Build Your Own Port Scanner in Python (and Understand How Nmap Thinks)

Lorenzo Fazioli — Fri, 18 Sep 2026 15:39:09 +0000

Why write one when Nmap exists?

Because using a tool and understanding a tool are different skills. When you write the scan loop yourself, you feel why a full connect scan is loud, why timeouts dominate your runtime, and why threading matters. That intuition transfers directly to reading Nmap output later.

The naive version

Start with the simplest thing that works: a socket, a connect call, and a loop.

import socket

def scan(host, ports):

    for port in ports:

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

        s.settimeout(0.5)

        if s.connect_ex((host, port)) == 0:

            print(f"[+] {port}/tcp open")

        s.close()

scan("127.0.0.1", range(1, 1025))

connect_ex is the key: it returns an error code instead of raising, so a closed port is just a non-zero return, not an exception to catch.

Why it’s painfully slow

Run it against 1024 ports and you’ll wait. Each closed port burns the full timeout serially. Scanning 1024 ports at 0.5s each is over eight minutes in the worst case — for one host.

Making it threaded

Network scanning is I/O bound, so threads help enormously here despite the GIL.

from concurrent.futures import ThreadPoolExecutor

def check(host, port):

    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:

        s.settimeout(0.5)

        if s.connect_ex((host, port)) == 0:

            return port

def scan(host, ports, workers=200):

    with ThreadPoolExecutor(max_workers=workers) as pool:

        results = pool.map(lambda p: check(host, p), ports)

    return [p for p in results if p]

Suddenly 1024 ports finish in seconds.

Where to go next

Grab banners: after connecting, send a probe and read the first bytes to fingerprint the service.
Add a SYN scan with raw sockets (requires root) to avoid completing the handshake.
Rate-limit yourself so you don’t trip IDS on networks you’re allowed to test.

One rule before you run it

Only scan hosts you own or have written permission to test. A port scan against someone else’s infrastructure can be illegal in most jurisdictions, full stop.

If you want the finished version, my Portscanner repo is on GitHub.

Published via ZyVOP — Write once in Markdown, auto-backup to GitHub, and syndicate to Dev.to, Medium & Hashnode in 1 click.

Beyond Passwords: A Practical Guide to Passkeys in 2026

Lorenzo Fazioli — Fri, 18 Sep 2026 14:22:15 +0000

Passwords are the weakest link in almost every breach. They get reused, phished, and dumped in leaks. Passkeys fix the root cause: there is no shared secret to steal.

What a passkey actually is

A passkey is a public/private key pair created for a specific site. Your device keeps the private key and never sends it anywhere. The site only stores the public key. When you log in, your device signs a challenge — proof you hold the private key — without transmitting anything a phisher could reuse.

That single design choice removes the two biggest attack classes at once:

Phishing — a fake site can’t collect a secret that never leaves your device.
Credential stuffing — there’s no password database to leak and replay.

Why this matters more than “a stronger password”

A 20-character password in a password manager is good. It still travels over the wire, still lands in a server-side hash, and still gets phished if you’re tricked into typing it on a lookalike domain. A passkey is bound to the real origin by the browser, so it simply won’t fire on ‎paypa1.com.

How to start today

Turn on passkeys for your most-used accounts first: Google, Apple, GitHub, Microsoft.
Store them in a cross-device manager (iCloud Keychain, Google Password Manager, 1Password, Bitwarden) so a lost phone isn’t a lockout.
Keep one backup method — a security key or recovery codes stored offline.

For developers

If you build auth, look at the WebAuthn API and the passkeys spec ↗ (https://passkeys.dev). Most stacks now have a library that handles registration and assertion in a few dozen lines. Offer passkeys alongside passwords first, then nudge users to upgrade.

The endgame isn’t “harder to guess.” It’s “nothing worth stealing.” Passkeys get us there.

DEV Community: Lorenzo Fazioli

Build Your Own Port Scanner in Python (and Understand How Nmap Thinks)

Beyond Passwords: A Practical Guide to Passkeys in 2026