Check if tcp port is open using scapy

The simple way to scan the open port
sudo nmap -sS -O 192.168.0.1

The following python script  checks if a port is open using scapy .

import logging
import sys
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
from scapy.all import *
dst_ip = "192.168.0.1"
src_port = 400
dst_port=80
 
tcp_connect_scan_resp = sr1(IP(dst=dst_ip)/TCP(sport=src_port,dport=dst_port,flags="S"),timeout=3)
if(tcp_connect_scan_resp is None):
    print ("The port is Closed")
    sys.exit()
     
print ("The flags:" + str (tcp_connect_scan_resp.getlayer(TCP).flags))    
    
if(tcp_connect_scan_resp.haslayer(TCP)):
    if(tcp_connect_scan_resp.getlayer(TCP).flags == 0x12):
        #send_rst = sr(IP(dst=dst_ip)/TCP(sport=src_port,dport=dst_port,flags="AR"),timeout=3)
        print ("The port is Open")
        sys.exit ();
            
#(tcp_connect_scan_resp.getlayer(TCP).flags == 0x14):
print ("The port is Closed ")

notes:
Currently scapy supports only Python 2.7 .
Needed sudo privilege in order to execute script with scapy .

The results:
zvika@ubuntu:~/myStaff/myCode$ sudo python PortsScan.py
Begin emission:
..Finished to send 1 packets.
*
Received 3 packets, got 1 answers, remaining 0 packets
The flags:18
The port is Open

The code is based on :
http://resources.infosecinstitute.com/port-scanning-using-scapy/

Other good references : 
http://theitgeekchronicles.files.wordpress.com/2012/05/scapyguide1.pdf
http://thesprawl.org/research/scapy/
http://thepacketgeek.com/scapy-p-06-sending-and-receiving-with-scapy/

Simple netfilter module

The following is a simple linux kernel module that demonstrates the use of netfilters .
The module code :

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
static struct nf_hook_ops nfho;        
static int mPacketNo = 0 ;
unsigned int hook_func(unsigned int hooknum, struct sk_buff **skb, const struct net_device *in,
const struct net_device *out, int (*okfn)(struct sk_buff *))
{
    mPacketNo++;
    printk(KERN_INFO "packet (%d) Arrived \n" , mPacketNo);                             
    return NF_ACCEPT;                                                                   
}
int init_module()
{
  nfho.owner          = THIS_MODULE;
  nfho.hook = hook_func;                      
  //After promisc drops, checksum checks 
  nfho.hooknum = 0;                            
  //IPV4 packets
  nfho.pf = PF_INET;                           
  //set to highest priority over all other hook functions
  nfho.priority = NF_IP_PRI_FIRST;             
  nf_register_hook(&nfho);                     
  return 0;                                    
}
void cleanup_module()
{
  nf_unregister_hook(&nfho);                     
}

The make file

obj-m := TestNetFilter.o 
KDIR  := /lib/modules/$(shell uname -r)/build
PWD   := $(shell pwd)
default:
    $(MAKE) -C $(KDIR) M=$(PWD) modules

After building the module using the make command install the module using
sudo insmod TestNetFilter.ko
Surf the web
And check the log using
dmesg
The result :
.
.
.
[ 6982.485399] packet (263) Arrived 
[ 6983.007097] packet (264) Arrived 
[ 6983.105030] packet (265) Arrived 
[ 6983.238858] packet (266) Arrived 
[ 6983.306514] packet (267) Arrived 
[ 6984.058800] packet (268) Arrived 
.
.
.

References
http://www.paulkiddie.com/2009/10/creating-a-simple-hello-world-netfilter-module/
http://www.linuxjournal.com/article/7184