I was reading the nmap source code because I’d like to find out how does it discover that certain ports are filtered or firewalled. I have some experience with sockets in c and i’ve built simple port scanners, that’s easy – if the connection succeeds, the port is open, otherwise it’s closed (because of the RST returned). But in case with the firewalled ports, they don’t return RST packet back, and my port scanner just “waits” forever.
If someone’s got experience with this topic, please point me to the parts of the nmap code where the actual scanning and port-state determination occurs, or at least tell me if there are any other codes available which deal with this problem.
Use asynchronous socket API calls (i.e. don’t wait for the connection to be established, and instead try the next port/address in parallel) and define a reasonable timeout (e.g. if the connection isn’t established after a minute you can consider it filtered).