TCP_SCAN(1)

NAME
tcp_scan, udp_scan - internet port scanners

SYNOPSIS
tcp_scan [-abuU] [-l load] [-s string] [-w time] host service(s)...

udp_scan [-apuU] [-l load] host service(s)...

DESCRIPTION
These commands take a list of internet services and investigate which services are available from a given host. The tcp_scan command looks for connection-oriented services; udp_scan identifies active datagram ports.

Each service argument may be specified as a symbolic name (telnet), a port number (23), an interval (1-1023, telnet-smtp) or an interval with the lower or upper bounds missing (the default bounds are 1 and 65535, respectively).

Options:

-a  Report status of all specified services.

-b (tcp_scan only)
    Report banner information. Banners are converted to printable form using C-like escape sequences. Whenever tcp_scan finds that the server does telnet options negotiation it sets the 't' flag in the output. This is useful to detect telnet servers on non-standard ports.

-l load
    Minimize the impact of network roundtrip delays by performing load network probes in parallel. The default load is the per-process open-file limit - 10.

-p port (udp_scan only)
    Use this port to verify that the host or network is alive. By default the UDP port scanner uses port number 1. Specify a port number that is known to be unreachable or inactive.

-s string (tcp_scan only)
    After a connection has been established, send string to the server. The following backslash escapes can be used: \ooo (octal character code), \b (backspace), \f (formfeed), \n (newline), \r (carriage-return), \s (space), and \t (horizontal tab). The string should be enclosed between quotes if it contains shell meta characters.

-t time (tcp_scan only)
    Give up when the program has not found out anything within time seconds. This bounds the time lost when scanning systems with broken TCP/IP implementations that do not send RESETs when contacted at a dead port. The udp scanner already has a built-in mechanism to detect dead hosts.

-u  Report probes that fail with "Host unreachable". Use this with packet filters that pass most traffic.

-U  Report probes that do not fail with "Host unreachable". Use this with packet filters that block most traffic.

-w time (tcp_scan only)
    Wait for at most time seconds for banner information.

WARNING
These programs will raise lots of alarms on sites that run the tcp wrapper or other network logging software. Use only with prior permission.

BUGS
The UDP port scanner relies on ICMP replies to detect that a service is unavailable, and may report false positives when the host or network dies in the middle of a measurement.

The TCP port scanner does not keep track of roundtrip times or of retransmissions, and may overload hosts or networks.

With some UNIX implementations, a single "Host unreachable" condition affects all connections that are being established with that host.

With some UNIX implementations, a single "Host unreachable" condition affects all TCP connections to that host, even those that already exist.

AUTHOR
Wietse Venema