Building a Custom Security Tool: Python Port Scanner from Scratch

#!/usr/bin/env python3
"""
simple_scanner.py - Basic TCP port scanner

Usage: python3 simple_scanner.py <target> <start_port> <end_port>
Example: python3 simple_scanner.py 192.168.1.1 1 1024
"""

import socket
import sys
from datetime import datetime

def scan_port(target, port, timeout=1):
    """
    Scan single port using TCP connect

    Args:
        target: IP address or hostname
        port: Port number to scan
        timeout: Socket timeout in seconds

    Returns:
        True if port is open, False otherwise
    """
    try:
        # Create TCP socket
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(timeout)

        # Attempt connection
        result = sock.connect_ex((target, port))

        # Clean up
        sock.close()

        # connect_ex returns 0 on success
        return result == 0

    except socket.gaierror:
        print(f"[-] Hostname resolution failed: {target}")
        return False
    except socket.error as e:
        print(f"[-] Socket error on port {port}: {e}")
        return False

def scan_target(target, start_port, end_port):
    """Scan range of ports on target"""

    print(f"\n[+] Starting scan of {target}")
    print(f"[+] Scanning ports {start_port}-{end_port}")
    print(f"[+] Started at {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")

    open_ports = []

    for port in range(start_port, end_port + 1):
        # Show progress
        if port % 100 == 0:
            print(f"[+] Scanned {port - start_port} ports...", end='\r')

        if scan_port(target, port):
            print(f"[+] Port {port:5d} - OPEN")
            open_ports.append(port)

    print(f"\n[+] Scan complete at {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
    print(f"[+] Found {len(open_ports)} open ports\n")

    return open_ports

if __name__ == '__main__':
    if len(sys.argv) != 4:
        print(f"Usage: {sys.argv[0]} <target> <start_port> <end_port>")
        print(f"Example: {sys.argv[0]} 192.168.1.1 1 1024")
        sys.exit(1)

    target = sys.argv[1]
    start_port = int(sys.argv[2])
    end_port = int(sys.argv[3])

    # Validate port range
    if not (1 <= start_port <= 65535 and 1 <= end_port <= 65535):
        print("[-] Port range must be 1-65535")
        sys.exit(1)

    if start_port > end_port:
        print("[-] Start port must be <= end port")
        sys.exit(1)

    open_ports = scan_target(target, start_port, end_port)

    if open_ports:
        print("Open Ports:")
        for port in open_ports:
            print(f"  {port}")

python3 simple_scanner.py scanme.nmap.org 1 100

#!/usr/bin/env python3
"""
threaded_scanner.py - Multi-threaded port scanner

Significantly faster than single-threaded approach
"""

import socket
import sys
import threading
from queue import Queue
from datetime import datetime

# Configuration
MAX_THREADS = 100
TIMEOUT = 1

# Thread-safe storage for results
open_ports = []
ports_lock = threading.Lock()

def scan_port(target, port):
    """Scan single port (thread worker)"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(TIMEOUT)
        result = sock.connect_ex((target, port))
        sock.close()

        if result == 0:
            with ports_lock:
                open_ports.append(port)
                print(f"[+] Port {port:5d} - OPEN")

    except:
        pass  # Silently ignore errors in worker threads

def worker(target, port_queue):
    """Thread worker function"""
    while True:
        port = port_queue.get()
        if port is None:
            break

        scan_port(target, port)
        port_queue.task_done()

def scan_target_threaded(target, start_port, end_port, num_threads=MAX_THREADS):
    """Scan target using thread pool"""

    print(f"\n[+] Starting threaded scan of {target}")
    print(f"[+] Scanning ports {start_port}-{end_port}")
    print(f"[+] Using {num_threads} threads")
    print(f"[+] Started at {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")

    # Create queue and add all ports
    port_queue = Queue()
    for port in range(start_port, end_port + 1):
        port_queue.put(port)

    # Create and start worker threads
    threads = []
    for _ in range(num_threads):
        thread = threading.Thread(target=worker, args=(target, port_queue))
        thread.daemon = True
        thread.start()
        threads.append(thread)

