What is a key indicator of port scanning activity?

• A. Many SYN packets to multiple ports from the same source.
• B. Repeated UDP requests to the same port from different sources.
• C. A long sequence of ICMP echo replies from the destination.
• D. A single TCP connection established to a single port.

Answer: (A)

Port scanning shows up when a single host probes many ports across a short period. The clearest sign is a burst of SYN packets directed at multiple ports from the same source, indicating an attempt to map which ports are open for service. In TCP, a SYN starts the handshake, and a scanner often sends many of these to different ports without completing connections, which is characteristic of probing rather than regular access.

The other patterns describe different activity: repeated UDP requests to one port from various sources suggest a UDP flood or reflection abuse, not broad port discovery; a long sequence of ICMP echo replies from the destination points to a flood of ping responses, not port probing; and a single TCP connection to one port is normal user/service traffic, not scanning.