Port Scanning

How a connect scan works

The simplest scan is the TCP connect scan: ask the OS to open a normal connection to host:port. The kernel runs the three-way handshake for you, so you need no special privileges:

sequenceDiagram
participant S as Scanner
participant T as Target:port
S->>T: SYN
alt port open
  T->>S: SYN-ACK
  S->>T: ACK (handshake complete → OPEN)
else port closed
  T->>S: RST (refused → CLOSED)
else firewalled
  Note over T: packet dropped → (timeout → FILTERED)
end

• Open — the handshake completes; net.Dial returns a usable connection.
• Closed — the host replies with RST; net.Dial fails fast with “connection refused”.
• Filtered — a firewall drops the probe; net.Dial hangs until your timeout fires. That timeout is the knob that separates “slow but open” from “filtered.”

Go’s net package gives you the connect scan essentially for free — the skill is doing it concurrently and politely.

See it: the concurrent scan engine

Here is the worker-pool scanner with a simulated network so it runs in the sandbox — real net.Dial is fenced below. Note the bounded workers, the open/closed/filtered classification, and the deterministic sorted report:

package main

import (
"fmt"
"sort"
"sync"
)

type status int

const (
closed status = iota
open
filtered
)

// simulateDial stands in for net.DialTimeout so this runs offline.
// Pretend 22, 80, 443 are open; 8080 is firewalled; everything else closed.
func simulateDial(port int) status {
switch port {
case 22, 80, 443:
	return open
case 8080:
	return filtered
default:
	return closed
}
}

func main() {
const workers = 50
ports := make(chan int)
type res struct {
	port int
	st   status
}
out := make(chan res)

var wg sync.WaitGroup
for i := 0; i < workers; i++ {
	wg.Add(1)
	go func() {
		defer wg.Done()
		for p := range ports {
			out <- res{p, simulateDial(p)}
		}
	}()
}
go func() {
	for p := 1; p <= 1024; p++ {
		ports <- p
	}
	close(ports)
}()
go func() { wg.Wait(); close(out) }()

var openPorts []int
for r := range out {
	if r.st == open {
		openPorts = append(openPorts, r.port)
	}
}
sort.Ints(openPorts)
fmt.Printf("scanned 1024 ports, %d open:\n", len(openPorts))
for _, p := range openPorts {
	fmt.Printf("  %d/tcp open\n", p)
}
}

The real thing: net.DialTimeout

Swap the simulated dial for the real one and you have a working scanner. The sandbox can’t open real connections, so this is fenced — but it’s the whole change:

import (
	"fmt"
	"net"
	"time"
)

// scanPort returns true if a TCP handshake to host:port completes.
func scanPort(host string, port int, timeout time.Duration) bool {
	addr := fmt.Sprintf("%s:%d", host, port)
	conn, err := net.DialTimeout("tcp", addr, timeout)
	if err != nil {
		return false // refused (closed) or timed out (filtered)
	}
	conn.Close()
	return true
}

Drop scanPort into the worker body above, give it a 1–2 second timeout, and respect the scope guard and a rate limit. That’s a complete, polite scanner in ~40 lines — the Black Hat Go classic, done idiomatically.

Banner grabbing: what’s behind the door

Knowing a port is open is half the story; banner grabbing identifies the service. Many protocols send a greeting on connect (SSH, SMTP, FTP) or answer a crafted request (HTTP). Read the first bytes and you’ve fingerprinted the software and version:

conn, _ := net.DialTimeout("tcp", addr, 2*time.Second)
conn.SetReadDeadline(time.Now().Add(2 * time.Second))
buf := make([]byte, 256)
n, _ := conn.Read(buf) // SSH/SMTP/FTP announce themselves here
fmt.Printf("%s banner: %q\n", addr, buf[:n])
// For HTTP, write "HEAD / HTTP/1.0\r\n\r\n" first, then read the Server header.

A defender uses the same technique to inventory their own network and spot outdated, vulnerable versions before an attacker does.

Defending against scans

See also

• Building security tools — the worker-pool skeleton this fills in.
• DNS enumeration — discovering hosts before you scan their ports.
• Worker pool & rate limiting — the concurrency behind a fast, polite scanner.
• TCP sockets — the net package the scanner is built on.

Next: turning a list of open ports into a picture of the network — network recon & service detection.

Related topics