    # Wait for all ports to be scanned
    port_queue.join()

    # Stop workers
    for _ in range(num_threads):
        port_queue.put(None)
    for thread in threads:
        thread.join()

    print(f"\n[+] Scan complete at {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
    print(f"[+] Found {len(open_ports)} open ports\n")

    return sorted(open_ports)

if __name__ == '__main__':
    if len(sys.argv) < 4:
        print(f"Usage: {sys.argv[0]} <target> <start_port> <end_port> [threads]")
        print(f"Example: {sys.argv[0]} 192.168.1.1 1 1024 100")
        sys.exit(1)

    target = sys.argv[1]
    start_port = int(sys.argv[2])
    end_port = int(sys.argv[3])
    num_threads = int(sys.argv[4]) if len(sys.argv) > 4 else MAX_THREADS

    # Validate inputs
    if not (1 <= start_port <= 65535 and 1 <= end_port <= 65535):
        print("[-] Port range must be 1-65535")
        sys.exit(1)

    if start_port > end_port:
        print("[-] Start port must be <= end port")
        sys.exit(1)

    if not (1 <= num_threads <= 1000):
        print("[-] Thread count must be 1-1000")
        sys.exit(1)

    ports = scan_target_threaded(target, start_port, end_port, num_threads)

    if ports:
        print("Open Ports:")
        for port in ports:
            print(f"  {port}")

#!/usr/bin/env python3
"""
service_detection.py - Port scanner with service version detection
"""

import socket
import sys
import threading
from queue import Queue
from datetime import datetime

# Common service probes
SERVICE_PROBES = {
    'generic': b'\r\n',
    'http': b'GET / HTTP/1.0\r\n\r\n',
    'smtp': b'EHLO scanner\r\n',
    'ssh': b'',  # SSH sends banner first
}

# Common port-to-service mappings
COMMON_PORTS = {
    21: 'ftp',
    22: 'ssh',
    23: 'telnet',
    25: 'smtp',
    53: 'dns',
    80: 'http',
    110: 'pop3',
    143: 'imap',
    443: 'https',
    445: 'smb',
    3306: 'mysql',
    3389: 'rdp',
    5432: 'postgresql',
    6379: 'redis',
    8080: 'http-proxy',
    27017: 'mongodb'
}

class PortScanResult:
    """Container for scan results"""

    def __init__(self, port, state, service=None, banner=None):
        self.port = port
        self.state = state  # 'open', 'closed', 'filtered'
        self.service = service
        self.banner = banner

    def __repr__(self):
        return f"Port {self.port}: {self.state} ({self.service or 'unknown'})"

def grab_banner(target, port, timeout=2):
    """
    Attempt to grab service banner

    Args:
        target: Target IP/hostname
        port: Port number
        timeout: Socket timeout

    Returns:
        Banner string or None
    """
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(timeout)
        sock.connect((target, port))

        # Determine probe to send
        probe = SERVICE_PROBES.get('generic')

        if port == 80 or port == 8080:
            probe = SERVICE_PROBES.get('http')
        elif port == 25:
            probe = SERVICE_PROBES.get('smtp')

        # Send probe if needed
        if probe:
            sock.send(probe)

        # Receive response
        banner = sock.recv(1024).decode('utf-8', errors='ignore').strip()

        sock.close()
        return banner if banner else None

    except:
        return None

def detect_service(port, banner):
    """
    Identify service from port number and banner

    Args:
        port: Port number
        banner: Banner string

    Returns:
        Service name
    """
    # Check common ports first
    if port in COMMON_PORTS:
        base_service = COMMON_PORTS[port]
    else:
        base_service = 'unknown'

    # Refine with banner analysis
    if banner:
        banner_lower = banner.lower()

        # SSH
        if 'ssh' in banner_lower:
            return f"ssh ({banner.split()[0]})"

        # HTTP servers
        if 'http' in banner_lower or 'apache' in banner_lower or 'nginx' in banner_lower:
            if 'apache' in banner_lower:
                return 'http (Apache)'
            elif 'nginx' in banner_lower:
                return 'http (nginx)'
            return 'http'

        # FTP
        if 'ftp' in banner_lower:
            return 'ftp'

        # SMTP
        if 'smtp' in banner_lower or 'mail' in banner_lower:
            return 'smtp'

        # MySQL
        if 'mysql' in banner_lower:
            return 'mysql'

        # PostgreSQL
        if 'postgresql' in banner_lower:
            return 'postgresql'

    return base_service

def scan_port_detailed(target, port, timeout=1):
    """
    Scan port and detect service

