# Scanned Unique Host **URL:** \ **Category:** Zeek\ **Created:** [October 25, 2017, 9:40pm UTC](https://community.zeek.org/t/scanned-unique-host/5074 "2017-10-25T21:40:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Hector\_Pena](https://avatars.discourse-cdn.com/v4/letter/h/a4c791/32.png) [@Hector\_Pena](https://community.zeek.org/u/Hector_Pena)\ **Post date:** [October 25, 2017, 9:40pm UTC](https://community.zeek.org/t/scanned-unique-host/5074/1 "2017-10-25T21:40:11Z")
Hi, Is there a way to view which host were scanned when receiving a notice for the scan.bro script? We have been receiving a lot of notices lately for “x.x.x.x scanned at least X unique hosts on port X in Xtime”. I cannot seem to find a good way to determine which host were scanned by the host machine. Thanks, ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [December 28, 2017, 3:47pm UTC](https://community.zeek.org/t/scanned-unique-host/5074/2 "2017-12-28T15:47:47Z")
Hi, typically the only way to do this is to look into conn.log; it might be possible to add that information using the SAMPLE or LAST SumStat reducers; however that will require modifying scans.bro. Johanna ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [December 28, 2017, 4:45pm UTC](https://community.zeek.org/t/scanned-unique-host/5074/3 "2017-12-28T16:45:19Z")
This has come up a few times.. What do you think of the idea of adding a tags field to conn.log like http.log has? The sql injection script makes good use of this:     if ( match\_sql\_injection\_uri in unescaped\_URI )         {         add c$http$tags[URI\_SQLI];         SumStats::observe("http.sqli.attacker", [$host=c$id$orig\_h], [$str=original\_URI]);         SumStats::observe("http.sqli.victim", [$host=c$id$resp\_h], [$str=original\_URI]);         } But there's no corresponding c$conn$tags Adding SCAN to c$conn$tags would make it easy to figure things out after the fact. ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [December 28, 2017, 8:40pm UTC](https://community.zeek.org/t/scanned-unique-host/5074/4 "2017-12-28T20:40:52Z")
> This has come up a few times.. What do you think of the idea of adding a tags field to conn.log like http.log has? That might be a good idea - even though I am always a bit hesitant to add new fields to conn.log. One small drawback is that this approach will always only mark future connections as scan connections - all the ones that actually caused something to be recognized as scanning activity will probably already have been logged into conn.log (and we don't actually have the connection UIDs - at least at the moment). So - adding a sample of IPs might still make sense. Or even make more sense in this case. Johanna ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [December 28, 2017, 8:53pm UTC](https://community.zeek.org/t/scanned-unique-host/5074/5 "2017-12-28T20:53:29Z")
> > This has come up a few times.. What do you think of the idea of adding a tags field to conn.log like http.log has? > > That might be a good idea - even though I am always a bit hesitant to add > new fields to conn.log. One small drawback is that this approach will > always only mark future connections as scan connections - all the ones > that actually caused something to be recognized as scanning activity will > probably already have been logged into conn.log (and we don't actually > have the connection UIDs - at least at the moment). Yeah.. I don't really want to add a new field either, but I think it could be useful in a few places. Maybe I just need to come up with a handful first 🙂 I thought it would work fine for scans.. all my scan.bro does is this: event connection\_attempt(c: connection)     {     if ( c$history == "S" )         add\_scan(c$id);     } event connection\_rejected(c: connection)     {     if ( c$history == "Sr" )         add\_scan(c$id);     } So as long as I could add to c$conn$tags from those 2 events before the log is written, it would work. > So - adding a sample of IPs might still make sense. Or even make more > sense in this case. I was thinking about doing that, but the only good place I know of to put a lot of info is in email\_body\_sections, and that doesn't make it to the notice.log ---
**Author:** ![JonZeolla](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@JonZeolla](https://community.zeek.org/u/JonZeolla)\ **Post date:** [December 29, 2017, 1:02am UTC](https://community.zeek.org/t/scanned-unique-host/5074/6 "2017-12-29T01:02:12Z")
Would [https://github.com/JonZeolla/scan-sampling](https://github.com/JonZeolla/scan-sampling) do what you’re looking for? It’s in bro-pkg as well. Jon ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/scanned-unique-host/5074/7 "2022-05-06T15:45:22Z")