feat(scanner): add subnet ping scan and TCP port scans for alive hosts

Introduce subnet scanning using CIDR prefix notation and perform TCP port scans
on each discovered alive host. The change replaces the full port scan with a
two-step process: first pinging the subnet to find active devices, then scanning
their open TCP ports.

src/cli/packet_sniffer_cli.cpp

@@ -1,30 +0,0 @@
-#include "packet_sniffer_cli.hpp"
-#include <boost/program_options/value_semantic.hpp>
-
-PacketSnifferCli::PacketSnifferCli()
-    : CliBase("Packet Sniffer Options")
-    , ip_("")
-{
-}
-
-void PacketSnifferCli::setupOptions()
-{
-    // clang-format off
-    desc_.add_options()
-        ("help,h",  "Show help")
-        ("ip,H",    withDefault(ip_, "<IP>"), "Local IPv4 to sniff (e.g. 192.168.1.42)")
-        ("mask,m",  boost::program_options::value<bool>()->default_value(false)->implicit_value(true),
-                    "Mask IP addresses in output (demo)");
-    // clang-format on
-}
-
-std::string PacketSnifferCli::getIp() const
-{
-    return vm_.at("ip").as<std::string>();
-}
-
-bool PacketSnifferCli::isMaskEnabled() const
-{
-    const auto it = vm_.find("mask");
-    return (it != vm_.end()) ? it->second.as<bool>() : false;
-}

src/cli/packet_sniffer_cli.hpp

@@ -1,19 +0,0 @@
-#pragma once
-#include "cli_base.hpp"
-#include "option_utils.hpp"
-#include <string>
-
-class PacketSnifferCli : public CliBase, protected OptionUtils
-{
-  public:
-    PacketSnifferCli();
-
-    std::string getIp() const;
-    bool isMaskEnabled() const;
-
-  protected:
-    void setupOptions() override;
-
-  private:
-    std::string ip_;
-};

src/cli/portscan_cli.cpp

@@ -0,0 +1,28 @@
+#include "portscan_cli.hpp"
+#include <boost/program_options/value_semantic.hpp>
+#include <cassert>
+
+PortScanCli::PortScanCli()
+    : CliBase("Port Scanner Options")
+{
+}
+
+void PortScanCli::setupOptions()
+{
+    // clang-format off
+    desc_.add_options()
+        ("help,h",      "Show help")
+        ("ip,H",        withDefault(ip_, "<IPv4>"),      "Base IPv4 inside your LAN (e.g. 10.0.1.42)")
+        ("prefix,p",    withDefault(prefix_, "<0..32>"), "CIDR prefix length (e.g. 24)");
+    // clang-format on
+}
+
+int PortScanCli::getPrefix() const
+{
+    return vm_.at("prefix").as<int>();
+}
+
+std::string PortScanCli::getBaseIp() const
+{
+    return vm_.at("ip").as<std::string>();
+}

src/cli/portscan_cli.hpp

@@ -0,0 +1,21 @@
+#pragma once
+
+#include "cli_base.hpp"
+#include "option_utils.hpp"
+#include <string>
+
+class PortScanCli : public CliBase, protected OptionUtils
+{
+  public:
+    PortScanCli();
+
+    int getPrefix() const;
+    std::string getBaseIp() const;
+
+  protected:
+    void setupOptions() override;
+
+  private:
+    int prefix_{24};
+    std::string ip_{"10.0.1.0"};
+};