    Returns:
        PortScanResult object
    """
    try:
        # Test if port is open
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(timeout)
        result = sock.connect_ex((target, port))
        sock.close()

        if result == 0:
            # Port is open, try to grab banner
            banner = grab_banner(target, port)
            service = detect_service(port, banner)

            return PortScanResult(
                port=port,
                state='open',
                service=service,
                banner=banner
            )
        else:
            return PortScanResult(port=port, state='closed')

    except socket.timeout:
        return PortScanResult(port=port, state='filtered')
    except:
        return PortScanResult(port=port, state='filtered')

# Thread-safe results storage
scan_results = []
results_lock = threading.Lock()

def worker(target, port_queue):
    """Thread worker for detailed scanning"""
    while True:
        port = port_queue.get()
        if port is None:
            break

        result = scan_port_detailed(target, port)

        if result.state == 'open':
            with results_lock:
                scan_results.append(result)
                print(f"[+] Port {result.port:5d} - {result.service or 'unknown'}")
                if result.banner:
                    # Print first 60 chars of banner
                    banner_preview = result.banner[:60]
                    print(f"    Banner: {banner_preview}")

        port_queue.task_done()

def scan_with_detection(target, start_port, end_port, num_threads=50):
    """Scan with service detection"""

    print(f"\n[+] Starting detailed scan of {target}")
    print(f"[+] Scanning ports {start_port}-{end_port}")
    print(f"[+] Using {num_threads} threads")
    print(f"[+] Started at {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")

    # Create queue
    port_queue = Queue()
    for port in range(start_port, end_port + 1):
        port_queue.put(port)

    # Create workers
    threads = []
    for _ in range(num_threads):
        thread = threading.Thread(target=worker, args=(target, port_queue))
        thread.daemon = True
        thread.start()
        threads.append(thread)

    # Wait for completion
    port_queue.join()

    # Stop workers
    for _ in range(num_threads):
        port_queue.put(None)
    for thread in threads:
        thread.join()

    print(f"\n[+] Scan complete at {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
    print(f"[+] Found {len(scan_results)} open ports\n")

    return sorted(scan_results, key=lambda x: x.port)

if __name__ == '__main__':
    if len(sys.argv) < 4:
        print(f"Usage: {sys.argv[0]} <target> <start_port> <end_port> [threads]")
        sys.exit(1)

    target = sys.argv[1]
    start_port = int(sys.argv[2])
    end_port = int(sys.argv[3])
    num_threads = int(sys.argv[4]) if len(sys.argv) > 4 else 50

    results = scan_with_detection(target, start_port, end_port, num_threads)

    if results:
        print("\n" + "="*60)
        print("SCAN RESULTS")
        print("="*60)
        for result in results:
            print(f"\nPort: {result.port}")
            print(f"Service: {result.service or 'unknown'}")
            if result.banner:
                print(f"Banner:\n  {result.banner[:200]}")

#!/usr/bin/env python3
"""
syn_scanner.py - SYN (half-open) port scanner

Requires root/Administrator privileges for raw sockets

WARNING: This is more intrusive than TCP connect scanning.
Use only on networks you own or have written authorization to test.
"""

import socket
import sys
import struct
import random
from datetime import datetime

def checksum(data):
    """
    Calculate IP checksum

    Args:
        data: Bytes to checksum

    Returns:
        16-bit checksum
    """
    s = 0
    for i in range(0, len(data), 2):
        if i + 1 < len(data):
            w = (data[i] << 8) + data[i + 1]
        else:
            w = data[i] << 8
        s = s + w

    s = (s >> 16) + (s & 0xffff)
    s = ~s & 0xffff

    return s

def create_ip_header(src_ip, dst_ip):
    """Create IP header"""
    ip_ihl = 5
    ip_ver = 4
    ip_tos = 0
    ip_tot_len = 0  # Kernel will fill
    ip_id = random.randint(1, 65535)
    ip_frag_off = 0
    ip_ttl = 64
    ip_proto = socket.IPPROTO_TCP
    ip_check = 0  # Kernel will fill
    ip_saddr = socket.inet_aton(src_ip)
    ip_daddr = socket.inet_aton(dst_ip)

    ip_ihl_ver = (ip_ver << 4) + ip_ihl

    ip_header = struct.pack(
        '!BBHHHBBH4s4s',
        ip_ihl_ver, ip_tos, ip_tot_len, ip_id, ip_frag_off,
        ip_ttl, ip_proto, ip_check, ip_saddr, ip_daddr
    )

    return ip_header

def create_tcp_header(src_ip, dst_ip, src_port, dst_port):
    """Create TCP header with SYN flag"""
    tcp_source = src_port
    tcp_dest = dst_port
    tcp_seq = random.randint(0, 4294967295)
    tcp_ack_seq = 0
    tcp_doff = 5  # 4-bit field, size of tcp header, 5 * 4 = 20 bytes

