Ping Scan Detected By Netscan

  • 1
  • Question
  • Updated 8 years ago
  • Answered
Whenever i use a ping scan tool that pings a /24 subnet, LAN Guardian detects this and sends us a notification. Can I confirm the criteria for a ping scan detected as a Netscan? Is this at least /24 simultaneous pings?
Photo of NetFort

NetFort

  • 182 Posts
  • 2 Reply Likes

Posted 8 years ago

  • 1
Photo of NetFort

NetFort

  • 182 Posts
  • 2 Reply Likes
Official Response
With the default value of 100,25 the sensor will record a netscan event if a host attempts to access 100 or more hosts in 25 seconds. Use a comma to seperate the threshold. values.

This field can be specified under the menu Administration - Configuration - Local Sensors - Edit - Portscan Detector (accessed more than X hosts in Y seconds)