYN to different ports
alert tcp any any -> $HOME_NET any (msg:"Port Scan - SYN scan detected"; \
  flags:S,12; \
  threshold:type both, track by_src, count 20, seconds 10; \
  sid:6000001; rev:1;)

# Vertical scan — single source to many ports on one host
alert tcp any any -> $HOME_NET any (msg:"Port Scan - vertical scan"; \
  flags:S,12; \
  threshold:type both, track by_src, count 50, seconds 30; \
  sid:6000002; rev:1;)

# NULL scan detection
alert tcp any any -> $HOME_NET any (msg:"Port Scan - NULL scan"; \
  flags:0; \
  threshold:type both, track by_src, count 5, seconds 60; \
  sid:6000003; rev:1;)

# XMAS scan detection
alert tcp any any -> $HOME_NET any (msg:"Port Scan - XMAS scan"; \
  flags:FPU; \
  threshold:type both, track by_src, count 5, seconds 60; \
  sid:6000004; rev:1;)

# Nmap OS fingerprint detection
alert tcp any any -> $HOME_NET any (msg:"Nmap OS fingerprint probe"; \
  flags:SFPU; window:1024; \
  sid:6000005; rev:1;)
```

### iptables Scan Detection

```bash
# Log SYN flood / scan attempts
iptables -A INPUT -p tcp --syn -m recent --name portscan --set
iptables -A INPUT -p tcp --syn -m recent --name portscan \
  --rcheck --seconds 10 --hitcount 20 -j LOG \
  --log-prefix "PORTSCAN: " --log-level 4
iptables -A INPUT -p tcp --syn -m recent --name portscan \
  --rcheck --seconds 10 --hitcount 20 -j DROP

# Block and log NULL/XMAS/FIN scans
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j LOG \
  --log-prefix "NULL-SCAN: " --log-level 4
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j LOG \
  --log-prefix "XMAS-SCAN: " --log-level 4
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
```

### Wireshark Filters

```
# SYN scan detection
tcp.flags.syn == 1 and tcp.flags.ack == 0 and tcp.window_size <= 1024

# Connection resets (scan indicator)
tcp.flags.reset == 1

# ICMP port unreachable (UDP scan response)
icmp.type == 3 and icmp.code == 3
```

## Workflow

### Step 1: Enable Detection

Deploy Suricata rules and iptables logging from Key Concepts section.

### Step 2: Baseline Connections

```bash
# Establish normal connection patterns
nfdump -r nfcapd.* -s srcip/flows -n 50 > baseline_flows.txt
```

### Step 3: Monitor and Alert

```bash
# Watch for scan alerts
tail -f /var/log/suricata/eve.json | \
  jq 'select(.event_type=="alert" and .alert.signature | contains("scan"))'
```

### Step 4: Investigate Scanner

```bash
# Full activity from scanner IP
tshark -r traffic.pcap -Y "ip.src == $SCANNER_IP" \
  -T fields -e ip.dst -e tcp.dstport | sort | uniq -c | sort -rn
```

## Detection

```yaml
title: Port Scanning Detection
id: 83fb7439-3e8d-47f3-a0b4-3c0eb4197164
status: experimental
description: Detects suspicious activity related to detecting port scanning techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1046
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Port Scanning Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1046 |

## Verification

- [ ] Suricata scan detection rules deployed
- [ ] iptables logging for unusual TCP flags
- [ ] SIEM alerting on scan detection signatures
- [ ] Scan detection tested with controlled nmap scan
- [ ] False positive tuning applied (internal scanners whitelisted)
- [ ] Slow scan detection via flow analysis
- [ ] Response procedure for scan detection documented

## References

- MITRE ATT&CK T1046 — Network Service Discovery
- [Suricata — Detecting Port Scans](https://docs.suricata.io/)
- SANS SEC503: Intrusion Detection In-Depth
- Nmap Network Scanning — Detection and Evasion
