Network investigation guide
Investigating Port Scans
A port scan occurs when one device probes many network ports on a single host to learn which services the host exposes.
Understand the finding
What do Port Scans mean?
Port scans are routinely performed by security tools, but they can also show an attacker profiling a chosen target. The ports tested and any successful follow-through matter more than the scan label alone.
Triage workflow
How to investigate Port Scans
- 1
Map the probed ports to services and identify sensitive administrative or data services.
- 2
Verify the role, owner, and process associated with the scanning source.
- 3
Determine whether probes reached the target or were filtered upstream.
- 4
Look for a subsequent established connection to any scanned port.
Interpret the context
Common benign explanations
Finding this behavior does not by itself prove malicious intent. Common explanations include:
- Approved vulnerability or asset scanners fingerprinting a host
- Monitoring that checks several services on one system
- A broken client retrying obsolete service configurations
Make a decision
When to escalate or de-escalate
Escalate when
- A user endpoint or unknown process scans sensitive services.
- The source connects successfully to a scanned service or repeats the behavior across hosts.
De-escalate when
- An approved scanner performed the activity within its expected scope.
- A recurring and documented application or monitoring issue explains the probes.
Analyze the evidence
Investigate network behavior with Red Hand Analytics
Upload a PCAP or connect Red Hand Collector. Both use Red Hand Analytics, where meaningful behavior, endpoints, DNS, data flows, and connection evidence stay connected.