Python Network Recon TCP Socket Programming

How It Works

The scanner uses Python's socket module to attempt TCP connections to specified ports on a target host. If the three-way handshake completes, the port is open. If it is refused or times out, it is closed or filtered.

Simple concept - but understanding it deeply means understanding how Nmap works, how firewalls make decisions, and why open ports represent attack surface. This is foundational knowledge for anyone in security.

Example Output
Enter IP or domain to scan: scanme.nmap.org
Enter ports to scan (comma-separated): 22,80,443,8080

Scanning scanme.nmap.org...

Port 22: OPEN
Port 80: OPEN
Port 443: CLOSED
Port 8080: CLOSED
What I Learned

Building this from scratch rather than using a library forced me to understand exactly what happens during a TCP connection - the SYN, SYN-ACK, ACK sequence - and why this matters for firewall rule design, network segmentation, and intrusion detection. It's the kind of foundational knowledge that makes you better at defensive work because you understand what attackers are doing when they scan your network.