src/core/local_ping_scanner.cpp

@@ -0,0 +1,103 @@
+#include "local_ping_scanner.hpp"
+#include "logger.hpp"
+#include <Poco/Net/ICMPClient.h>
+#include <boost/asio/ip/address_v4.hpp>
+#include <stdexcept>
+
+LocalPingScanner::LocalPingScanner(
+    const std::string &baseIp, int prefixLen, int timeoutMs
+)
+    : baseIp_(baseIp)
+    , prefixLen_(prefixLen)
+    , timeoutMs_(timeoutMs)
+{
+    if (prefixLen_ < 0 || prefixLen_ > 32) {
+        Logger::error("Invalid prefix length in LocalPingScanner constructor");
+        throw std::runtime_error("Bad prefix length");
+    }
+    if (timeoutMs_ <= 0) {
+        timeoutMs_ = 2000;
+    }
+}
+
+const std::vector<std::string> &LocalPingScanner::alive() const
+{
+    return alive_;
+}
+
+uint32_t LocalPingScanner::ipToU32(const std::string &ip)
+{
+    using namespace boost::asio::ip;
+    return static_cast<uint32_t>(make_address_v4(ip).to_uint());
+}
+
+std::string LocalPingScanner::u32ToIp(uint32_t v)
+{
+    using namespace boost::asio::ip;
+    return address_v4(v).to_string();
+}
+
+bool LocalPingScanner::pingHost(const std::string &ip) const
+{
+    try {
+        return Poco::Net::ICMPClient::pingIPv4(
+                   ip,
+                   /*repeat=*/1,
+                   /*dataSize=*/48,
+                   /*ttl=*/64,
+                   /*timeout=*/timeoutMs_
+               )
+               > 0;
+    } catch (const std::exception &ex) {
+        Logger::error(
+            std::string("Ping failed for host ") + ip + ": " + ex.what()
+        );
+        return false;
+    } catch (...) {
+        Logger::fatal(std::string("Unknown error pinging host ") + ip);
+        return false;
+    }
+}
+
+void LocalPingScanner::runImpl()
+{
+    alive_.clear();
+
+    const uint32_t base = ipToU32(baseIp_);
+    const uint32_t mask =
+        (prefixLen_ == 0) ? 0u : (0xFFFFFFFFu << (32 - prefixLen_));
+    const uint32_t network = base & mask;
+    const uint32_t broadcast = network | (~mask);
+
+    // No hosts when prefix is too tight (e.g., /32).
+    if (broadcast - network <= 2) {
+        return;
+    }
+
+    const std::string selfIp = u32ToIp(base);
+
+    for (uint32_t v = network + 1; v < broadcast; ++v) {
+        const std::string ipStr = u32ToIp(v);
+
+        if (ipStr == selfIp) {
+            continue;
+        }
+
+        if (pingHost(ipStr)) {
+            alive_.push_back(ipStr);
+        }
+    }
+}
+
+void LocalPingScanner::run()
+{
+    try {
+        runImpl();
+    } catch (const std::exception &ex) {
+        Logger::error(
+            std::string("Exception in LocalPingScanner::run: ") + ex.what()
+        );
+    } catch (...) {
+        Logger::fatal("Unknown exception in LocalPingScanner::run");
+    }
+}

src/core/local_ping_scanner.hpp

@@ -0,0 +1,26 @@
+#pragma once
+#include <cstdint>
+#include <string>
+#include <vector>
+
+class LocalPingScanner
+{
+  public:
+    LocalPingScanner(
+        const std::string &baseIp, int prefixLen, int timeoutMs = 2000
+    );
+
+    void run(); // blocking scan over subnet
+    const std::vector<std::string> &alive() const;
+
+  private:
+    static std::string u32ToIp(uint32_t v);
+    static uint32_t ipToU32(const std::string &ip);
+    bool pingHost(const std::string &ip) const;
+    void runImpl();
+
+    std::string baseIp_;
+    int prefixLen_;
+    int timeoutMs_;
+    std::vector<std::string> alive_;
+};

