##########################new_syn_scan_one_port###############################
#!/usr/bin/python3.4
# -*- coding=utf-8 -*-
import sys
from io import StringIO
import logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
import re
from scapy.all import *

def new_syn_scan_one_port(hostname,port):

    result_raw = sr(IP(dst=hostname)/TCP(dport=port,flags="S"), verbose = False)
	
	#result_raw:类型为元组(<Results: TCP:1 UDP:0 ICMP:0 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>)
	#result_raw[0]:类型为 class 'scapy.plist.SndRcvList'
	#class 'scapy.plist.SndRcvList'可以使用的方法有

	#print(result_raw[0].stats)
	#[<class 'scapy.layers.inet.TCP'>, <class 'scapy.layers.inet.UDP'>, <class 'scapy.layers.inet.ICMP'>]
	#print(result_raw[0].res)
	#[(<IP  frag=0 proto=tcp dst=202.100.1.200 |<TCP  dport=epmap flags=A |>>, <IP  version=4 ihl=5 tos=0x0 len=40 id=184 flags= frag=0 ttl=128 proto=tcp chksum=0xa1fd src=202.100.1.200 dst=202.100.1.138 options=[] |<TCP  sport=epmap dport=ftp_data seq=0 ack=0 dataofs=5 reserved=0 flags=R window=0 chksum=0x172b urgptr=0 |<Padding  load='\x00\x00\x00\x00\x00\x00' |>>>), (<IP  frag=0 proto=tcp dst=202.100.1.200 |<TCP  dport=netbios_ssn flags=A |>>, <IP  version=4 ihl=5 tos=0x0 len=40 id=185 flags= frag=0 ttl=128 proto=tcp chksum=0xa1fc src=202.100.1.200 dst=202.100.1.138 options=[] |<TCP  sport=netbios_ssn dport=ftp_data seq=0 ack=0 dataofs=5 reserved=0 flags=R window=0 chksum=0x1727 urgptr=0 |<Padding  load='\x00\x00\x00\x00\x00\x00' |>>>)]
	#print(result_raw[0].listname)
	#Results
	result_list = result_raw[0].res #类型为清单
	#[0]代表收到的响应（有发有收），[1]代表未收到的响应（有发无收）
	#ipfields = result_list[0][1][0].fields
	#第一层[0]代表第一组收发的数据包 [1]代表第二组收发的数据包 ....
	#第二层[0]代表收到的包， [1]代表发送的包
	#第三层[0]为class 'scapy.layers.inet.IP' [1]为class 'scapy.layers.inet.TCP'
	#fields传进去的是字典
	#class 'scapy.layers.inet.IP'字典为:
	#{'options': [], 'src': '202.100.1.200', 'len': 40, 'chksum': 41426, 'frag': 0, 'proto': 6, 'dst': '202.100.1.138', 'ttl': 128, 'flags': 0, 'tos': 0, 'ihl': 5, 'version': 4, 'id': 227}
	#class 'scapy.layers.inet.TCP'字典为:
	#{'dport': 20, 'seq': 0, 'dataofs': 5, 'flags': 4, 'ack': 0, 'chksum': 5931, 'window': 0, 'reserved': 0, 'sport': 135, 'urgptr': 0}
	#print(ipfields['dst'])
	#202.100.1.138
	tcpfields = result_list[0][1][1].fields #类型为清单
	if tcpfields['flags'] == 18:# SA (ack:16, push:8, Reset:4, SYN:2, FIN:1)
		os._exit(3)
	#20 RA (ack:16, push:8, Reset:4, SYN:2, FIN:1)

if __name__ == '__main__':
	new_syn_scan_one_port('202.100.1.200',135)
    
===============================new_scapy_syn_scan###############################
#!/usr/bin/python3.4
# -*- coding=utf-8 -*-
import logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
import re
import time
import multiprocessing
from new_syn_scan_one_port import new_syn_scan_one_port
from scapy.all import *
def scapy_syn_scan(host,port_low,port_high):
    processes = []
	ports = []
	port_l = int(port_low)
	port_h = int(port_high) + 1
	for port in range(port_l,port_h):
		syn_one = multiprocessing.Process(target=new_syn_scan_one_port, args=(host, port))
		#print('Started ' + str(port) + '  Scan!!!')
		syn_one.start()
		processes.append(syn_one)
		ports.append(port)

	#print(processes)
	#print(ports)
	port_no = 0
	time.sleep(3)
	for process in processes:
		if process.exitcode == 3:
			print('Host: ' + host + '  Port:' + str(ports[port_no]) + '  is Open!!!')
		else:
			process.terminate()
		port_no = port_no + 1

if __name__ == '__main__':
	host = input('请你输入扫描主机的IP地址: ')
	port_low = input('请你输入扫描端口的最低端口号: ')
	port_high = input('请你输入扫描端口的最高端口号: ')
	scapy_syn_scan(host,port_low,port_high)
	#scapy_syn_scan('202.100.1.200',135,140)

#####################运行效果###############################
[root@Fedora python]# ./new_scapy_syn_scan.py 
请你输入扫描主机的IP地址: 202.100.1.200
请你输入扫描端口的最低端口号: 135
请你输入扫描端口的最高端口号: 445
Host: 202.100.1.200  Port:135  is Open!!!
Host: 202.100.1.200  Port:139  is Open!!!
Host: 202.100.1.200  Port:445  is Open!!!