19. Information Gathering and Scanning
19.10 How Defenders Detect Scanning
Aata attacker chi topi kadhun defender chi ghala. Pratyek scan network var paaul khuna sodto. Defender la te disla pahije aani thambavta ala pahije.
| Signal | What it looks like | Tool that catches it |
|---|---|---|
| Many ports from one IP in seconds | SYN to port 1, 2, 3 ... from one source | Snort/Suricata port-scan rules, firewall logs |
| Half-open connections | SYN, SYN-ACK, then RST (no ACK) | IDS, tcpdump |
| ARP sweeps | One MAC asking for a whole range | arpwatch, Dynamic ARP Inspection |
| Service banners grabbed | Short connections to many services, often failed logins | Service logs, /var/log/secure, web access logs |
| Cloud-side | Rejected traffic to your instances | AWS VPC Flow Logs, GuardDuty port-probe findings |
Defences that reduce what a scanner can find:
- Open only the ports you really need – on AWS, keep security groups tight (for example SSH 22 only from your own IP, never
0.0.0.0/0). - Stop and remove services you do not use (
sudo service vsftpd stop,sudo yum remove vsftpd). - Hide version banners:
ServerTokens ProdandServerSignature Offin Apache,server_tokens off;in Nginx (you configured these servers in Chapters 7–8). - Use an IDS/IPS and tools like
fail2banto block IPs that scan or brute-force. - Watch the logs – this is exactly the SOC work you will do in Part 11.
See it yourself on the lab: on a Linux target you own, capture traffic while you scan it from Kali.
# on the target VM (or your own EC2 instance)
sudo tcpdump -n -i eth0 'tcp[tcpflags] & tcp-syn != 0' | head -50
# on Kali, in another window
sudo nmap -sS 192.168.56.20
You will see a flood of SYN packets from Kali's IP to different ports – that is exactly the pattern an IDS alerts on.
Ravindra Bagale's Tip
In companies there are more "defender" jobs than "hacker" jobs – SOC analyst, security engineer. So while learning every attack, ask yourself: "How would I catch this in the logs?" Give this answer in an interview and you'll be ahead of the other candidates.
Ravindra Bagale's Tip – मराठी
Company मध्ये "hacker" पेक्षा "defender" च्या जागा जास्त आहेत – SOC analyst, security engineer. म्हणून प्रत्येक attack शिकताना स्वतःला विचारा: "हे मी logs मध्ये कसं पकडू?" Interview मध्ये हे उत्तर दिलं तर तुम्ही बाकी candidates पेक्षा पुढे असता.
Ravindra Bagale's Tip – हिंदी
Company में "hacker" से ज़्यादा "defender" की jobs हैं – SOC analyst, security engineer. इसलिए हर attack सीखते समय ख़ुद से पूछो: "इसे मैं logs में कैसे पकड़ूँगा?" Interview में यह जवाब दिया तो तुम बाकी candidates से आगे रहोगे.
Lab
Run tcpdump on Metasploitable 2 (or on your own EC2 instance with your laptop as the scanner) while you run a SYN scan from Kali. Save 20 lines of the capture in your notes and label the pattern. Then on your EC2 instance, restrict SSH to "My IP" in the security group and scan again from another network to confirm port 22 now shows filtered.