Hacker News Reader

If you are a sys admin how can you tell the difference between legit scan and scan by potential hacker?

There is none, "a potential hacker" will however go ahead and try to exploit the system.

So this scan should set off the security alarms and sys admins should patch their servers, right?