pip install python-nmap

import nmap
nm = nmap.PortScanner()

def scan(  # NOQA: CFQ001, C901
    self, hosts="127.0.0.1", ports=None, arguments="-sV", sudo=False, timeout=0
):
    """
    :param hosts: 主機字符串，如 nmap 使用的 'scanme.nmap.org' 或 '198.116.0-255.1-127' 或 '216.163.128.20/20'
    :param ports: 端口字符串，如 nmap 使用的 '22,53,110,143-4564'
    :param arguments: nmap 參數(shù)字符串 '-sU -sX -sC'
    :param sudo: 如果為 True，則使用 sudo 啟動 nmap
    :param timeout: 整數(shù)，如果大于零，將在指定秒數(shù)后終止掃描，否則將無限期等待
    :returns: 掃描結果作為字典
    """

scan_result = nm.scan("192.168.88.150", "22")

all_hosts = nm.all_hosts()

command_line = nm.command_line()

scaninfo = nm.scaninfo()

scan_stats = nm.scanstats()

has_host = nm.has_host("192.168.88.150")

csv_result = nm.csv()

import nmap

nm = nmap.PortScanner()
nm.scan(hosts='192.168.88.0/24', arguments='-sn')
hosts_list = [(x, nm[x]['status']['state']) for x in nm.all_hosts()]

for host, status in hosts_list:
    if status == 'up':
        print(f'{host} status: {status}')

import nmap
nm_async = nmap.PortScannerAsync()

def scan(  # NOQA: CFQ002
    self,
    hosts="127.0.0.1",
    ports=None,
    arguments="-sV",
    callback=None,
    sudo=False,
    timeout=0,
):
    """
	:param hosts: 主機字符串，格式與 nmap 使用的格式相同，例如'scanme.nmap.org' 或 '198.116.0-255.1-127' 或 '216.163.128.20/20'。
	:param ports: 端口字符串，格式與 nmap 使用的格式相同，例如 '22,53,110,143-4564'。
	:param arguments: nmap 的參數(shù)字符串，例如 '-sU -sX -sC'。
	:param callback: 回調(diào)函數(shù)，該函數(shù)以（主機，掃描數(shù)據(jù)）作為參數(shù)。
	:param sudo: 如果為真，則使用 sudo 啟動 nmap。
	:param timeout: 整數(shù)，如果大于零，將會在指定秒數(shù)之后終止掃描，否則將無限期等待。
	"""

import nmap

# 定義回調(diào)函數(shù)（掃描結果處理）
def scan_callback(host, data):
	"""
	:param host: 掃描完主機ip地址
	:param data：掃描結果
	"""
    print(host, data)

nm_async = nmap.PortScannerAsync()
hosts = '192.168.88.0/24'
ports = '1-1000'
arguments = '-sS'

if __name__ == '__main__':
	# 創(chuàng)建一個新的進程掃描，避免主進程阻塞
    nm_async.scan(hosts, ports, arguments, callback=scan_callback)

    while nm_async.still_scanning():
		# still_scanning判斷是否還在掃描
        print("scanning...")
        nm_async.wait(1)

def scan(self, hosts="127.0.0.1", ports=None, arguments="-sV", sudo=False, timeout=0):

    # 對輸入?yún)?shù)（主機、端口、掃描參數(shù)等）進行類型檢查和合法性驗證
    if sys.version_info[0] == 2:
        ......
    else:
        ......

    # shlex模塊對主機和掃描參數(shù)進行分割處理
    h_args = shlex.split(hosts)
    f_args = shlex.split(arguments)

    # 構建完整的nmap命令行參數(shù)列表
    args = ([self._nmap_path, "-oX", "-"] + h_args + ["-p", ports] * (ports is not None) + f_args)

    # 啟動nmap進程
    p = subprocess.Popen(args, bufsize=100000, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
						stderr=subprocess.PIPE,)


    # 超時處理
    if timeout == 0:
        (self._nmap_last_output, nmap_err) = p.communicate()
    else:
        ......

    return self.analyse_nmap_xml_scan(nmap_xml_output=self._nmap_last_output,  nmap_err=nmap_err)

def analyse_nmap_xml_scan( self, nmap_xml_output=None, nmap_err=nmap_err):

    if nmap_xml_output is not None:
        self._nmap_last_output = nmap_xml_output

    scan_result = {}

    # 將XML字符串轉換為元素樹
    try:
        dom = ET.fromstring(self._nmap_last_output)
    except Exception:
        pass

    # 掃描結果存儲結構, get等方法拿到樹中的數(shù)據(jù)
    scan_result["nmap"] = {
        "command_line": dom.get("args"),
        "scaninfo": {
            "timestr": dom.find("runstats/finished").get("timestr"),
            ......
        },
    }

    return scan_result

def __scan_progressive__(self, hosts, ports, arguments, callback, timeout):

    # 此函數(shù)在一個單獨的進程中執(zhí)行掃描操作，并調(diào)用回調(diào)函數(shù)處理結果
    try:
        scan_data = self._nm.scan(host, ports, arguments, timeout)
    except Exception:
        scan_data = None

    if callback is not None:
        callback(host, scan_data)
    return

class PortScannerAsync(object):

    def __init__(self):
        self._process = None
        self._nm = PortScanner()   #創(chuàng)建一個PortScanner實例，用于執(zhí)行掃描操作
        return

    def scan(self, hosts="127.0.0.1", ports=None, arguments="-sV", callback=None, timeout=0):

        if sys.version_info[0] == 2:
            ......
        else:
            ......

        self._process = Process(   # 創(chuàng)建一個新的進程對象，將 __scan_progressive__ 函數(shù)作為目標函數(shù)
            target=__scan_progressive__,
            args=(self, hosts, ports, arguments, callback, timeout),
        )
        self._process.daemon = True
        self._process.start()

        return