# Bro and port scan

**URL:** <https://community.zeek.org/t/bro-and-port-scan/205>\
**Category:** Zeek\
**Created:** [December 12, 2001, 3:05pm UTC](https://community.zeek.org/t/bro-and-port-scan/205 "2001-12-12T15:05:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pierfrancesco\_porcu](https://avatars.discourse-cdn.com/v4/letter/p/45deac/32.png) [@pierfrancesco\_porcu](https://community.zeek.org/u/pierfrancesco_porcu)\
**Post date:** [December 12, 2001, 3:05pm UTC](https://community.zeek.org/t/bro-and-port-scan/205/1 "2001-12-12T15:05:48Z")

</div>

Hi,  
I have another questions regarding bro(version 07a90).I'am testing the  
capability  
of bro to detect port scanner.After , i have found others problem:

1) It don't detect Fin, Xmas and Null scans.  
2) Bro don't detect two time the seme scan betweent the same hosts on  
the same ports.  
3) It consume a great quantity of memory.

To resolve the first i have added a script to detect Fin, Xmas and Null  
scans usuing the weird event their produce.And all works good.  
To resolve the 2° and the 3°, i have added to scan.bro a recursive  
function (that use bro delete function and a table of support) to delete  
the record of the table scan\_triples(is deleted also the table of support).  
While the first problem seems to be resolved, the second is gotten worse.  
There is a way to easy delete a subset of a table? or another way to  
reduce the consume of memory of the scan analyzer?  
Thanks.

Pierfrancesco Porcu.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/bro-and-port-scan/205/2 "2022-05-06T15:36:25Z")

</div>