通过端口扫描我们可以知道服务器上哪些端口是处于监听状态。

借助Go net模块的DialTimeout方法可以很容易的判断端口是否打开，同时对于批量端口的扫描使用Go Routines实现非常简单。

主结构

type PortScanner struct {
	ip   string
	lock *semaphore.Weighted
}

需要传入ip地址和一个信号量来限制goroutine启动的数量，goroutine太多会占用太多内存，对于一个小工具而言不太合适。

扫描单个端口

复杂一点你可能需要判断一下错误信息再重复，这里简单实现也能满足基本需求

func (ps PortScanner) Scan(port int, timeout time.Duration) error {
	address := fmt.Sprintf("%s:%d", ps.ip, port)
	conn, err := net.DialTimeout("tcp", address, timeout)
	if err != nil {
		return err
	}
	conn.Close()
	return nil
}

批量扫描端口

指定起始端口和结束端口，使用sync.WaitGroup等待函数执行完成，lock限制goroutine启动的数量

func (ps PortScanner) Start(from, to int, timeout time.Duration) {
	wg := sync.WaitGroup{}
	defer wg.Wait()
	fmt.Println("Scanning ip", ps.ip)
	if to == 0 {
		to = from + 1
	}
	for port := from; port < to; port++ {
		ps.lock.Acquire(context.TODO(), 1)
		wg.Add(1)
		go func(port int) {
			defer ps.lock.Release(1)
			defer wg.Done()
			start := time.Now()
			err := ps.Scan(port, timeout)
			if err == nil {
				fmt.Println("Port", port, "open, time", time.Since(start).Milliseconds(), "ms")
			} else {
				fmt.Println("Port", port, "closed")
			}
		}(port)
	}
}

完整代码

package main

import (
	"context"
	"fmt"
	"net"
	"os"
	"strconv"
	"strings"
	"sync"
	"time"

	"golang.org/x/sync/semaphore"
)

type PortScanner struct {
	ip   string
	lock *semaphore.Weighted
}

func (ps PortScanner) Scan(port int, timeout time.Duration) error {
	address := fmt.Sprintf("%s:%d", ps.ip, port)
	conn, err := net.DialTimeout("tcp", address, timeout)
	if err != nil {
		return err
	}
	conn.Close()
	return nil
}

func (ps PortScanner) Start(from, to int, timeout time.Duration) {
	wg := sync.WaitGroup{}
	defer wg.Wait()
	fmt.Println("Scanning ip", ps.ip)
	if to == 0 {
		to = from + 1
	}
	for port := from; port < to; port++ {
		ps.lock.Acquire(context.TODO(), 1)
		wg.Add(1)
		go func(port int) {
			defer ps.lock.Release(1)
			defer wg.Done()
			start := time.Now()
			err := ps.Scan(port, timeout)
			if err == nil {
				fmt.Println("Port", port, "open, time", time.Since(start).Milliseconds(), "ms")
			} else {
				fmt.Println("Port", port, "closed")
			}
		}(port)
	}
}

func main() {
	helps := []string{}
	helps = append(helps, "\r\ncommand error, eg:")
	helps = append(helps, "1. portscanner 127.0.0.1:3000")
	helps = append(helps, "2. portscanner 127.0.0.1:1/65536")
	tips := strings.Join(helps, "\r\n")
	if len(os.Args) != 2 {
		panic(tips)
	}

	address := os.Args[1]
	s := strings.Split(address, ":")
	if len(s) != 2 {
		panic(tips)
	}

	ip := s[0]
	s = strings.Split(s[1], "/")
	var from, to int
	if len(s) > 0 {
		from, _ = strconv.Atoi(s[0])
	}
	if len(s) > 1 {
		to, _ = strconv.Atoi(s[1])
	}

	ps := PortScanner{
		ip:   ip,
		lock: semaphore.NewWeighted(100),
	}
	ps.Start(from, to, 1*time.Second)
}

有两个设置需要注意：

• timeout，超时时间1秒
• NewWeighted，100最多同时运行的goroutine数量

为了提高扫描速度可以减少timeout，增加weighted值。

使用

扫描单个端口

C:\Windows\system32>portscanner 127.0.0.1:135
Scanning ip 127.0.0.1
Port 135 open, time 3 ms

指定扫描的端口范围

C:\Windows\system32>portscanner 127.0.0.1:130/140
Scanning ip 127.0.0.1
Port 135 open, time 1 ms
Port 130 closed
Port 134 closed
Port 132 closed
Port 131 closed
Port 139 closed
Port 133 closed
Port 138 closed
Port 137 closed
Port 136 closed