<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Port Scanning — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-port-scanning.

## Tools


### `tshark`

CLI packet analyzer for scan detection

**Usage:**
```bash
tshark -r <pcap> -Y 'tcp.flags.syn==1' -T fields -e ip.src
```

**Key Flags:**
  - `-Y: display filter`
  - `-T fields: extract fields`
  - `-e: field name`
  - `-q: quiet mode`

---

### `suricata`

IDS with scan detection rules

**Usage:**
```bash
suricata -r <pcap> -S scan_rules.rules
```

**Key Flags:**
  - `-T: test config`
  - `-S: rule file`
  - `--set threshold-file=threshold.yaml`

---

### `nmap`

Network scanner (for testing detection)

**Usage:**
```bash
nmap -sS -p- <target>
```

**Key Flags:**
  - `-sS: SYN scan`
  - `-sT: connect scan`
  - `-sN: null scan`
  - `-sX: xmas scan`
  - `-T: timing (0-5)`

---


## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
