Why Scans Happen: Hosts, Ports, Timeouts

Networks hide work behind addresses and port numbers. A host may be up and still offer nothing you care about. A host may be down and still have a name in DNS. Defenders and authorized testers invent host discovery because they need to know which addresses in a contracted range actually respond. They invent port discovery because a live host is not the same as “SSH is listening.” Those jobs are real on an assessment with Rules of Engagement that name the range, the hours, and the excluded printers. They are also real on a box you own: you may want to know whether YOUR python -m http.server actually bound 8000. They are not real as homework on a café /24, a campus library Wi-Fi, a neighbor’s printer, or “whatever ARP showed me.” Discovery without a named owner is just unauthorized probing with a friendlier noun.

Hold the mechanism in one breath. You pick a destination IP that you are allowed to touch. You pick a small list of ports. For each pair you ask the TCP stack to try a connection, wait a short timeout, and tell you whether the handshake completed. That is host-plus-port discovery at beginner level — not a stealth kit, not a ping-sweep of 65,000 addresses, not nmap of the internet. The “why” is bookkeeping: so you can write “127.0.0.1:8000 OPEN because I started a server” or “127.0.0.1:22 closed_or_filtered because I do not run SSH.” The “why not” is legal: many jurisdictions treat uninvited port scans as unauthorized access or as evidence of attempted intrusion. “I was practicing CEH” is not a defense. This course is not official CEH training and will not pretend it is.

cat >> "$NOTES" << 'EOF'
host_question: is this name/address a machine I may touch?
port_question: is something listening on this TCP port?
not_a_license: cafe /24, campus, neighbor gateway
EOF

Python’s socket.connect_ex((host, port)) returns 0 when the TCP handshake completed from this process’s point of view. Any other return is “not open in this wait window”: the peer refused, nothing answered before settimeout fired, or the stack gave another error. settimeout is the politeness and the safety rail. On loopback, half a second is generous. A hang means you forgot the timeout, not that you should move HOST to the café to “get a faster RST.” A timeout on 127.0.0.1:443 usually means nothing on this machine accepted 443 in time — write closed_or_filtered and continue the tiny list. It does not mean the lab failed. It does not mean you must find an open door elsewhere to earn XP.

The question is always aimed. connect_ex does not check a get-out-of-jail card. It does not read your RoE file. Skill does not create consent. If HOST is 127.0.0.1 on a computer you control, you are asking a listener on that same OS (or a VM NIC you own, if a later lesson with writing says so). If HOST is the café gateway, you are asking someone else’s device whether it will complete a handshake with you — and you are doing it without their contract. One attempt is already a probe. A loop of attempts is a scan. This lesson’s code will refuse any host other than 127.0.0.1 so a paste error cannot become a /24. If you own a VM and someday have a separate, dated RoE that names that VM’s address, that is a different document on a different day. Not this script. Not tonight’s coffee shop.

People argue about whether a single ping is a scan. Do not hide in that argument. This course’s wording is practical: one connect to a host you own is a check. Repeating that check across a list of ports on that same allowed host is a beginner port scan — still a lab if HOST is locked. Repeating it across a list of hosts you do not own is a network scan of someone else’s space. IDS and café operators do not grade your intent. They see a source address knocking on many doors. Module 1 already said covering tracks is a defender visibility problem, not a wipe tutorial. Here the visibility is the scan itself: logs may show your MAC or your DHCP lease knocking 22, 80, 443, 8000 in a tight burst. On loopback, those logs are yours. On campus, they are evidence.

Timeouts shape how the burst looks, but they do not legalize it. A slow loop against a /24 is still a /24 scan. A fast loop against 127.0.0.1 is still only your box. Do not “space the packets to look like browsing” on a network you were not invited to test — that sentence is already an evasion idea, and Lesson 2 will refuse to turn it into a playbook. The skill in this lesson is naming the loop honestly in notes: “I sent N connect_ex calls to 127.0.0.1 on this port list with this timeout.” Honesty is how you prove scope later. Trophy screenshots of foreign IPs are how you prove the opposite.

Walk into a shop, join Wi-Fi, and run a scanner at 192.168.x.0/24. You did not get RoE from the shop, the ISP, or the people whose phones just associated. You sent many probes across a broadcast domain you do not administer. Calling it a lab does not move the permission switch. The same is true of a campus library, a dorm switch, a hotel, an airport, and “the guest VLAN at work.” Student ID is not a pentest charter. Cyberlium XP is not a voucher. Original teaching mapped to a CEH v13 domain is not official EC-Council authorization to touch those nets. If a classmate says “everyone in the cert course scans the building,” that classmate is not this course. Refuse. Stay on loopback. Write the refusal in the notes so you remember why the empty OPEN column is still a pass.

Home-lab edge: other devices on a house network you pay for are still not automatically yours. A roommate’s laptop, a guest phone, and an ISP-owned ONT are different owners. Get explicit written consent or stay on 127.0.0.1 and on VMs whose disks you created. Pinging the home router you administer is a separate, smaller question — and even then this lesson’s Python will not aim there. Hardcoding loopback is how beginners avoid “just this once.” If every port on loopback is closed, that is a complete teaching outcome: you now know how a scan reports absence. Lesson 4 will optionally start http.server on 127.0.0.1:8000 so you can see one OPEN you caused. Do not skip ahead by hunting an OPEN on the LAN.

On a computer you own, create cyberlium-lab if needed. Run the script unchanged. Fill scan-why-notes.txt with definitions in your own words: what a scan is (many attempts), why host/port discovery exists, why a timeout is not a hunting license, and the ethics line. Closed ports are valid. Do not add a LAN IP. chmod 600. Windows without chmod: WSL or Git Bash, or restrict the files in your profile. PowerShell can Test-NetConnection 127.0.0.1 -Port 8000 as a single-port check — still loopback only.

You now hold the reason scans exist (authorized bookkeeping of hosts and doors) and the reason they become crimes (the same loop aimed at people who did not invite you). connect_ex and timeout are one question. A tiny list on 127.0.0.1 is a lab. A /24 at a café or campus is not. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to a CEH v13 domain — not official EC-Council training, not a cert, not exam dumps. Next — Connect Scans vs Stealth Ideas — names a completed handshake versus a half-open idea so you can read defender logs, not so you can hide from a SOC on café Wi-Fi.