src/core/port_scanner.cpp

@@ -0,0 +1,126 @@
+#include "port_scanner.hpp"
+#include "logger.hpp"
+#include <algorithm>
+
+PortScanner::PortScanner(std::string ip, int timeoutMs)
+    : ip_(std::move(ip))
+    , timeoutMs_(timeoutMs)
+{
+    if (timeoutMs_ <= 0) {
+        timeoutMs_ = 250;
+    }
+}
+
+PortScanner::Probe::Probe(IoContext &io, uint16_t p)
+    : port(p)
+    , socket(io)
+    , timer(io)
+{
+}
+
+const std::vector<uint16_t> &PortScanner::openPorts() const
+{
+    return openPorts_;
+}
+
+void PortScanner::run()
+{
+    openPorts_.clear();
+    nextPort_ = kFirstPort;
+    outstanding_ = 0;
+    active_.clear();
+
+    while (outstanding_ < kMaxConcurrency && nextPort_ <= kLastPort) {
+        startNext();
+    }
+
+    io_.run();
+}
+
+void PortScanner::startNext()
+{
+    if (nextPort_ > kLastPort) {
+        return;
+    }
+
+    const uint16_t port = static_cast<uint16_t>(nextPort_);
+    nextPort_ += 1;
+
+    startProbe(port);
+}
+
+void PortScanner::startProbe(uint16_t port)
+{
+    // Lifetime of Probe is managed in 'active_' until probe finishes.
+    auto prPtr = std::make_unique<Probe>(io_, port);
+    Probe *pr = prPtr.get();
+    active_.push_back(std::move(prPtr));
+
+    outstanding_ += 1;
+
+    {
+        using namespace boost::asio::ip;
+
+        TcpEndpoint ep(make_address_v4(ip_), port);
+
+        pr->timer.expires_after(std::chrono::milliseconds(timeoutMs_));
+
+        auto onTimer = [pr](const ErrorCode &ec) {
+            // Cancel socket on timeout; completion will run onConnect with
+            // ec=operation_aborted.
+            if (!ec) {
+                pr->socket.cancel();
+            }
+        };
+
+        auto onAsyncConnect = [this, pr](const ErrorCode &ec) {
+            onConnect(pr, ec);
+        };
+
+        pr->timer.async_wait(onTimer);
+        pr->socket.async_connect(ep, onAsyncConnect);
+    }
+}
+
+void PortScanner::onConnect(Probe *pr, const ErrorCode &ec)
+{
+    pr->timer.cancel();
+
+    // Open if connect succeeded; REFUSED means closed but host is alive.
+    if (!ec) {
+        openPorts_.push_back(pr->port);
+        Logger::info(std::string("Open port: ") + std::to_string(pr->port));
+    }
+
+    ErrorCode ignored;
+    pr->socket.close(ignored);
+
+    finishProbe(pr);
+}
+
+void PortScanner::finishProbe(Probe *pr)
+{
+    if (outstanding_ > 0) {
+        outstanding_ -= 1;
+    }
+
+    // Remove 'pr' from active_ (active_ size <= kMaxConcurrency, linear
+    // erase is fine).
+    auto it = std::find_if(
+        active_.begin(), active_.end(), [pr](const std::unique_ptr<Probe> &u) {
+            return u.get() == pr;
+        }
+    );
+    if (it != active_.end()) {
+        active_.erase(it);
+    }
+
+    if (nextPort_ <= kLastPort) {
+        startNext();
+    }
+
+    if (outstanding_ == 0 && nextPort_ > kLastPort) {
+        io_.stop();
+        return;
+    }
+}

src/core/port_scanner.hpp

@@ -0,0 +1,43 @@
+#pragma once
+#include "aliases.hpp"
+#include <cstdint>
+#include <memory>
+#include <string>
+#include <vector>
+
+class PortScanner
+{
+  public:
+    explicit PortScanner(std::string ip, int timeoutMs = 250);
+
+    void run(); // blocking scan
+    const std::vector<uint16_t> &openPorts() const;
+
+  private:
+    struct Probe {
+        uint16_t port{0};
+        TcpSocket socket;
+        SteadyTimer timer;
+
+        Probe(IoContext &io, uint16_t p);
+    };
+
+    void startNext();
+    void startProbe(uint16_t port);
+    void onConnect(Probe *pr, const ErrorCode &ec);
+    void finishProbe(Probe *pr);
+
+    // Fixed settings
+    static constexpr uint16_t kFirstPort = 1;
+    static constexpr uint16_t kLastPort = 65535;
+    static constexpr std::size_t kMaxConcurrency = 256;
+
+    // State
+    std::string ip_;
+    IoContext io_;
+    std::vector<uint16_t> openPorts_;
+    std::vector<std::unique_ptr<Probe>> active_; // <= kMaxConcurrency
+    uint32_t nextPort_{kFirstPort};
+    std::size_t outstanding_{0};
+    int timeoutMs_;
+};

