Self-adapting-based network port fast scanning method

Abstract

The invention discloses a self-adapting-based network port fast scanning method. According to the method, through mutual self-adaptive learning of IP addresses and ports, newly found IP addresses or newly found ports are updated and scanned, and repeated scanning is avoided. On the one hand, the number of detected messages can be reduced greatly, meanwhile, the conditions of the IPs and the ports opened in the network can be found to the maximum extent, and the subnet scanning speed is greatly increased. Once it is found that a loophole port happens to a certain host, it is likely that the host has other loophole ports under general conditions, under the condition that one loophole is found, self-adaptive learning can be performed, all the ports where the loopholes may exist of the host IPs which can be attacked easily can be found in time, all the other loopholes of the IPs of the whole network can be detected by just finding any one IP loophole, and threatening loopholes probably existing in the network can be scanned in time.

Description

technical field [0001] The technology relates to the technical field of network measurement, in particular to a fast scanning method for network ports based on self-adaptation. Background technique [0002] Each operating system has different ports open for inter-system communication. If an intruder wants to detect which ports are open and which services are provided by the target computer, they need to establish a TCP connection with the target port first. Try to establish a connection with some port of the target host. If the port of the target host responds, it means that the port is open. [0003] There are many port scanning techniques, such as: (1) full TCP connection: use three-way handshake to establish a standard TCP connection with the target computer, but it is easy to be recorded by the target host. (2) Semi-open scanning (SYN scanning): a. If the target computer responds with SYN=1 and ACK=1 in the TCP message, it means that the port is active, and then ...

AI Technical Summary

Problems solved by technology

(2) Semi-open scanning (SYN scanning): a. If the target computer responds with SYN=1 and ACK=1 in the TCP message, it means that the port is active, and then the scanning host sends an RST to the target host to refuse to establish a TCP connection , resulting in the failure of the three-way handshake process

[0005] The main problem of the current port scanning is that a host has 65536 ports, and the number of ports opened by the IP in the subnet is very small. If you want to be able to scan the vulnerabilities in the subnet, you need to scan all the hosts in the subnet All the ports are scanned, resulting in a huge number of scanned traffic. On the one hand, the scanning traffic affects the normal operation of the network, and at the same time, it takes a lot of time to scan

Images