本文是按照lfree的博客（https://www.cnblogs.com/lfree/p/10368332.html）中的内容，进行学习、测试、总结的。有些知识点也是在阅读这篇博文时，发现不了解这方面的知识，遂网上搜索相关资料总结了一下。
1：Linux 设备里面有个比较特殊的文件:/dev/[tcp|upd]/host/port 只要读取或者写入这个文件，相当于系统会尝试连接:host 这台机器，对应port端口。如果主机以及端口存在，就建立一个socket 连接。将在，/proc/self/fd目录下面，有对应的文件出现。
/dev/tcp/${HOST}/${PORT} 这个字符串看起来很像一个文件系统中的文件，并且位于 /dev 这个设备文件夹下。但是：这个文件并不存在，而且并不是一个设备文件。这只是 bash 实现的用来实现网络请求的一个接口，其实就像我们自己编写的一个命令行程序，按照指定的格式输入host port参数，就能发起一个socket连接完全一样
1[root@DB-Server ~]# cat < /dev/tcp/10.20.57.24/23 2 3-bash: connect: Connection refused 4 5-bash: /dev/tcp/10.20.57.24/23: Connection refused 6 7[root@DB-Server ~]# cat < /dev/tcp/10.20.57.24/22 8 9SSH-2.0-OpenSSH_4.3 10 11[root@DB-Server ~]# echo a > /dev/tcp/10.20.57.24/22 12 13[root@DB-Server ~]# echo $? 14 150 16 17[root@DB-Server ~]# echo a > /dev/tcp/10.20.57.24/23 18 19-bash: connect: Connection refused 20 21-bash: /dev/tcp/10.20.57.24/23: Connection refused 22 23[root@DB-Server ~]# echo $? 24 251 26 27[root@DB-Server ~]# netstat -ntlp 28 29Active Internet connections (only servers) 30 31Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name 32 33tcp 0 0 0.0.0.0:42304 0.0.0.0:* LISTEN 7497/ora_d009_gsp 34 35tcp 0 0 0.0.0.0:50336 0.0.0.0:* LISTEN 7481/ora_d005_gsp 36 37tcp 0 0 127.0.0.1:2208 0.0.0.0:* LISTEN 2936/hpiod 38 39tcp 0 0 0.0.0.0:57505 0.0.0.0:* LISTEN 7521/ora_d015_gsp 40 41tcp 0 0 0.0.0.0:769 0.0.0.0:* LISTEN 2707/rpc.statd 42 43tcp 0 0 0.0.0.0:31298 0.0.0.0:* LISTEN 7533/ora_d018_gsp 44 45tcp 0 0 0.0.0.0:13026 0.0.0.0:* LISTEN 7469/ora_d002_gsp 46 47tcp 0 0 0.0.0.0:40227 0.0.0.0:* LISTEN 7485/ora_d006_gsp 48 49tcp 0 0 0.0.0.0:62788 0.0.0.0:* LISTEN 7537/ora_d019_gsp 50 51tcp 0 0 0.0.0.0:58151 0.0.0.0:* LISTEN 7473/ora_d003_gsp 52 53tcp 0 0 0.0.0.0:18728 0.0.0.0:* LISTEN 7505/ora_d011_gsp 54 55tcp 0 0 0.0.0.0:29705 0.0.0.0:* LISTEN 7529/ora_d017_gsp 56 57tcp 0 0 0.0.0.0:60011 0.0.0.0:* LISTEN 7493/ora_d008_gsp 58 59tcp 0 0 0.0.0.0:19819 0.0.0.0:* LISTEN 7461/ora_d000_gsp 60 61tcp 0 0 0.0.0.0:50605 0.0.0.0:* LISTEN 7513/ora_d013_gsp 62 63tcp 0 0 0.0.0.0:11149 0.0.0.0:* LISTEN 7465/ora_d001_gsp 64 65tcp 0 0 0.0.0.0:25487 0.0.0.0:* LISTEN 7501/ora_d010_gsp 66 67tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 2662/portmap 68 69tcp 0 0 0.0.0.0:28021 0.0.0.0:* LISTEN 7517/ora_d014_gsp 70 71tcp 0 0 0.0.0.0:46038 0.0.0.0:* LISTEN 7525/ora_d016_gsp 72 73tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2953/sshd 74 75tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 2964/cupsd 76 77tcp 0 0 0.0.0.0:22392 0.0.0.0:* LISTEN 7489/ora_d007_gsp 78 79tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2999/sendmail: acce 80 81tcp 0 0 0.0.0.0:12508 0.0.0.0:* LISTEN 7477/ora_d004_gsp 82 83tcp 0 0 0.0.0.0:26302 0.0.0.0:* LISTEN 7509/ora_d012_gsp 84 85[root@DB-Server ~]# seq 1 65535 | xargs -I{} echo "echo a > /dev/tcp/10.20.57.24/{} 2>/dev/null 2&>1 ; echo ok=\$?,{}" | bash 2>/dev/null | grep ok=0 | cut -d, -f2 86 8722 88 89111 90 91769 92 9311149 94 9512508 96 9713026 98 9918728 100 10119819 102 10322392 104 10525487 106 10726302 108 10928021 110 11129705 112 11331298 114 11540227 116 11742304 118 11945826 120 12146038 122 12350336 124 12550605 126 12750741 128 12952199 130 13156371 132 13357505 134 13558151 136 13760011 138 13962788
如上测试所示，上面脚本不会记录环回地址（127.0.0.1）的LISTEN端口。而且脚本执行的效率较低，等待时间过长。
2：使用nc命令测试，测试结果发现，这个命令的速度完全秒杀上面脚本。但是也是不能定位环回地址（127.0.0.1）的LISTEN端口。需要指定IP地址127.0.0.1才能定位定位环回地址（127.0.0.1）的LISTEN