    # TCP flags
    tcp_fin = 0
    tcp_syn = 1  # SYN flag
    tcp_rst = 0
    tcp_psh = 0
    tcp_ack = 0
    tcp_urg = 0

    tcp_window = socket.htons(5840)
    tcp_check = 0
    tcp_urg_ptr = 0

    tcp_offset_res = (tcp_doff << 4) + 0
    tcp_flags = tcp_fin + (tcp_syn << 1) + (tcp_rst << 2) + (tcp_psh << 3) + (tcp_ack << 4) + (tcp_urg << 5)

    tcp_header = struct.pack(
        '!HHLLBBHHH',
        tcp_source, tcp_dest, tcp_seq, tcp_ack_seq,
        tcp_offset_res, tcp_flags, tcp_window, tcp_check, tcp_urg_ptr
    )

    # Pseudo header for checksum
    src_addr = socket.inet_aton(src_ip)
    dst_addr = socket.inet_aton(dst_ip)
    placeholder = 0
    protocol = socket.IPPROTO_TCP
    tcp_length = len(tcp_header)

    pseudo_header = struct.pack(
        '!4s4sBBH',
        src_addr, dst_addr, placeholder, protocol, tcp_length
    )

    pseudo_header = pseudo_header + tcp_header

    tcp_checksum = checksum(pseudo_header)

    # Rebuild TCP header with checksum
    tcp_header = struct.pack(
        '!HHLLBBH',
        tcp_source, tcp_dest, tcp_seq, tcp_ack_seq,
        tcp_offset_res, tcp_flags, tcp_window
    ) + struct.pack('H', tcp_checksum) + struct.pack('!H', tcp_urg_ptr)

    return tcp_header

def syn_scan_port(src_ip, dst_ip, port, timeout=1):
    """
    Perform SYN scan on single port

    Args:
        src_ip: Source IP address
        dst_ip: Destination IP address
        port: Port to scan
        timeout: Response timeout

    Returns:
        True if port is open, False otherwise
    """
    try:
        # Create raw socket
        send_socket = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
        send_socket.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

        # Create receive socket
        recv_socket = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
        recv_socket.settimeout(timeout)
        recv_socket.bind((src_ip, 0))

        # Build packet
        ip_header = create_ip_header(src_ip, dst_ip)
        tcp_header = create_tcp_header(src_ip, dst_ip, random.randint(1024, 65535), port)

        packet = ip_header + tcp_header

        # Send SYN packet
        send_socket.sendto(packet, (dst_ip, 0))

        # Wait for response
        try:
            response, addr = recv_socket.recvfrom(1024)

            # Parse TCP header from response
            ip_header_len = (response[0] & 0x0F) * 4
            tcp_header_start = ip_header_len
            tcp_flags = response[tcp_header_start + 13]

            # Check for SYN-ACK (flags = 0x12)
            if tcp_flags & 0x12 == 0x12:
                send_socket.close()
                recv_socket.close()
                return True

        except socket.timeout:
            pass

        send_socket.close()
        recv_socket.close()
        return False

    except PermissionError:
        print("[-] Error: SYN scanning requires root/Administrator privileges")
        sys.exit(1)
    except Exception as e:
        print(f"[-] Error scanning port {port}: {e}")
        return False

def get_local_ip():
    """Get local IP address"""
    try:
        # Create dummy socket to find local IP
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s.connect(("8.8.8.8", 80))
        local_ip = s.getsockname()[0]
        s.close()
        return local_ip
    except:
        return "127.0.0.1"

if __name__ == '__main__':
    if len(sys.argv) < 4:
        print(f"Usage: sudo {sys.argv[0]} <target> <start_port> <end_port>")
        print(f"Example: sudo {sys.argv[0]} 192.168.1.1 1 1024")
        print("\nNote: Requires root privileges for raw sockets")
        sys.exit(1)

