In the previous part of this guide, we saw what raw sockets actually are and how to use them to build something useful(i.e. a tcpdump clone). In the last part of this guide, we will extend our knowledge about raw sockets by writing a simple TCP SYN port scanner. Before getting into the actual code, let us understand how does a port scanner work and what are the main techniques to perform port scanning.
In the previous part of this tutorial, we discussed what TCP sockets actually are and how to use them on Linux systems. Now we are ready to introduce a new concept of network programming: raw sockets. Raw sockets When you declare a new socket using socket()s Linux API, you are in fact delegating the kernel to take care of all the details about encoding and decoding the headers of your packages.
In this series of tutorials, I will try to explain how socket programming works under UNIX operating systems(focusing on Linux) and eventually, how to use them to create network-based programs, such as a port scanner. In fact, being able to create a (SYN)port scanner is the final scope of this guide. To fully comprehend this tutorial, you should have a good knowledge of system programming in C, some knowledge of GNU/Linux systems(or any UNIX-like OS of your choice) and some knowledge of the TCP/IP stack.