You suspect that someone located outside your organization has been searching for open ports on your web server. How can you see whether the web server is being scanned?

The correct answer is C. Firewall logs. Firewall logs can show network traffic, including port scans, whether connections are made or not. Netstat only shows active connections; port scans do not create connections. FPort and TCPview provide the same kind of information that netstat does. Event Viewer shows what has ha

Reconnaissance, Scanning, and Enumeration

Question

Options

ATCP View
BEvent Viewer
CFirewall logs
Dnetstat
EFPort

How the community answered

(50 responses)

A
2% (1)
B
2% (1)
C
90% (45)
E
6% (3)

Explanation

Firewall logs can show network traffic, including port scans, whether connections are made or not. Netstat only shows active connections; port scans do not create connections. FPort and TCPview provide the same kind of information that netstat does. Event Viewer shows what has happened on a host, but does not show network traffic, including port scans.

Topics

#port scanning detection#firewall logs#network monitoring

Community Discussion

No community discussion yet for this question.

Full GCIH Practice