    # Check if running as root
    import os
    if os.geteuid() != 0:
        print("[-] This script must be run as root")
        print(f"    Try: sudo {sys.argv[0]} {' '.join(sys.argv[1:])}")
        sys.exit(1)

    target = sys.argv[1]
    start_port = int(sys.argv[2])
    end_port = int(sys.argv[3])

    # Resolve target to IP
    try:
        dst_ip = socket.gethostbyname(target)
    except socket.gaierror:
        print(f"[-] Could not resolve hostname: {target}")
        sys.exit(1)

    src_ip = get_local_ip()

    print(f"\n[+] Starting SYN scan of {target} ({dst_ip})")
    print(f"[+] Source IP: {src_ip}")
    print(f"[+] Scanning ports {start_port}-{end_port}")
    print(f"[+] Started at {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")

    open_ports = []

    for port in range(start_port, end_port + 1):
        if port % 100 == 0:
            print(f"[+] Scanned {port - start_port} ports...", end='\r')

        if syn_scan_port(src_ip, dst_ip, port):
            print(f"[+] Port {port:5d} - OPEN")
            open_ports.append(port)

    print(f"\n[+] Scan complete at {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
    print(f"[+] Found {len(open_ports)} open ports\n")

    if open_ports:
        print("Open Ports:")
        for port in open_ports:
            print(f"  {port}")

sudo python3 syn_scanner.py scanme.nmap.org 1 1024

import json
import xml.etree.ElementTree as ET

def export_json(results, filename):
    """Export scan results to JSON"""
    data = {
        'scan_time': datetime.now().isoformat(),
        'ports': [
            {
                'port': r.port,
                'state': r.state,
                'service': r.service,
                'banner': r.banner
            }
            for r in results
        ]
    }

    with open(filename, 'w') as f:
        json.dump(data, f, indent=2)

    print(f"[+] Results exported to {filename}")

def export_xml(results, filename):
    """Export scan results to XML"""
    root = ET.Element('scan')
    root.set('time', datetime.now().isoformat())

    for r in results:
        port_elem = ET.SubElement(root, 'port')
        port_elem.set('number', str(r.port))
        port_elem.set('state', r.state)

        if r.service:
            service_elem = ET.SubElement(port_elem, 'service')
            service_elem.text = r.service

        if r.banner:
            banner_elem = ET.SubElement(port_elem, 'banner')
            banner_elem.text = r.banner

    tree = ET.ElementTree(root)
    tree.write(filename, encoding='utf-8', xml_declaration=True)

    print(f"[+] Results exported to {filename}")

# Usage after scan:
# export_json(scan_results, 'scan_results.json')
# export_xml(scan_results, 'scan_results.xml')

import time
from functools import wraps

class RateLimiter:
    """Rate limiter for port scanning"""

    def __init__(self, max_per_second):
        self.max_per_second = max_per_second
        self.min_interval = 1.0 / max_per_second
        self.last_call = 0
        self.lock = threading.Lock()

    def __call__(self, func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            with self.lock:
                elapsed = time.time() - self.last_call
                if elapsed < self.min_interval:
                    time.sleep(self.min_interval - elapsed)
                self.last_call = time.time()

            return func(*args, **kwargs)
        return wrapper

# Apply rate limiter to scan function
@RateLimiter(max_per_second=10)  # Max 10 ports per second
def scan_port_rate_limited(target, port):
    return scan_port(target, port)

#!/usr/bin/env python3
"""
portscan.py - Production-grade port scanner

Features:
- Multi-threaded TCP connect scanning
- Service version detection
- Multiple output formats (text, JSON, XML)
- Rate limiting
- Comprehensive error handling
- Progress reporting

Usage:
  python3 portscan.py <target> [options]

Examples:
  python3 portscan.py scanme.nmap.org -p 1-1024
  python3 portscan.py 192.168.1.0/24 -p 80,443 --threads 50
  python3 portscan.py example.com --top-ports 100 -o json
"""

import argparse
import json
import sys
import ipaddress
from datetime import datetime
from service_detection import scan_with_detection, export_json, export_xml