src/core/sniffer.cpp

@@ -1,135 +0,0 @@
-#include "sniffer.hpp"
-#include "logger.hpp"
-#include <tins/tins.h>
-
-Sniffer::Sniffer(std::string localIp, bool maskIp)
-    : ip_(std::move(localIp))
-    , mask_(maskIp)
-{
-}
-
-int Sniffer::run()
-{
-    const auto ifaceName = resolveIfaceNameByIp(ip_);
-
-    Tins::SnifferConfiguration cfg;
-    cfg.set_promisc_mode(true);
-    cfg.set_immediate_mode(true);
-
-    Tins::Sniffer sniffer(ifaceName, cfg);
-
-    auto running = [this] { return !stop_.load(std::memory_order_relaxed); };
-
-    auto handler = [&](Tins::PDU &pdu) -> bool {
-        if (!running())
-            return false;
-
-        std::string src, dst;
-        const char *type = "OTHER";
-        uint16_t sport = 0, dport = 0;
-
-        if (auto *arp = pdu.find_pdu<Tins::ARP>()) {
-            src = arp->sender_ip_addr().to_string();
-            dst = arp->target_ip_addr().to_string();
-            type = "ARP";
-        } else if (auto *ip4 = pdu.find_pdu<Tins::IP>()) {
-            src = ip4->src_addr().to_string();
-            dst = ip4->dst_addr().to_string();
-
-            if (auto *tcp = pdu.find_pdu<Tins::TCP>()) {
-                type = "TCP";
-                sport = tcp->sport();
-                dport = tcp->dport();
-            } else if (auto *udp = pdu.find_pdu<Tins::UDP>()) {
-                type = "UDP";
-                sport = udp->sport();
-                dport = udp->dport();
-            } else if (pdu.find_pdu<Tins::ICMP>()) {
-                type = "ICMP";
-            } else {
-                type = "IP";
-            }
-        } else if (auto *ip6 = pdu.find_pdu<Tins::IPv6>()) {
-            src = ip6->src_addr().to_string();
-            dst = ip6->dst_addr().to_string();
-
-            if (auto *tcp = pdu.find_pdu<Tins::TCP>()) {
-                type = "TCP";
-                sport = tcp->sport();
-                dport = tcp->dport();
-            } else if (auto *udp = pdu.find_pdu<Tins::UDP>()) {
-                type = "UDP";
-                sport = udp->sport();
-                dport = udp->dport();
-            } else if (pdu.find_pdu<Tins::ICMPv6>()) {
-                type = "ICMPv6";
-            } else {
-                type = "IPv6";
-            }
-        } else {
-            Logger::info("(unknown src) -> (unknown dst) [OTHER]");
-            return running();
-        }
-
-        if (mask_) {
-            src = hideHalf(src);
-            dst = hideHalf(dst);
-        }
-
-        printLine(src, dst, type, sport, dport);
-        return running();
-    };
-
-    sniffer.sniff_loop(handler);
-    return 0;
-}
-
-void Sniffer::stop()
-{
-    stop_.store(true, std::memory_order_relaxed);
-}
-
-std::string Sniffer::hideHalf(const std::string &s) const
-{
-    if (s.empty()) {
-        return s;
-    }
-
-    const size_t n = s.size();
-    const size_t hide = n / 2;
-    const size_t keep = n - hide;
-    std::string out = s.substr(0, keep);
-    out.append(hide, '*');
-
-    return out;
-}
-
-std::string Sniffer::resolveIfaceNameByIp(const std::string &ip)
-{
-    const Tins::IPv4Address want(ip);
-    for (const auto &iface : Tins::NetworkInterface::all()) {
-        const auto info = iface.addresses(); // .ip_addr/.netmask/...
-        if (info.ip_addr == want) {
-            return iface.name();
-        }
-    }
-    throw std::runtime_error("Interface with IP " + ip + " not found");
-}
-
-void Sniffer::printLine(
-    const std::string &src,
-    const std::string &dst,
-    const char *type,
-    uint16_t sport,
-    uint16_t dport
-)
-{
-    if (sport || dport) {
-        Logger::info(
-            std::string(src) + ":" + std::to_string(sport) + " -> " + dst + ":"
-            + std::to_string(dport) + " [" + type + "]"
-        );
-    } else {
-        Logger::info(std::string(src) + " -> " + dst + " [" + type + "]");
-    }
-}

