NOOB2ROOT

Field Guide Detection & monitoring

Nmap

The classic network scanner. I use it to attack my own honeypot and prove the alerting works end to end.

#What it is

Nmap discovers hosts on a network and the services they run. It sends carefully built probes, reads the responses, and reports which ports are open and, with -sV, what software is answering on them.

#Why I use it here

A detection you've never seen fire is a detection you can't trust. After setting up OpenCanary and the Grafana alert, I scan the honeypot from another machine:

nmap -sV -p 21,23,2222,3306,8080 192.168.1.213

Within a minute or two the honeypot logs the connections, Loki has them, and a Telegram alert arrives. That one command tests every link in the chain.

#Also useful for

  • Checking what your Pi exposes: nmap -p- 192.168.1.213 from another device shows every open port. Anything you don't recognise deserves an answer.
  • Inventory: nmap -sn 192.168.1.0/24 lists what's alive on your network.

#The rule

Only scan networks and devices you own or have written permission to test. Scanning your own LAN is fine; scanning anything else can be illegal and will certainly annoy someone.

← All Field Guide entries