Port scanning basics in Bash Scripting - Deep Dive

Overview - Port scanning basics

What is it?

Port scanning is a way to check which doors (ports) on a computer or server are open and ready to communicate. Each port is like a door to a specific service or application. By scanning ports, you learn what services a machine offers and if it might be vulnerable. This helps in security testing and network management.

Why it matters

Without port scanning, you would not know which services are running on a computer or if any doors are accidentally left open. This could lead to security risks or network problems. Port scanning helps find weak spots before attackers do, making networks safer and more reliable.

Where it fits

Before learning port scanning, you should understand basic networking concepts like IP addresses and ports. After mastering port scanning, you can learn about network security, firewall rules, and vulnerability assessment tools.

Mental Model

Core Idea

Port scanning is like knocking on every door of a house to see which ones are open and who answers.

Think of it like...

Imagine a big apartment building where each apartment door is a port. Port scanning is like walking down the hallway and knocking on each door to find out which apartments are occupied and what activities are happening inside.

┌───────────────┐
│ Target Host   │
│               │
│  Ports:       │
│  [22] Open   ←┐
│  [80] Open   ←┤  Port Scanner knocks
│  [443] Closed │
│  [8080] Open ←┘
└───────────────┘

Port Scanner → Knocks on each port to check if open or closed

Build-Up - 6 Steps

1

Foundation

Understanding IP and Ports

Concept: Learn what IP addresses and ports are and how they identify computers and services.

Every device on a network has an IP address, like a street address. Each device can have many ports, like doors to different rooms. Ports are numbered from 0 to 65535. Common ports include 22 for SSH, 80 for web, and 443 for secure web.

Result

You know that IP is the device location and ports are entry points to services on that device.

Understanding IP and ports is essential because port scanning targets these entry points to find active services.

2

Foundation

What is Port Scanning?

Concept: Port scanning is the process of checking which ports on a device are open or closed.

When you scan a port, you send a small message to see if the port responds. If it responds, the port is open and a service is listening. If not, the port is closed or filtered by a firewall.

Result

You can tell which ports are open and which are closed on a target device.

Knowing which ports are open helps identify what services the device offers and if it might be vulnerable.

3

Intermediate

Basic Bash Port Scan Script

🤔Before reading on: do you think a simple bash script can scan all ports quickly or will it be slow? Commit to your answer.

Concept: Use bash scripting with tools like 'nc' (netcat) to scan ports by trying to connect to them.

A simple bash script loops through a range of ports and uses 'nc -zv' to check if the port is open. For example: for port in {20..25}; do nc -zv 192.168.1.1 $port done This tries to connect to each port and reports if it is open.

Result

The script outputs which ports are open or closed on the target IP.

Using bash and netcat is a straightforward way to scan ports without installing complex tools.

4

Intermediate

Interpreting Scan Results

🤔Before reading on: do you think a port that doesn't respond is always closed? Commit to your answer.

Concept: Learn how to read the output of port scans and understand open, closed, and filtered ports.

Open ports respond positively to connection attempts. Closed ports reject connections. Filtered ports do not respond because a firewall blocks them. For example, 'Connection refused' means closed, 'timed out' means filtered.

Result

You can distinguish between open, closed, and filtered ports from scan output.

Knowing the difference helps you understand network security and firewall behavior.

5

Advanced

Scanning with Timeout and Parallelism

🤔Before reading on: do you think scanning ports one by one is efficient or slow? Commit to your answer.

Concept: Improve bash port scanning by adding timeouts and running scans in parallel to speed up results.

By adding a timeout option to 'nc' and running multiple scans in the background, you can scan many ports faster. Example: for port in {1..100}; do nc -z -w 1 192.168.1.1 $port & done wait This runs scans in parallel with a 1-second timeout.

Result

The scan completes faster and avoids hanging on unresponsive ports.

Optimizing scan speed is important for practical use on large networks.

6

Expert

Limitations and Detection Risks

🤔Before reading on: do you think port scanning is always invisible to the target? Commit to your answer.

Concept: Understand that port scanning can be detected and blocked, and learn about stealth scanning techniques.

Port scans generate network traffic that can be logged or blocked by firewalls and intrusion detection systems. Some scans use slow timing or special packet types to avoid detection. Bash scripts are simple and easy to detect, so advanced tools like Nmap use stealth methods.

Result

You realize port scanning can alert defenders and that stealth requires specialized tools.

Knowing detection risks helps you choose the right tools and methods for ethical scanning.