# Top 100 most common ports (nmap top-ports 100)
TOP_PORTS_100 = [
    7, 9, 13, 21, 22, 23, 25, 26, 37, 53, 79, 80, 81, 88, 106, 110, 111, 113,
    119, 135, 139, 143, 144, 179, 199, 389, 427, 443, 444, 445, 465, 513, 514,
    515, 543, 544, 548, 554, 587, 631, 646, 873, 990, 993, 995, 1025, 1026,
    1027, 1028, 1029, 1110, 1433, 1720, 1723, 1755, 1900, 2000, 2001, 2049,
    2121, 2717, 3000, 3128, 3306, 3389, 3986, 4899, 5000, 5009, 5051, 5060,
    5101, 5190, 5357, 5432, 5631, 5666, 5800, 5900, 6000, 6001, 6646, 7070,
    8000, 8008, 8009, 8080, 8081, 8443, 8888, 9100, 9999, 10000, 32768, 49152,
    49153, 49154, 49155, 49156, 49157
]

def parse_port_range(port_string):
    """Parse port range string (e.g., '1-1024,8080,443')"""
    ports = set()

    for part in port_string.split(','):
        if '-' in part:
            start, end = part.split('-')
            ports.update(range(int(start), int(end) + 1))
        else:
            ports.add(int(part))

    return sorted(ports)

def parse_targets(target_string):
    """Parse target specification (IP, hostname, or CIDR)"""
    targets = []

    try:
        # Try parsing as CIDR
        network = ipaddress.ip_network(target_string, strict=False)
        targets = [str(ip) for ip in network.hosts()]
    except ValueError:
        # Single host
        targets = [target_string]

    return targets

def main():
    parser = argparse.ArgumentParser(
        description='Production-grade port scanner',
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog='''
Examples:
  %(prog)s scanme.nmap.org -p 1-1024
  %(prog)s 192.168.1.0/24 -p 80,443 --threads 50
  %(prog)s example.com --top-ports 100 -o json
        '''
    )

    parser.add_argument('target', help='Target IP, hostname, or CIDR range')
    parser.add_argument('-p', '--ports', help='Port specification (e.g., 1-1024,8080)')
    parser.add_argument('--top-ports', type=int, help='Scan N most common ports')
    parser.add_argument('-t', '--threads', type=int, default=50, help='Number of threads')
    parser.add_argument('-o', '--output', choices=['text', 'json', 'xml'], default='text',
                       help='Output format')
    parser.add_argument('-f', '--file', help='Output filename')
    parser.add_argument('--timeout', type=float, default=1.0, help='Socket timeout')
    parser.add_argument('--rate-limit', type=int, help='Max ports per second')

    args = parser.parse_args()

    # Determine ports to scan
    if args.top_ports:
        ports = TOP_PORTS_100[:args.top_ports]
    elif args.ports:
        ports = parse_port_range(args.ports)
    else:
        # Default: scan top 100 ports
        ports = TOP_PORTS_100

    # Parse targets
    targets = parse_targets(args.target)

    print(f"\n[+] Port Scanner - Production Edition")
    print(f"[+] Targets: {len(targets)}")
    print(f"[+] Ports per target: {len(ports)}")
    print(f"[+] Total scans: {len(targets) * len(ports)}")
    print(f"[+] Threads: {args.threads}")
    print(f"[+] Started: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")

    all_results = []

    for target in targets:
        print(f"\n{'='*60}")
        print(f"Scanning {target}")
        print('='*60)

        # Run scan (using service_detection module)
        results = scan_with_detection(
            target,
            min(ports),
            max(ports),
            args.threads
        )

        all_results.extend(results)

    # Output results
    if args.output == 'json':
        filename = args.file or 'scan_results.json'
        export_json(all_results, filename)

    elif args.output == 'xml':
        filename = args.file or 'scan_results.xml'
        export_xml(all_results, filename)

    else:
        # Text output (already printed during scan)
        if args.file:
            with open(args.file, 'w') as f:
                for r in all_results:
                    f.write(f"Port {r.port}: {r.state} ({r.service or 'unknown'})\n")
                    if r.banner:
                        f.write(f"  Banner: {r.banner}\n")

    print(f"\n[+] Scan complete: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
    print(f"[+] Total open ports found: {len([r for r in all_results if r.state == 'open'])}")

if __name__ == '__main__':
    main()

# Scan top 100 ports
python3 portscan.py scanme.nmap.org --top-ports 100

# Scan specific ports with JSON output
python3 portscan.py 192.168.1.1 -p 80,443,8080 -o json -f results.json

# Scan subnet
python3 portscan.py 192.168.1.0/24 -p 1-1024 --threads 100