What is a recommended practice to observe network traffic during scanning?

• A. Run a sniffer on the scanning machine
• B. Disable monitoring to speed testing
• C. Use a VPN during scanning
• D. Ignore traffic

Answer: (A)

Capturing the scan’s traffic with a packet sniffer on the scanning machine lets you see exactly what the scan sends and what responses come back. This local capture provides visibility into which ports and services react, the sequence of probe packets, and the specific flags and timing involved, so you can interpret results accurately and spot effects from filtering or IDS rules. Tools like Wireshark or tcpdump can reveal SYNs, ACKs, RSTs, ICMP messages, and any anomalies, helping you explain why a host appears open, closed, or filtered. Using a VPN during scanning hides or alters the traffic in transit, making it harder to analyze the scan’s behavior and can complicate scope and interpretation. If monitoring is disabled, you lose a critical view of what actually happened on the network, leaving you with incomplete conclusions. In short, running a sniffer on the scanning machine provides the essential visibility needed to observe and understand the traffic generated during the scan.