Comparison of Port Scanning, Vulnerability Scanning, and Penetration Testing Combinations for Network Vulnerability Detection in GNS3 Testbed

Abstract

Network security faces significant challenges due to the increasing number and complexity of system vulnerabilities. This study aims to develop and evaluate a full combination method (ABC) integrating port scanning (Nmap), vulnerability scanning (OpenVAS), and penetration testing (Metasploit), and compare it with partial combinations (AB, BC, AC) for more effective vulnerability detection. Using a quantitative experimental approach within a controlled GNS3 TestBed, three key indicators were analyzed: number of vulnerabilities detected, detection time, and exploit validity. Experimental results show that the ABC method detected 62 potential vulnerabilities, including 11 high and medium severity CVEs, matching the AB method but significantly outperforming AC, which detected none. In terms of detection time, the ABC method achieved a balanced performance at 91 minutes, which is 31.5% faster than AB (133 minutes), while maintaining full exploit validation. Notably, the ABC method successfully validated 100% of critical vulnerabilities using Metasploit, confirming the practical applicability and reliability of the integrated approach compared to dual combinations. Overall, the findings demonstrate that the full combination method (ABC) offers superior accuracy and comprehensiveness in detecting and validating network vulnerabilities. This research contributes to cybersecurity practices by proposing an integrated detection workflow that effectively balances speed and depth of analysis, setting a practical benchmark for vulnerability detection systems applicable to both simulated and real-world network environments.