[mothered]

Totally forgot this thread.

How would this be useful? I've used zenmap in class to find open ports and such but how is this different from just scanning?

Regular scans to see or find any open ports that an attack has done or, has gotten access to your network.

Isn't that what Zenmap/Nmap does- Identifies open/vulnerable ports as well as hosts & services running on the network (IPs, hostnames etc), hence allows you to establish If and when an Intrusion has taken place?