Category: My Projects

The following port scanner C code checks approximately 65535 ports in about 15 seconds on-network.

#include <stdio.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <string.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/ioctl.h>
#include <sys/wait.h>

#define MAX_PORTS 65535
#define MAX_SOCKETS 1023

// gcc -o portscanner portscanner.c

int scan_port(const char* host, int port) {
    struct sockaddr_in server;
    int sock;

    sock = socket(AF_INET, SOCK_STREAM, 0);
    if (sock == -1) {
        perror("socket");
        return -1;
    }

    server.sin_addr.s_addr = inet_addr(host);
    server.sin_family = AF_INET;
    server.sin_port = htons(port);

    int flags = fcntl(sock, F_GETFL, 0);
    fcntl(sock, F_SETFL, flags | O_NONBLOCK);

    if (connect(sock, (struct sockaddr *)&server, sizeof(server)) == -1) {
        if (errno != EINPROGRESS) {
            perror("connect");
            return -1;
        }
    }

    fd_set fdset;
    struct timeval tv;

    FD_ZERO(&fdset);
    FD_SET(sock, &fdset);

    tv.tv_sec = 0;
    tv.tv_usec = 200000;  // Timeout of 200ms

    int select_ret = select(sock + 1, NULL, &fdset, NULL, &tv);

    if (select_ret == -1) {
        perror("select");
        return -1;
    }
    else if (select_ret == 0) {
        close(sock);
        return 0;
    }

    // Connection successful, port is open
    close(sock);
    return 1;
}

void scan_ports(const char* host, int start_port, int end_port) {
    int num_sockets = 0;
    int port;

    for (port = start_port; port <= end_port; port++) {
        pid_t pid = fork();
        if (pid == -1) {
            perror("fork");
            exit(EXIT_FAILURE);
        } else if (pid == 0) {
            // Child process
            int result = scan_port(host, port);
            if (result == 1) {
                printf("Port %d is open\n", port);
            }
            exit(EXIT_SUCCESS);
        } else {
            // Parent process
            num_sockets++;
            if (num_sockets >= MAX_SOCKETS) {
                wait(NULL);
                num_sockets--;
            }
        }
    }
}

int main(int argc, char* argv[]) {
    if (argc < 3 || argc > 4) {
        printf("Usage: %s <host> <port/start_port> [end_port]\n", argv[0]);
        return 1;
    }

    const char* host = argv[1];
    int start_port = atoi(argv[2]);
    int end_port;

    if (argc == 4) {
        end_port = atoi(argv[3]);
        if (start_port < 1 || start_port > MAX_PORTS || end_port < 1 || end_port > MAX_PORTS || start_port > end_port) {
            printf("Invalid port range.\n");
            return 1;
        }
    } else {
        end_port = start_port;
        if (start_port < 1 || start_port > MAX_PORTS) {
            printf("Invalid port.\n");
            return 1;
        }
    }

    printf("Scanning ports %d to %d on host %s...\n", start_port, end_port, host);
    scan_ports(host, start_port, end_port);
    return 0;
}

Here is a Windows version; it is much slower.

// CFLAGS="-static-libgcc -static-libstdc++ -03"
// i686-w64-mingw32-gcc -o portscanner.exe portscanner_win32.c -lws2_32

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#include <process.h>

#pragma comment(lib, "ws2_32.lib")

#define MAX_PORTS 65535

typedef struct {
    const char* host;
    int start_port;
    int end_port;
} ScanParams;

int scan_port(const char* host, int port) {
    WSADATA wsaData;
    SOCKET sock;
    struct sockaddr_in server;

    if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0) {
        perror("WSAStartup");
        return -1;
    }

    sock = socket(AF_INET, SOCK_STREAM, 0);
    if (sock == INVALID_SOCKET) {
        perror("socket");
        WSACleanup();
        return -1;
    }

    server.sin_addr.s_addr = inet_addr(host);
    server.sin_family = AF_INET;
    server.sin_port = htons(port);

    u_long nonblocking = 1;
    if (ioctlsocket(sock, FIONBIO, &nonblocking) != 0) {
        perror("ioctlsocket");
        closesocket(sock);
        WSACleanup();
        return -1;
    }

    if (connect(sock, (struct sockaddr*)&server, sizeof(server)) == SOCKET_ERROR) {
        int error = WSAGetLastError();
        if (error != WSAEWOULDBLOCK) {
            perror("connect");
            closesocket(sock);
            WSACleanup();
            return -1;
        }
    }

    fd_set fdset;
    struct timeval tv;

    FD_ZERO(&fdset);
    FD_SET(sock, &fdset);

    tv.tv_sec = 0;
    tv.tv_usec = 200000;  // Timeout of 200ms

    int select_ret = select(0, NULL, &fdset, NULL, &tv);

    if (select_ret == SOCKET_ERROR) {
        perror("select");
        closesocket(sock);
        WSACleanup();
        return -1;
    } else if (select_ret == 0) {
        closesocket(sock);
        WSACleanup();
        return 0;
    }

    // Connection successful, port is open
    closesocket(sock);
    WSACleanup();
    return 1;
}

unsigned int __stdcall scan_ports_thread(void* params) {
    ScanParams* scanParams = (ScanParams*)params;
    const char* host = scanParams->host;
    int start_port = scanParams->start_port;
    int end_port = scanParams->end_port;
    int port;

    for (port = start_port; port <= end_port; port++) {
        int result = scan_port(host, port);
        if (result == 1) {
            printf("Port %d is open\n", port);
        }
    }

    _endthreadex(0);
    return 0;
}

void scan_ports(const char* host, int start_port, int end_port, int num_threads) {
    int ports_per_thread = (end_port - start_port + 1) / num_threads;
    int remaining_ports = (end_port - start_port + 1) % num_threads;
    int thread;
    HANDLE* scanThreads = malloc(num_threads * sizeof(HANDLE));
    ScanParams* scanParams = malloc(num_threads * sizeof(ScanParams));

    for (thread = 0; thread < num_threads; thread++) {
        scanParams[thread].host = host;
        scanParams[thread].start_port = start_port + thread * ports_per_thread;
        scanParams[thread].end_port = scanParams[thread].start_port + ports_per_thread - 1;

        if (thread == num_threads - 1) {
            // Assign remaining ports to the last thread
            scanParams[thread].end_port += remaining_ports;
        }

        scanThreads[thread] = (HANDLE)_beginthreadex(NULL, 0, scan_ports_thread, &scanParams[thread], 0, NULL);
    }

    // Wait for all threads to finish
    WaitForMultipleObjects(num_threads, scanThreads, TRUE, INFINITE);

    free(scanThreads);
    free(scanParams);
}

int main(int argc, char* argv[]) {
    if (argc < 3 || argc > 5) {
        printf("Usage: %s <host> <port/start_port> [end_port] [num_threads]\n", argv[0]);
        return 1;
    }

    const char* host = argv[1];
    int start_port = atoi(argv[2]);
    int end_port;
    int num_threads = 25;

    if (argc >= 4) {
        end_port = atoi(argv[3]);
        if (argc == 5) {
            num_threads = atoi(argv[4]);
        }
    } else {
        end_port = start_port;
    }

    if (start_port < 1 || start_port > MAX_PORTS || end_port < 1 || end_port > MAX_PORTS || start_port > end_port) {
        printf("Invalid port range.\n");
        return 1;
    }

    printf("Scanning ports %d to %d on host %s using %d thread(s)...\n", start_port, end_port, host, num_threads);
    scan_ports(host, start_port, end_port, num_threads);
    return 0;
}