src/core/sniffer.hpp

@@ -1,32 +0,0 @@
-#pragma once
-#include <atomic>
-#include <cstdint>
-#include <string>
-
-class Sniffer
-{
-  public:
-    explicit Sniffer(std::string localIp, bool maskIp = false);
-
-    Sniffer(const Sniffer &) = delete;
-    Sniffer &operator=(const Sniffer &) = delete;
-
-    std::string hideHalf(const std::string &s) const;
-
-    int run();
-    void stop();
-
-  private:
-    static std::string resolveIfaceNameByIp(const std::string &ip);
-    static void printLine(
-        const std::string &src,
-        const std::string &dst,
-        const char *type,
-        uint16_t sport = 0,
-        uint16_t dport = 0
-    );
-
-    std::string ip_;
-    std::atomic<bool> stop_{false};
-    bool mask_{false};
-};

src/main.cpp

@@ -1,26 +1,61 @@
+#include "local_ping_scanner.hpp"
 #include "logger.hpp"
-#include "packet_sniffer_cli.hpp"
+#include "port_scanner.hpp"
-#include "sniffer.hpp"
+#include "portscan_cli.hpp"
-#include <exception>
+#include <string>
 
-int main(int argc, char *argv[])
+int main(int argc, char **argv)
 {
     Logger::init(true);
-    try {
+
-        PacketSnifferCli cli;
+    PortScanCli cli;
     cli.parse(argc, argv);
     if (cli.isHelp()) {
         cli.printHelp();
         return 0;
     }
 
-        Sniffer sniffer(cli.getIp(), cli.isMaskEnabled());
+    const std::string baseIp = cli.getBaseIp();
-        return sniffer.run();
+
-    } catch (const std::exception &ex) {
+    const int prefix = cli.getPrefix();
-        Logger::fatal(ex.what());
+    if (prefix < 0 || prefix > 32) {
-        return 1;
+        Logger::fatal("Prefix must be in range 0..32\n");
-    } catch (...) {
+        return 2;
-        Logger::fatal("unknown error");
+    }
-        return 1;
+
+    LocalPingScanner scanner(baseIp, prefix);
+    Logger::info(std::format("Scanning subnet: {}/{}", baseIp, prefix));
+
+    scanner.run();
+
+    const auto &alive = scanner.alive();
+    if (alive.empty()) {
+        Logger::info("No alive hosts found.\n");
+        return 0;
+    }
+
+    std::cout << "Alive hosts:\n";
+    for (const auto &ip : alive) {
+        std::cout << "  " << ip << "\n";
+    }
+
+    // For each alive host, run full TCP port scan
+    for (const auto &ip : alive) {
+        std::cout << "Scanning ports on " << ip << " ...\n";
+
+        PortScanner ps(ip);
+        ps.run();
+
+        const auto &open = ps.openPorts();
+        if (open.empty()) {
+            std::cout << "  No open TCP ports found on " << ip << "\n";
+        } else {
+            std::cout << "  Open ports on " << ip << ":\n";
+            for (uint16_t port : open) {
+                std::cout << "    " << port << "\n";
             }
         }
+    }
+
+    return 0;
+}

xmake.lua

@@ -10,12 +10,18 @@ add_requires("cmake::Boost", {
     },
 })
 
-add_requires("cmake::libtins", { alias = "libtins", system = true })
+add_requires("cmake::Poco", {
+    alias = "poco",
+    system = true,
+    configs = {
+        components = { "Net", "Foundation" },
+    },
+})
 
-target "packet_sniffer"
+target "port_scanner"
 do
     set_kind "binary"
     add_files("src/main.cpp", "src/cli/*.cpp", "src/common/*.cpp", "src/core/*.cpp")
     add_includedirs("src", "src/cli", "src/common", "src/core", { public = true })
-    add_packages("boost", "libtins")
+    add_packages("boost", "poco")
 end