Question: is nmap a protocol analyzer?
Answer: Detecting Nmap on your Network A network protocol analyzer, such as Wireshark, is a good tool to use to monitor your network and detect network scanning. The Snort sfPortscan preprocessor will detect Nmap TCP connect and SYN scanning activity.