1root@DB-Server ~]# echo a | nc -w 1 -n -v 10.20.57.24 1-65535 2>/dev/null | grep "succeeded" 2 3Connection to 10.20.57.24 22 port [tcp/*] succeeded! 4 5Connection to 10.20.57.24 111 port [tcp/*] succeeded! 6 7Connection to 10.20.57.24 769 port [tcp/*] succeeded! 8 9Connection to 10.20.57.24 11149 port [tcp/*] succeeded! 10 11Connection to 10.20.57.24 12508 port [tcp/*] succeeded! 12 13Connection to 10.20.57.24 13026 port [tcp/*] succeeded! 14 15Connection to 10.20.57.24 18728 port [tcp/*] succeeded! 16 17Connection to 10.20.57.24 19819 port [tcp/*] succeeded! 18 19Connection to 10.20.57.24 22392 port [tcp/*] succeeded! 20 21Connection to 10.20.57.24 25487 port [tcp/*] succeeded! 22 23Connection to 10.20.57.24 26302 port [tcp/*] succeeded! 24 25Connection to 10.20.57.24 28021 port [tcp/*] succeeded! 26 27Connection to 10.20.57.24 29705 port [tcp/*] succeeded! 28 29Connection to 10.20.57.24 31298 port [tcp/*] succeeded! 30 31Connection to 10.20.57.24 40227 port [tcp/*] succeeded! 32 33Connection to 10.20.57.24 42304 port [tcp/*] succeeded! 34 35Connection to 10.20.57.24 46038 port [tcp/*] succeeded! 36 37Connection to 10.20.57.24 50111 port [tcp/*] succeeded! 38 39Connection to 10.20.57.24 50336 port [tcp/*] succeeded! 40 41Connection to 10.20.57.24 50605 port [tcp/*] succeeded! 42 43Connection to 10.20.57.24 57505 port [tcp/*] succeeded! 44 45Connection to 10.20.57.24 58151 port [tcp/*] succeeded! 46 47Connection to 10.20.57.24 60011 port [tcp/*] succeeded! 48 49Connection to 10.20.57.24 62788 port [tcp/*] succeeded! 50 51[root@DB-Server ~]# echo a | nc -w 1 -n -v 127.0.0.1 1-65535 2>/dev/null | grep "succeeded" 52 53Connection to 127.0.0.1 22 port [tcp/*] succeeded! 54 55Connection to 127.0.0.1 25 port [tcp/*] succeeded! 56 57Connection to 127.0.0.1 111 port [tcp/*] succeeded! 58 59Connection to 127.0.0.1 631 port [tcp/*] succeeded! 60 61Connection to 127.0.0.1 769 port [tcp/*] succeeded! 62 63Connection to 127.0.0.1 2208 port [tcp/*] succeeded! 64 65Connection to 127.0.0.1 11149 port [tcp/*] succeeded! 66 67Connection to 127.0.0.1 12508 port [tcp/*] succeeded! 68 69Connection to 127.0.0.1 13026 port [tcp/*] succeeded! 70 71Connection to 127.0.0.1 18728 port [tcp/*] succeeded! 72 73Connection to 127.0.0.1 19819 port [tcp/*] succeeded! 74 75Connection to 127.0.0.1 22392 port [tcp/*] succeeded! 76 77Connection to 127.0.0.1 25487 port [tcp/*] succeeded! 78 79Connection to 127.0.0.1 26302 port [tcp/*] succeeded! 80 81Connection to 127.0.0.1 28021 port [tcp/*] succeeded! 82 83Connection to 127.0.0.1 29705 port [tcp/*] succeeded! 84 85Connection to 127.0.0.1 31298 port [tcp/*] succeeded! 86 87Connection to 127.0.0.1 40227 port [tcp/*] succeeded! 88 89Connection to 127.0.0.1 42304 port [tcp/*] succeeded! 90 91Connection to 127.0.0.1 46038 port [tcp/*] succeeded! 92 93Connection to 127.0.0.1 50336 port [tcp/*] succeeded! 94 95Connection to 127.0.0.1 50605 port [tcp/*] succeeded! 96 97Connection to 127.0.0.1 57505 port [tcp/*] succeeded! 98 99Connection to 127.0.0.1 58151 port [tcp/*] succeeded! 100 101Connection to 127.0.0.1 60011 port [tcp/*] succeeded! 102 103Connection to 127.0.0.1 62788 port [tcp/*] succeeded! 104 105[root@DB-Server ~]#
这些命令其实是查看服务器处于 LISTENING状态的端口。跟服务器开放的端口是两回事情。如下所示，使用nmap扫描，发现服务器只开放了这些端口。
1# nmap 10.20.57.24 2 3Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2019-02-15 17:01 CST 4 5Interesting ports on 10.20.57.24: 6 7Not shown: 1674 filtered ports 8 9PORT STATE SERVICE 10 1122/tcp open ssh 12 13631/tcp closed ipp 14 151521/tcp open oracle 16 173306/tcp closed mysql 18 195901/tcp closed vnc-1 20 215902/tcp closed vnc-2
对比测试如下：
参考资料：
https://www.jianshu.com/p/80d6b5a61372
http://www.cnblogs.com/chengmo/archive/2010/10/22/1858302.html