Aether Scanner: High-Performance Cross-Platform Network Scanner

A modular, high-performance, platform-independent network scanner CLI utility built in Python. The tool automatically adapts to your user privileges, utilizing fast Layer 2 ARP sweeps and TCP SYN stealth scans when run under root/administrative permissions, and falling back to a highly concurrent Asynchronous TCP Connect scanner when run under standard user permissions.

---

Key Features

1. Flexible Target Parsing: Supports CIDR notations (192.168.1.0/24), IP ranges (192.168.1.10-50), comma-separated addresses, individual IPs, and hostnames/domains.
2. Adaptive Privilege Modes:
   • Root Mode: Layer-2 ARP sweeps for rapid host discovery and TCP SYN half-open (stealth) scans via Scapy.
   • Non-Root Mode (Fallback): Multi-threaded ICMP ping sweeps and a highly concurrent Asynchronous TCP Connect scanner (powered by Python's native asyncio).
3. Service Banner Grabbing: Performs banner analysis on open TCP ports (supporting raw banner exchange and specific HTTP/HTTPS Server header queries).
4. TTL-Based OS Detection: Classifies target operating systems (Linux/macOS/Unix vs. Windows vs. Network/Cisco devices) by analyzing the Time-to-Live (TTL) field of returning packets.
5. Multiple Export Formats: Supports formatted terminal tables, structured JSON, and CSV data reports.

---

Installation & Requirements

The tool runs natively on Linux, macOS, and Windows.

Prerequisites

• Python 3.8+
• (Optional) scapy library (Required for root-mode scans: ARP sweeps and TCP SYN half-open scans).

  pip install scapy

  Note: On Windows, Scapy requires Npcap (or WinPcap) installed to handle raw socket packet manipulation.

---

CLI Command Usage

usage: aether_scanner.py [-h] -t TARGET [-p PORTS] [-s {syn,connect,auto}] [--ping] [--banner] [--os]
                         [--concurrency CONCURRENCY] [--timeout TIMEOUT] [-o OUTPUT] [-f {table,json,csv}]

Aether Network Scanner - A High-Performance Cross-Platform Security Tool

options:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        Target IP address, range (e.g. 192.168.1.1-50), CIDR block (192.168.1.0/24), or hostname.
  -p PORTS, --ports PORTS
                        Ports to scan. Example: 22,80,443 or range 20-100. Default: 26 common ports.
  -s {syn,connect,auto}, --scan-type {syn,connect,auto}
                        Scan type. SYN (root required) or Connect (asynchronous socket). Default: auto.
  --ping                Perform Host Discovery sweep before port scanning.
  --banner              Attempt service version banner grabbing on open ports.
  --os                  Estimate host Operating System via TTL fingerprinting.
  --concurrency CONCURRENCY
                        Maximum concurrent sockets for Connect scan (Default: 500).
  --timeout TIMEOUT     Connection timeout in seconds (Default: 1.0).
  -o OUTPUT, --output OUTPUT
                        Write scan results to a file path.
  -f {table,json,csv}, --format {table,json,csv}
                        Output format. Default: table.

---

Example Scans

1. Basic Scan (All privileges)

Scan the default top common ports on a single local target:

python3 aether_scanner.py -t 127.0.0.1

2. High-Performance Port Range Scan (Non-Root/Asynchronous)

Scan a target across 1,000 ports asynchronously with custom timeout:

python3 aether_scanner.py -t 192.168.1.1 -p 1-1000 -s connect --timeout 0.5

3. Comprehensive Stealth Scan (Root required, includes OS and Banner Grabbing)

sudo python3 aether_scanner.py -t 192.168.1.5 -p 22,80,443,8080 -s syn --ping --banner --os

4. Export Subnet Scan to CSV

python3 aether_scanner.py -t 192.168.1.0/24 -p 22,80,443 --ping --output results.csv --format csv