Is internal port scanning a sign of an intruder?
Often, unless you know who is doing it. Inside a company network there are a few legitimate scanners, such as a vulnerability scanner, an inventory tool, a network management system or a printer driver looking for devices, and they should be known, scheduled and documented. An ordinary workstation, a printer or a camera suddenly connecting to many internal addresses or many ports in a short time is a different matter: it is one of the clearest signs that someone is mapping the network after getting in, and it usually comes early, before the real damage. Keep a list of approved scanners and their addresses, so that an alert can be checked in seconds, and investigate everything else the same day. NetSenX flags scanning on every plan, Free included, including from devices that run no agent, when watched from a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port.
Read next
Related questions
- How do we know if someone is guessing passwords on our internal network?
- How do we detect large uploads to cloud storage from a server?
- What is PsExec or admin-share abuse, and why does antivirus not flag it?
- Can attackers move through our network with stolen passwords and no malware?
- Should we detect lateral movement from authentication logs or from network flows?
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.