Anatomy of a Port Scan: How NGNTA Flags 268K+ Suspicious IPs in Real Time

A classic TCP SYN scan sends a SYN packet to a range of ports and reads the response: SYN/ACK means open, RST means closed, silence often means filtered. Multiply that across thousands of ports and hundreds of hosts, and you get a very distinctive traffic signature — if you're looking at the right layer.

Here's a simplified view of what NGNTA's flow engine sees during an active scan against a single host:

A single SYN to a single port means nothing. Hundreds of SYNs to sequential or randomized ports from the same source, in a tight time window, with a low response rate — that's a pattern no legitimate application produces.

Signature-based tools are good at catching the loud, fast scan — hundreds of ports per second from one IP is hard to miss. They're much worse at catching the patient version: a handful of connection attempts per hour, spread across a rotating pool of source IPs, deliberately staying under common rate-limit thresholds.

That slow, distributed pattern is exactly what showed up in the 268,000-IP campaign NGNTA flagged. No single source IP looked alarming in isolation. The signal only appeared when flows were aggregated and scored against a behavioral baseline over time, not against a fixed threshold in a single time window.

NGNTA's detection engine builds a rolling behavioral profile per source IP and per destination, weighing several signals together rather than relying on any single rule:

• Port fan-out — how many distinct destination ports a source has touched in a sliding time window.
• Response ratio — the share of SYNs that received a SYN/ACK versus silence or RST, since real clients expect a response.
• Host fan-out — whether the same source is repeating this pattern across many destination hosts, not just one.
• Protocol and service anomalies — connections to ports associated with legacy or high-risk services (Telnet, RDP, SMB) get additional weight.
• Historical reputation — whether the source has been associated with scanning or abuse behavior on other monitored networks.

Each signal contributes to a composite risk score between 0 and 1. Sources crossing the configured threshold — 0.85 by default on NGNTA Pro and Enterprise tiers — are flagged as active reconnaissance and routed into the mitigation pipeline automatically.

Detection alone doesn't stop anything. Once a source crosses the risk threshold, NGNTA's real-time mitigation engine can automatically push a block — either at the sensor, via API to an upstream firewall, or through a customer-defined playbook — without waiting for a human to act on the alert.

Every decision is logged with the full flow evidence that triggered it: the exact ports touched, the timing, and the composite score. That evidence is what turns "we blocked something" into a defensible, auditable record for compliance and post-incident review.

268,000 flagged IPs is a big number, but the number itself isn't the point. The point is that a coordinated reconnaissance campaign — the kind that typically precedes a targeted intrusion attempt — was identified and contained automatically, at line rate, without a NOC or SOC team ever manually triaging it.

Reconnaissance is the first stage of the attack lifecycle for a reason. Catching it early, cheaply, and automatically is one of the highest-leverage things a detection platform can do — because every scan you stop is an intrusion attempt that never gets the chance to start.

Read how regional ISP Northgrid used this exact detection to get ahead of a large-scale scanning campaign →