Case: a scan, seen from the side that was scanned
Many SYNs, many ports, almost no payload. That shape is a scan when you are the one who recorded the target.
What the defender’s file contains
A port scan, seen from the target or from a mirror in front of it, is a crowd of TCP SYNs with the ACK bit clear. They share a source and a destination host, and the destination ports change, or they share a port and the destination hosts change. Conversations show many TCP rows with a packet or two and almost no bytes. Closed ports answer with RST. Ports that do not answer leave a SYN and silence, which you already know how to read as “no reply observed here.”
Filter the attempts so the completed work of the server does not dilute them: tcp.flags.syn == 1 && tcp.flags.ack == 0 && ip.dst == 10.8.0.20. Then look at the source. One source and many destination ports is the vertical shape. One source port pattern across many lab hosts is the horizontal shape. Either way the conversation list should show payloads that never started.
tcp.flags.syn == 1 && tcp.flags.ack == 0 && ip.dst == 10.8.0.20
Worked case: one outside address, many ports, no application data
A mirror in front of the lab server 10.8.0.20 records a minute of noise at 16:05. Endpoints show 198.51.100.20 as a new talker. The TCP conversation list, limited to that source, has hundreds of rows to 10.8.0.20. Destination ports run through a wide range. Most rows are a SYN and a RST. A few are a SYN and nothing else. None show the byte counts you saw yesterday for real HTTPS sessions from 10.8.0.40.
You write: source 198.51.100.20, target 10.8.0.20, about 400 SYNs between 16:05 and 16:06, destination ports spread from the low hundreds into the thousands, replies mostly RST, no application payload, capture on the server mirror. You attach the conversation extract. The packets do not name a tool, so the note does not invent one. The firewall owners and the server owners get the source, the time, and the ports that answered.
What a busy client is, instead
A browser opens several connections to one port, usually 443, completes the handshake, and moves bytes. Those conversation rows are fat and few. A mail client checks one or two ports. A scanner’s rows are thin and many. The difference is in the conversation list, and you can show it by sorting on bytes.
SYN retransmissions toward a single closed port are a stubborn client or a refused service, not a sweep. Breadth of ports or breadth of hosts is the part that makes the scan reading. Quote the breadth.
What the lab does with the source
On a network you administer, the follow-up is the address, the time, and whether any handshake completed into a real service. If one port completed and carried an application exchange, pull that stream out and read it separately. It is no longer “just a SYN.” If nothing completed, the record is the attempt itself.
You do not scan back to confirm the source is still there. The file already recorded the attempt against a host you are allowed to watch. Further packets from you are a new action. The useful defensive work is the log line, the firewall review, and a check that the services which answered were supposed to be reachable from that network.
tshark -n -r lab.pcapng -Y "ip.src == 198.51.100.20 && tcp.flags.syn == 1 && tcp.flags.ack == 0" -T fields -e frame.time_relative -e ip.dst -e tcp.dstport -E separator=,
Diagram
From a burst of SYNs to a source, a port list, and a byte count
- SYNs
Filter attempts aimed at the lab server.
tcp.flags.syn == 1 && tcp.flags.ack == 0 && ip.dst == 10.8.0.20
- Source
Group by source in Conversations. One new source with many thin rows is the lead.
- Breadth
List the destination ports and whether the reply was RST, silence, or a real handshake.
- Separate
Any row that carried payload gets its own stream note. The rest is the attempt.
Check yourself
1. Which conversation list matches a sweep of ports on 10.8.0.20?
2. A lab client opens six TLS connections to port 443 of the same server and transfers a page. How does that differ?
3. The mirror recorded the SYNs. What is the useful next step on a lab you administer?