> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/reconnaissance/network-manual-scan.md).

# 手动网络扫描

{% hint style="info" %}
本文档详细介绍了不使用 Nmap 等自动化工具的手动网络扫描技术。你将学习使用简单而有效的命令（如 `/dev/tcp`, `ping`, `netcat`等）来识别活动主机、检查开放端口并诊断网络上的服务。非常适合理解网络诊断基础，并根据你的需求定制你的分析。
{% endhint %}

## 特定端口（HTTP - 80端口）

```bash
echo '' > /dev/tcp/192.168.1.1/80 && echo "[+] HTTP 已开放" || echo "[-] HTTP 已关闭"
```

## 多个端口（SSH、HTTP、HTTPS）

用于测试端口列表的简单命令：

```bash
for port in 22 80 443; do
  echo '' > /dev/tcp/192.168.1.1/$port && echo "[+] 端口 $port 已开放" || echo "[-] 端口 $port 已关闭"
done
```

## IP 列表和单个端口

要检查某个端口（例如 22）是否在多个 IP 上开放：

```bash
for ip in 192.168.1.1 192.168.1.2 192.168.1.3; do
  echo '' > /dev/tcp/$ip/22 && echo "[+] $ip 上的 SSH 已开放" || echo "[-] $ip 上的 SSH 已关闭"
done
```

## 扫描端口范围的循环

要扫描一台机器在指定范围内的端口：

```bash
for port in {20..30}; do
  echo '' > /dev/tcp/192.168.1.1/$port && echo "[+] 端口 $port 已开放" || echo "[-] 端口 $port 已关闭"
done
```

## 多个 IP 和端口上的服务

要测试一组 IP 和多个端口：

```bash
for ip in 192.168.1.1 192.168.1.2; do
  for port in 80 443 8080; do
    echo '' > /dev/tcp/$ip/$port && echo "[+] $ip:$port 已开放" || echo "[-] $ip:$port 已关闭"
  done
done
```

## 用于诊断网络的高级脚本

创建一个小脚本来扫描目标上的端口并将结果保存到文件：

```bash
#!/bin/bash

target="192.168.1.1"
output="scan_results.txt"

echo "正在扫描 $target..." > $output
for port in {1..1024}; do
  if echo '' > /dev/tcp/$target/$port 2>/dev/null; then
    echo "[+] 端口 $port 已开放" | tee -a $output
  else
    echo "[-] 端口 $port 已关闭" >> $output
  fi
done
echo "扫描完成。结果已保存到 $output。"
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/reconnaissance/network-manual-scan.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.