I'm just starting to read up on hacking in the Shadowrun universe, but I didn't see anything about corps or people being able to tell you're looking for their hidden network. Is it possible to detect these scans, or is it just seen as general network traffic?
Simple Sniffing is Undetectable
IRL as in the rules, simple network traffic capture is undetectable. Whether that traffic tells you anything about the network is another matter altogether, but it probably won't give you a network map, especially if behind any sort of edge device (IRL the edge device might NAT everything behind it).
Assuming the node is the direct target, it would have to be actively dropping packets on the network to be passively detected and responding to "pings" to be actively detected.
Working from Trajan's answer, here's how I might adjudicate detection of a scan, which IRL is akin to a network probe: drive the player experience without breaking immersion (or the fourth wall) by having a success or failure plan.
In attempting to detect the node, the node owner—presumably the runner's target—is made aware of the scan/probe only in failure of the hacking test. What the owner is aware of might be modeled on how badly the test fails.
Simple failure might mean that the node is not detected. Higher "degrees" of failure might inform the owner more about the attempt, gradually going from "Aha! someone is scanning my network" to "This rank amateur is scanning my node and he's doing it from the coffee shop at 3rd and Elm" in the case of a catastrophic failure.
In this, you abstractly model real life without trying to make it just like real life.
Abstraction by test success/failure is a better plan. Having a plan ready so you don't have to say "Oh, the ICE near the node has X ability and rolls opposed to your Y ability and succeeds by Z much". A plan allows you to say something like "You see the ICE drop onto the grid and a bright line sweeps across you. The sense that you've been scanned overwhelms you as bright bursts of data leave the ICE like tracers from a Panther assault cannon to its owner. A feeling of being naked and exposed crawls across your flesh back at the apartment/coffee shop/rent-a-room."
Real Life Network Probing
Today's network engineering toolkits pretty much apply an acceptable threshold in identifying attack and threats in network scanning. Oneoff pings are so ubiquitous they are all but ignored or "dropped" in the "bit bucket" by edge devices (or by configuration at the target firewall). "Dropping ICMP packets" is how devices are typically hidden on a network. If you can't "ping it" you can't know anything is at the address goes the logic. DNS tends to betray this by mapping a name to an address. But hosts can be distributed by DNS multiplexing and … the rabbit hole just leads deeper.
DDoS detection is sophisticated monitoring of volume traffic, often looking across network boundaries. Scanning is often difficult to detect at the target node, but easier across edge devices. Any sophisticated network, especially one of a mega-corps, will likely have honeypots and ICE at the edge of possible targets to assist in detection.
As GM you probably don't want to model real life as it can be quite deep and complicated.
There is no strict answer to this question in the rule but I'd say maybe.
- The rule :
The description of the matrix action Capture Wireless Signal (Sniffer) explicitely tells us (SR4A p.229) :
There is no way for other parties to detect your capture
While the Detect Hidden Mode doesn't.
- My interpretation :
disclaimer: while I may have some basic knowledge in computer science, I have almost no experience in networking, and this is nothing but personal opinion. Also, be aware that trying to enforce technical realism in SR4 may not be a good idea
Assuming the hidden node isn't broadcasting anything (slave nodes, watching a movie on netflix, etc.), there is no way of being aware that there is a receiver. So I guess the scan program detects hidden nodes by trying to send data and see if anything respond. That would make scanning detection possible. If the hidden node is emitting receiving traffic, then spotting such request would be difficult, and scanning would be less efficient than sniffing to know if there is someone in the area. Trying to hack the hidden node would still require a Scan action.