How does Wireshark detect port scanning attempts

Question

Wireshark captures and analyzes network packets. How does it identify patterns that indicate port scanning activity?

Answer 1

​Wireshark is a powerful network protocol analyzer that captures and inspects network traffic in real-time. While it doesn't automatically flag port scanning attempts, it provides the tools necessary to identify patterns indicative of such activity. Here's how you can detect port scanning using Wireshark:​

Recognizing Port Scanning Patterns

Port scanning involves sending packets to various ports on a target system to discover open or active services. Common indicators of port scanning in Wireshark include:

• Multiple Connection Attempts: A single source IP attempting connections to numerous destination ports within a short timeframe.​

• Unusual Packet Flags: Use of specific TCP flags that deviate from standard connection behavior.​

• ICMP Responses: A surge in ICMP "Destination Unreachable" messages, often resulting from UDP scans.​

Utilizing Wireshark Filters

Wireshark's filtering capabilities allow you to isolate traffic that matches port scanning characteristics:​

• TCP SYN Scans: These scans send SYN packets to initiate connections without completing the handshake. Filter:

  tcp.flags.syn == 1 && tcp.flags.ack == 0

This filter displays SYN packets without corresponding ACKs, typical of SYN scans. ​

• TCP Connect Scans: These involve full TCP handshakes. Filter:

  tcp.flags.syn == 1 && tcp.flags.ack == 0 && tcp.window_size > 1024

A larger window size indicates a standard connection attempt.

• TCP Null Scans: Packets with no flags set. Filter:​

  tcp.flags == 0

Such packets can be used to probe firewalls and identify open ports.

• TCP FIN Scans: Packets with only the FIN flag set. Filter:​

  tcp.flags.fin == 1 && tcp.flags.ack == 0 && tcp.flags.syn == 0 && tcp.flags.rst == 0 && tcp.flags.psh == 0 && tcp.flags.urg == 0

FIN scans attempt to close connections to detect open ports.

• TCP Xmas Scans: Packets with FIN, PSH, and URG flags set. Filter:

  tcp.flags.fin == 1 && tcp.flags.push == 1 && tcp.flags.urg == 1

These scans send packets that "light up" like a Christmas tree, hence the name.

• UDP Scans: Often result in ICMP "Port Unreachable" messages. Filter:​

  icmp.type == 3 && icmp.code == 3

This filter captures ICMP messages indicating closed UDP ports.

Analyzing Conversations

Wireshark's Statistics > Conversations feature helps identify unusual communication patterns:​

1. Navigate to Statistics > Conversations.​

2. Review the list for a single source IP communicating with multiple destination ports.

3. Such patterns can indicate a port scan originating from that source.