Question
A cybersecurity monitoring tool flagged network activity related to Nmap during a scan.
The environment has historically generated significant Lansweeper scan traffic, which is expected and previously observed. However, this is the first time the security tool identified Nmap-related activity, resulting in a security incident.
Does Lansweeper use Nmap as part of its scanning functionality?
Answer
No. Lansweeper does not use Nmap in any part of its scanning or discovery functionality.
Lansweeper relies exclusively on its own proprietary scanning mechanisms (such as agentless network scanning, credentialed protocols, and optional agents) and does not embed, invoke, or depend on Nmap binaries, libraries, or techniques.
Any Nmap-related activity detected in the environment was not initiated by Lansweeper.
Additional clarification
If Nmap traffic was detected around the same time as a Lansweeper scan, it is likely that:
-
Another security, monitoring, or network discovery tool was running in parallel.
-
A script, scheduled task, or third-party product using Nmap was executed on the same system or network segment.
-
The security tool correlated the traffic temporally but misattributed it to Lansweeper activity.
While Lansweeper scans can generate noticeable network traffic (which is expected behavior), Nmap signatures or behaviors are not part of Lansweeper’s scanning process.
Conclusion
-
Lansweeper does not use Nmap
-
Nmap-related traffic originates from external tools or processes
-
Any security incident referencing Nmap activity should be investigated outside of Lansweeper
If further validation is required, Lansweeper Support can confirm scan behavior and assist with differentiating Lansweeper traffic from third-party tools.
