From the log excerpt, which line indicates a port scan detected from 194.222.156.169?

From the log excerpt, which line indicates a port scan detected from 194.222.156.169?

• A. Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169
• B. Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482
• C. Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53
• D. Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111

Answer: (A)

Port scanning detection is shown in logs by a line that explicitly says a portscan was detected, along with the source IP. In this excerpt, the line literally reads that a portscan was detected from 194.222.156.169, and it’s produced by the spp_portscan module, which indicates a detection event for a scanning activity coming from that IP. The other entries describe different kinds of activity (a FIN scan, a DNS version query, and an RPC info query) and do not announce a portscan detection. So the line with the portscan detection label from spp_portscan is the one that indicates a port scan detected from that IP.

Port scanning detection is shown in logs by a line that explicitly says a portscan was detected, along with the source IP. In this excerpt, the line literally reads that a portscan was detected from 194.222.156.169, and it’s produced by the spp_portscan module, which indicates a detection event for a scanning activity coming from that IP. The other entries describe different kinds of activity (a FIN scan, a DNS version query, and an RPC info query) and do not announce a portscan detection. So the line with the portscan detection label from spp_portscan is the one that indicates a port scan detected from that IP.