Q:

Determining if System or Network was scanned with a Network or Vulnerability Scanner

Everywhere I read is to be careful using network scanners and that vulnerability scanners should only be used in active reconnaissance as  scanners tend to be noisy.
How would a network administrator or security technician determine if one of these scanners was used? Could this be determined using log files or programs such as packet analyzers?
I have tried searching but I have had trouble finding anything on this. Mostly all I can find is on conducting such scans.

A:

You can detect them with Intrusion Detection Systems if it's network being scanned.
If it's web server, you can look into access log and grep for errors.
Example IDS is Snort. It can run passively by reading forwarded packets from switch (switch port mirroring), or it can be in front of the network (act as a router).
For experimentation, Snort can be installed on the server itself although this one is not recommended

