Building a Simple Nonconcurrent TCP Port Scanner in F#

Port scanning is one of the most fundamental techniques in networking and security. Before diving into high-performance concurrent scanners, it's useful to understand how a basic scanner works by checking one port at a time.

In this article, we'll build the foundation of a nonconcurrent TCP port scanner using F#.

---

What Is a Port Scanner?

A port scanner attempts to connect to ports on a target system and determines whether those ports are:

State	Meaning
Open	A service is listening and accepts connections
Closed	No service is listening
Filtered	Traffic is blocked by a firewall or filtering device

TCP ports range from:

1 - 65535

For demonstration purposes, we'll scan only:

1 - 1024

These are commonly known as the well-known ports.

---

Step 1: Generate Target Addresses

Before attempting any network connections, we need a way to generate:

hostname:port

combinations.

In F#, a simple loop can accomplish this.

open System

for i in 1 .. 1024 do
    let address = sprintf "scanme.nmap.org:%d" i
    printfn "%s" address

Example output:

scanme.nmap.org:1
scanme.nmap.org:2
scanme.nmap.org:3
...
scanme.nmap.org:1024

---

Understanding sprintf

The sprintf function formats strings similarly to C's printf.

let address = sprintf "scanme.nmap.org:%d" i

Here:

Component	Purpose
%d	Integer placeholder
i	Current port number
sprintf	Returns a formatted string

For port 80, the generated string becomes:

scanme.nmap.org:80

---

Step 2: Attempt a TCP Connection

A TCP scanner determines whether a port is open by trying to establish a connection.

Conceptually:

Connect to target port
    |
    +-- Success -> Open
    |
    +-- Error -> Closed/Filtered

In .NET, this is typically done using:

System.Net.Sockets.TcpClient

Minimal example:

let client = new System.Net.Sockets.TcpClient()

If the connection succeeds, the port is likely open.

---

Step 3: Always Close Connections

A successful connection consumes operating system resources.

Good network citizenship requires closing connections immediately after testing.

Conceptually:

client.Close()

Benefits:

• Releases socket resources
• Prevents connection leaks
• Reduces system overhead
• Mimics professional scanner behavior

---

Scanner Workflow

The complete nonconcurrent scanning algorithm is straightforward:

for each port
    generate address
    attempt TCP connection

    if success
        print OPEN
        close connection

    else
        continue

---

Why Is It Called Nonconcurrent?

Only one port is tested at a time.

Port 1  -> wait
Port 2  -> wait
Port 3  -> wait
...
Port 1024

Advantages:

• Easy to understand
• Easy to debug
• Minimal code complexity

Disadvantages:

• Slow
• Network latency accumulates
• Does not scale to large scans

Modern scanners solve this using:

• Threads
• Async I/O
• Tasks
• Event-driven networking

---

Educational Value

Even though professional scanners use concurrency, a nonconcurrent scanner teaches several important networking concepts:

• TCP connection establishment
• Socket programming
• Port states
• Error handling
• Resource management
• Network reconnaissance fundamentals

Understanding this sequential model makes it much easier to appreciate how high-performance scanners achieve their speed.

---

Key Takeaways

• TCP scanners determine port availability by attempting connections.
• A loop can generate target addresses for thousands of ports.
• sprintf provides convenient address formatting in F#.
• Successful connections should always be closed.
• Nonconcurrent scanners are simple but relatively slow.
• This approach forms the foundation for advanced concurrent port scanners.

---

A nonconcurrent scanner may not be the fastest tool in a security engineer's toolkit, but it provides an excellent introduction to how network discovery and TCP-based reconnaissance actually work under the hood.