Basic theory on scanning is also presented there. Where there exist two scan:

1. port scanners
2. IP scanner

How?

1. whether the host is up (alive, responding) or down (dead, not responding)
2. average roundtrip time (of IP packets to the destination address and back) – the same value as shown by the ping program
3. TTL (time to live) field value from the IP packet header, which can be used to find out the rough distance to the destination address (in number of routers the packet has traveled)
4. host and domain name (by using a DNS reverse lookup)
5. versions of particular services running on the host (e.g., “Apache 2.0.32 (Linux 2.6.9)” in case of a web server)
6. open (responding) and filtered TCP and UDP port numbers

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

<?php
	ini_set( "display_errors", 0);
	require_once("scanner.class.php");
	$ip_address1 = "192.168.1.10";
	$ip_address2 = "192.168.1.11";
	$my_scanner = new PortScanner($ip_address1, $ip_address2);
 
	$my_scanner->set_ports("80");
 
	$results = $my_scanner->do_scan();
 
	foreach($results as $ip=>$ip_results) {
		echo gethostbyaddr($ip)."\n<blockquote>\n";
 
 
		foreach($ip_results as $port=>$port_results) {
			echo "\t".$port." : ".$port_results['pname']." : ";
			if ($port_results['status']==1){echo "open";}
			else {echo "closed";}echo "<br />\n";
		}
		echo "</blockquote>\n\n";
	  }
 
?>

Results are as follow (it includes developerfusion.com port scan by default (?)):

developerfusion.com

15 : netstat : closed
16 : N/A : closed
17 : qotd : closed
18 : msp : closed
19 : chargen : closed
20 : ftp-data : closed
21 : ftp : closed
22 : ssh : closed
23 : telnet : closed
24 : N/A : closed
25 : smtp : open
80 : www : open
110 : pop3 : closed
3306 : mysql : closed
1337 : N/A : closed
666 : N/A : closed

xp-racy.local

80 : www : open

192.168.1.11

80 : www : closed