一种改进的端口扫描器的设计与实现  

Improved Design and Implementation of Port Scanner

作　　者：李继容[1] 曾爱国[1] 

机构地区：[1]五邑大学计算机学院,广东江门529020

出　　处：《计算机测量与控制》2010年第7期1664-1666,1679,共4页Computer Measurement &Control

基　　金：广东省自然科学基金项目(5013333);五邑大学青年基金项目(A200712)

摘　　要：端口扫描是网络入侵过程中非常重要的一种攻击预探测手段;对端口扫描进行检测,发现可能出现的攻击行为,可以有效地配合入侵检测系统完成预警、拦截和取证等工作。在简要介绍了端口扫描技术的原理及其检测技术的基础上,设计了一个将几种端口扫描技术综合在一起的且改进的端口扫描器,该端口扫描器包括了TCP扫描和UDP扫描,而TCP扫描再细分成3类:TCP connect扫描和TCP SYN扫描、TCP FIN扫描。经过测试,该扫描器能在不同类型的网络中正常运行,且综合了多种扫描技术的优点。Port scanning is a very important network intrusion during an attack on the pre--detection means. Detecting the port scan, findding that aggressive behavior may occur which can effectively cope with intrusion detection system to complete the early warning, inter- eept evidence and so on. After introducing briefly the port--scanning technology, principle and detection techniques. A several port scanning technology integrated and improved port scanner was designed, which included the TCP port scanner scanning, UDP scanning, while the TCP scanning further subdivided into three categories： TCP connect scanning, TCP SYN scanning, TCP FIN scanning. After testing, the scanner could be in different types of networks in normal operation, and combined the advantages of a variety of scanning technology.

关 键 词：端口扫描 检测 网络安全 

分 类 号：TP206.1[自动化与计算机技术—检测技术与自动化装置]