Become a Beta Tester

DocsAttack Types

Host & Network Discovery

Sweeps across many addresses or networks to find live hosts and services.

A VM sweeps across many addresses or whole networks to find live hosts. It precedes attacks and gets your ranges flagged by scanners' victims. Frabs counts how many different hosts each VM reaches in a short time.

Detectors (13)

DetectorMeasuresWarningIncidentCritical
Host DiscoveryDistinct destination addresses (addresses)100 in 5 min1,000 in 10 min5,000 in 30 min
ICMP Host SweepDistinct destination addresses (addresses)100 in 5 min1,000 in 10 min5,000 in 30 min
TCP Host SweepDistinct destination addresses (addresses)100 in 5 min1,000 in 10 min5,000 in 30 min
UDP Host SweepDistinct destination addresses (addresses)100 in 5 min1,000 in 10 min5,000 in 30 min
ARP SweepDistinct destination addresses (addresses)50 in 1 min200 in 5 min1,000 in 10 min
Subnet SweepDistinct destination addresses (addresses)100 in 5 min1,000 in 10 min5,000 in 30 min
Network SweepDistinct destination addresses (addresses)100 in 5 min1,000 in 10 min5,000 in 30 min
Internet-Wide Host ScanningDistinct destination addresses (addresses)1,000 in 10 min5,000 in 30 min10,000 in 1 h
Random IP ScanningDistinct destination addresses (addresses)1,000 in 10 min5,000 in 30 min10,000 in 1 h
Sequential IP ScanningDistinct destination addresses (addresses)100 in 5 min1,000 in 10 min5,000 in 30 min
Service DiscoveryDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min
Service EnumerationDistinct destination ports (ports)100 in 1 min500 in 5 min1,000 in 10 min
Banner GrabbingDistinct targets on the service's ports (targets)100 in 5 min1,000 in 10 min5,000 in 30 min

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.