1

I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image.
I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are related to the port scan.Wireshark log

4
  • 2
    It doesn't appear that you captured a port scan. What is the source IP of your scanner?
    – Ron Trunk
    May 13 '20 at 14:00
  • @RonTrunk I used the command nmap -sT localhost to run the scan, so I'm assuming that the source IP is that of my machine
    – bones
    May 13 '20 at 14:15
  • 2
    Have you configured it to capture on the localchost (127.0.0.1) virtual interface?
    – Ron Maupin
    May 13 '20 at 15:27
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17 '20 at 17:31
1

Your screenshot doesn't show a port scan.

With a TCP port scan you'd see a number of (unACKed) SYN packets for incrementing TCP port numbers. For UDP, you'd see incrementing port numbers as well.

You might have scanned and captured different interfaces.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.