1

I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image.
I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are related to the port scan.Wireshark log

Improve this question
4
  • 2
    It doesn't appear that you captured a port scan. What is the source IP of your scanner?
    – Ron Trunk
    Commented May 13, 2020 at 14:00
  • @RonTrunk I used the command nmap -sT localhost to run the scan, so I'm assuming that the source IP is that of my machine
    – bones
    Commented May 13, 2020 at 14:15
  • 2
    Have you configured it to capture on the localchost (127.0.0.1) virtual interface?
    – Ron Maupin ♦
    Commented May 13, 2020 at 15:27
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 17, 2020 at 17:31

1 Answer 1

Reset to default
1

Your screenshot doesn't show a port scan.

With a TCP port scan you'd see a number of (unACKed) SYN packets for incrementing TCP port numbers. For UDP, you'd see incrementing port numbers as well.

You might have scanned and captured different interfaces.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.