In a honeypot log, which event line indicates a port scan from an external IP?

In a honeypot log, which event line indicates a port scan from an external IP?

• A. spp_portscan: portscan detected from 194.222.156.169
• B. IDS213/ftp-passwd-retrieval
• C. IDS/DNS-version-query
• D. IDS27/FIN Scan

Answer: (A)

Port scanning is when an attacker probes many ports to map what services are available on a target. In a honeypot log, such activity is shown by a line that explicitly says a port scan was detected and includes the source IP. The line “spp_portscan: portscan detected from 194.222.156.169” fits perfectly: it names the event (portscan), says it was detected, and shows the external IP performing the scan. The other entries describe different actions: one indicates an FTP password retrieval attempt, another a DNS version query, and the last shows a FIN scan type. While a FIN scan is a kind of port scan, it doesn’t present the source IP in the same explicit “portscan detected from [IP]” format, so it isn’t as direct a match for indicating a port scan from an external IP.

Port scanning is when an attacker probes many ports to map what services are available on a target. In a honeypot log, such activity is shown by a line that explicitly says a port scan was detected and includes the source IP. The line “spp_portscan: portscan detected from 194.222.156.169” fits perfectly: it names the event (portscan), says it was detected, and shows the external IP performing the scan.

The other entries describe different actions: one indicates an FTP password retrieval attempt, another a DNS version query, and the last shows a FIN scan type. While a FIN scan is a kind of port scan, it doesn’t present the source IP in the same explicit “portscan detected from [IP]” format, so it isn’t as direct a match for indicating a port scan from an external IP.