Under the Hood

Port scanning works by sending network packets to specific ports on a target IP address and waiting for responses. The type of response or lack thereof reveals the port's state: open, closed, or filtered. Tools like 'nc' open TCP connections to test ports. The operating system's network stack handles these packets and replies accordingly.

Why designed this way?

Port scanning was designed to map network services and security holes efficiently. Early network tools needed a simple way to check service availability. The approach balances speed and information detail. Alternatives like banner grabbing or vulnerability scanning build on port scanning but are more complex.

┌───────────────┐       ┌───────────────┐
│ Port Scanner  │──────▶│ Target Host   │
│ Sends packet  │       │ Receives packet│
│ to port N     │       │ on port N     │
└───────────────┘       └───────────────┘
         ▲                      │
         │                      ▼
         │             ┌───────────────────┐
         │             │ Responds if open  │
         │             │ Rejects if closed │
         │             │ No response if    │
         │             │ filtered          │
         └─────────────┴───────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does a non-responding port always mean it is closed? Commit to yes or no.

Common Belief: If a port does not respond, it is always closed.

Reality: A non-responding port may be filtered by a firewall, not necessarily closed.

Why it matters: Assuming non-response means closed can cause you to miss hidden services or security controls.

Quick: Can port scanning be completely hidden from the target? Commit to yes or no.

Common Belief: Port scanning is invisible and cannot be detected by the target.

Reality: Port scanning generates network traffic that can be logged and detected by security systems.

Why it matters: Believing scans are invisible can lead to unintentional detection and blocking.

Quick: Does scanning all 65535 ports always give useful information? Commit to yes or no.

Common Belief: Scanning every port is always necessary and useful.

Reality: Most services use common ports; scanning all ports wastes time and may trigger alarms.

Why it matters: Blindly scanning all ports can slow down scans and increase detection risk.

Quick: Does a port scan tell you exactly what software is running? Commit to yes or no.

Common Belief: Port scanning reveals the exact software and version running on a port.

Reality: Port scanning only shows if a port is open; identifying software requires additional techniques.

Why it matters: Misunderstanding this can lead to overconfidence in scan results and missed vulnerabilities.

Expert Zone

1

Some ports may appear open but are actually protected by honeypots designed to trap attackers.

2

Timing and packet types in scans affect detection; slow scans reduce noise but take longer.

3

Network devices like load balancers can alter scan results by distributing connections.

When NOT to use

Avoid port scanning on networks without permission as it can be illegal or unethical. Use passive network monitoring or authorized vulnerability scanners instead.

Production Patterns

In real systems, port scanning is automated in security audits, combined with vulnerability scanners and firewall rule checks. Scripts are integrated into CI/CD pipelines to detect exposed services early.

Connections

Firewall Rules

Port scanning tests which firewall rules allow or block traffic to ports.

Understanding port scanning helps you design firewall rules that effectively protect services.

Network Intrusion Detection Systems (NIDS)

NIDS monitor for port scanning activity as a sign of potential attacks.

Knowing how port scanning works helps in tuning detection systems to reduce false alarms.

Medical Diagnostics

Port scanning is like running tests on different organs to find issues without opening the body.

This connection shows how probing external signs can reveal internal states, a principle across fields.

Common Pitfalls

#1 Scanning ports too quickly without timeouts causes the script to hang or miss results.

Wrong approach:

for port in {1..100}; do
nc -zv 192.168.1.1 $port
done

Correct approach:

for port in {1..100}; do
nc -zv -w 1 192.168.1.1 $port
done

Root cause:

Not setting a timeout causes the scanner to wait indefinitely on unresponsive ports.

#2 Running scans sequentially on many ports takes too long and is inefficient.

Wrong approach:

for port in {1..1000}; do
nc -zv -w 1 192.168.1.1 $port
done

Correct approach:

for port in {1..1000}; do
nc -zv -w 1 192.168.1.1 $port &
done
wait

Root cause:

Not using parallelism wastes time by scanning ports one after another.

#3 Assuming no response means the port is closed leads to wrong conclusions.

Wrong approach:

Ignoring ports that do not respond and marking them closed without considering filtering.

Correct approach:

Treat non-responding ports as filtered and investigate firewall rules or network blocks.

Root cause:

Misunderstanding network behavior and firewall effects on scan results.

Key Takeaways

Port scanning is a method to discover open doors (ports) on a computer to understand what services it offers.

Using simple bash scripts with tools like netcat allows you to scan ports and interpret their states.

Open, closed, and filtered ports behave differently and understanding these helps in network security.

Port scanning can be detected and should be done ethically with permission to avoid legal issues.

Optimizing scan speed and interpreting results correctly are key skills for effective port scanning.