Ever wanted to know exactly which ports a machine has open, without reaching for someone else’s prebuilt scanner? A python port scanner is a genuinely achievable second project once you’ve written your first recon script, and building your own teaches you more about what scanners actually do than running one ever will. This post builds it from scratch, line by line.
Quick answer: A python port scanner works by attempting a connection to a range of ports on a target, one at a time, and recording which ones successfully connect. Python’s built-in socket library handles the entire connection attempt, so no external packages are even required.
A machine has 65,535 possible ports. It only takes one open, unexpected one to matter, and the fastest way to find out which ones are open is to ask, politely, one at a time.
A Python Port Scanner, at a Glance
| Step | What Happens |
|---|---|
| 1. Open a socket | Create a connection object for one target port. |
| 2. Attempt the connection | connect_ex() tries to connect and returns 0 on success. |
| 3. Record the result | Print or log the port if it’s open. |
| 4. Close and repeat | Close the socket, move to the next port in range. |
Why build one when nmap already exists
nmap is faster, more capable, and better in almost every practical way. So why build a python port scanner at all? Because writing your own, even a simple one, forces you to understand what a port scan actually is instead of just trusting a tool’s output. That understanding pays off every time you read someone else’s scan results afterward.
Quick tip
Only ever scan machines you own or have explicit written authorization to test. Port scanning unauthorized targets can cross legal lines even when no actual exploitation happens.
The core idea behind every port scanner
A port scan is really just this: try to open a connection to a specific port, and see what happens. If the connection succeeds, something is listening there. If it fails or times out, nothing is, at least not accepting connections on that port right now. Every port scanner, from the simplest script to nmap itself, builds on that same basic idea.
Bottom line: a port scanner is just a connection attempt, repeated, with the results written down.
Writing the Python Port Scanner
Here’s a working python port scanner in under fifteen lines:
import socket
target = "127.0.0.1"
ports = range(20, 1025)
for port in ports:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(0.5)
result = sock.connect_ex((target, port))
if result == 0:
print(f"Port {port} is open")
sock.close()Run it against 127.0.0.1 (your own machine) first, and compare the results against what the ss -tulpn command from the Linux networking post already showed you was listening.
Quick trick
Keep target = "127.0.0.1" while you’re learning. Testing against your own machine first means every result is something you can independently verify was correct.
Reading it line by line
socket.socket(...) creates a new network connection object, and AF_INET/SOCK_STREAM just specify “a normal internet connection over TCP.” sock.settimeout(0.5) caps how long the script waits on each port before giving up. Without it, a single unresponsive port could stall the entire scan for much longer than necessary.
connect_ex() attempts the actual connection and returns 0 specifically when it succeeds. Everything else in the script exists to loop that single attempt across a whole range of ports and report back only the ones that worked.
Quick tip
Change ports = range(20, 1025) to a narrower range, like range(1, 100), while you’re still testing. A smaller range finishes almost instantly, which makes debugging far less painful.
Bottom line: every line in this script exists to answer one question, open or closed, for one port at a time.
5 Tips for Building (and Using) a Python Port Scanner Responsibly
Ready to take this further? These five habits separate a toy script from a genuinely useful tool.
- Get explicit written authorization first, always. Port scanning anything you don’t own or haven’t been authorized to test can cross legal lines, no exploitation required.
- Start with a tiny port range while debugging. A range of 10 to 20 ports finishes almost instantly and makes mistakes obvious fast.
- Cross-check results against a trusted tool. Run
nmaporss -tulpnagainst the same target and compare. Any mismatch usually points to a bug in your script, not a secret port nmap missed. - Log results to a file instead of only printing them. A saved, timestamped scan lets you diff today’s results against last week’s, which is often more useful than any single scan alone.
- Respect rate limits, even on your own network. A scanner firing connection attempts as fast as possible can look identical to a denial-of-service attempt to some services and security tools.
Frequently Asked Questions
Still have questions? Here’s what comes up most when people first build one of these.
Is writing my own python port scanner worth it if nmap exists?
Yes, specifically for the learning value. Understanding how a scan actually works makes reading any tool’s output afterward much clearer.
Why does the script need a timeout?
Without one, a single slow or unresponsive port could make the whole script hang far longer than necessary, instead of moving on to the next port.
Can this script scan a range of IP addresses, not just one?
Not as written, but it’s a natural next step: wrap the current loop in another loop that iterates over a list of target IPs.
Is this scanner as fast as nmap?
No, and it’s not meant to be. A hand-built scanner is for understanding the mechanism, not replacing a mature, heavily optimized tool.
Python Port Scanner: From One Open Port to a Real Recon Habit
That’s a working python port scanner, built from a single idea repeated across a range of numbers. Try, check, record. It won’t replace nmap on a real engagement, and it isn’t supposed to. What it does instead is make every scan result you read from now on make genuine sense, because you’ve already built the thing yourself, line by line.
If you’re putting scripts like this together and want someone to sanity-check your approach before you point it at a real bug bounty target, that’s exactly the kind of bug bounty mentoring mylinuxtips.com offers. Reach out through the site’s contact page if a second pair of eyes on your recon tooling would help.