Network investigation guide
Investigating Port Sweeps
A port sweep occurs when one device probes the same network port across many hosts to find systems offering a particular service.
Understand the finding
What do Port Sweeps mean?
A sweep can build a target list for exploitation or lateral movement. It can also come from legitimate asset discovery, monitoring, or a client retrying a service across stale peers.
Triage workflow
How to investigate Port Sweeps
- 1
Identify the service associated with the probed port and why it matters in this environment.
- 2
Determine whether the source is authorized to scan the affected range.
- 3
Establish whether the traffic is internal, inbound, or outbound.
- 4
Check whether the source later established a connection to one of the discovered services.
Interpret the context
Common benign explanations
Finding this behavior does not by itself prove malicious intent. Common explanations include:
- Approved vulnerability, asset, NAC, or monitoring scanners
- Health checks probing one service across a range of hosts
- A misconfigured client retrying a service against obsolete peers
Make a decision
When to escalate or de-escalate
Escalate when
- An unapproved endpoint sweeps administrative, directory, database, or file-sharing services.
- The sweep is followed by a successful connection, login attempt, or exploitation behavior.
De-escalate when
- The activity matches an approved scanner, schedule, scope, and port.
- Historical evidence shows a stable, understood monitoring or configuration pattern.
Analyze the evidence
Investigate network behavior with Red Hand Analytics
Upload a PCAP or connect Red Hand Collector. Both use Red Hand Analytics, where meaningful behavior, endpoints, DNS, data flows, and connection evidence stay connected.