Nmap is an old and "grown" software package. It's better to start to read the excellent documentation and then the source instead the other way around.
Just to give you an glimpse on the mish mash nmaps internals are see this quote from the Phrack Articke above:
Prior to writing nmap, I spent a lot of time with other scanners exploring the Internet and various private networks (note the avoidance of the "intranet" buzzword). I have used many of the top scanners available today, including strobe by Julian Assange, netcat by Hobbit, stcp by Uriel Maimon, pscan by Pluvius, ident-scan by Dave Goldsmith, and the SATAN tcp/udp scanners by Wietse Venema. These are all excellent scanners! In fact, I ended up hacking most of them to support the best features of the others. Finally I decided to write a whole new scanner, rather than rely on hacked versions of a dozen different scanners in my /usr/local/sbin. While I wrote all the code, nmap uses a lot of good ideas from its predecessors. I also incorporated some new stuff like fragmentation scanning and options that were on my "wish list" for other scanners.
(Disclaimer: haven't checked nmap's internals for a few years. Somebody might have cleaned up the code in between, but i consider it unlikely.
Your best bet now is to use the python nmap library. It gives the best look at what's under the hood and you get to learn python as well.
An even better option if you are willing is to build your own in ruby. It really isn't that hard to do and you have more control on what is going on. Scapy is pretty good to learn as well. If you pull up wireshark with any of these while you are doing your scanning you will gain a much better understand on how everything works.
发布评论
评论（2）
Nmap 是一个古老且“成熟”的软件包。最好先阅读优秀的文档，然后再阅读源代码，而不是相反。
我建议 Phrack 51 - 端口扫描的艺术 和 略有更新的版本作为仍然相关的入门读物。
只是为了让您了解 mish mash nmaps 的内部结构，请参阅上面 Phrack Articke 中的这段引用：
（免责声明：已经有几年没有检查过 nmap 的内部结构了。有人可能清理了中间的代码，但我认为这不太可能。
Nmap is an old and "grown" software package. It's better to start to read the excellent documentation and then the source instead the other way around.
I suggest Phrack 51 - The Art of Port Scanning and the slightly updated version as a still relevant primer.
Just to give you an glimpse on the mish mash nmaps internals are see this quote from the Phrack Articke above:
(Disclaimer: haven't checked nmap's internals for a few years. Somebody might have cleaned up the code in between, but i consider it unlikely.
现在最好的选择是使用 python nmap 库。它可以最好地了解底层内容，并且您还可以学习 Python。
如果您愿意，更好的选择是 用 ruby 构建您自己的。这确实并不难做到，而且您可以更好地控制正在发生的事情。 Scapy 也很好学。如果您在扫描时使用其中任何一个启动wireshark，您将更好地了解一切是如何进行的作品。
Your best bet now is to use the python nmap library. It gives the best look at what's under the hood and you get to learn python as well.
An even better option if you are willing is to build your own in ruby. It really isn't that hard to do and you have more control on what is going on. Scapy is pretty good to learn as well. If you pull up wireshark with any of these while you are doing your scanning you will gain a much better understand on how everything works.