Serangan dan Deteksi Port Scanning Menggunakan Wireshark dan Snort

Abstract

In the digital era, network security threats such as port scanning pose significant risks as they serve as reconnaissance for potential cyber attacks. This study evaluates the effectiveness of Wireshark (paket analysis tool) and Snort (Intrusion Detection System) in detecting and analyzing port scanning activities. Using Nmap (Zenmap) as an attack simulator, experiment were conducted on a local Wi-Fi network to capture TCP SYN scans and HTTP sniffing attemps. Wireshark successfully identified suspicious traffic patterns, icluding unacknowledged SYN packets and exposed HTTP login credentials, while Snort, configured with custom rules, generated real-time alert for scanning activities. The findings confirm the complementary roles validation. This study recommends regular Snort rule update, enabling promiscuous mode, and implementing HTTPS/VPN to mitigate sniffing risks. This integrates approach enhances early threat detection and strengthens network protection mechanisms.