Network Scan

Thu, 03/05/2009 - 23:51 — binde

Network scans can either take the form of scanning all ports on a host (or a variety of hosts) or specific ports on a variety of hosts.

Scanning generally indicates reconnaissance attempts, often automated. The information is gathered so that targetted attacks may later be launched.

Scanning is often a symptom of a host that is infected with malware or has been hacked (subjected to intrusion).
Remedy this as a malware infestation first, then as an intrusion.

computer abuse
incident handling
incident response