Skip to main content

Argus – Port Scanner

Python 3.10+ MIT License Platform

Argus is a high-performance, asynchronous port scanner built in Python. It combines speed with intelligence—featuring SSL/TLS support, smart banner grabbing, and built-in honeypot detection.

⚠️ Legal Disclaimer

This tool is for educational and authorized testing only.
Unauthorized scanning of networks you do not own or have permission to test may be illegal in your jurisdiction. Always obtain proper authorization before scanning.


Features

Feature Description
⚡ Async Scanning Concurrent scanning with configurable workers (up to 5000)
🔒 SSL/TLS Support HTTPS detection with SNI for CDNs like Akamai
🕵️ Honeypot Detection Multi-layer scoring: port density, banner consistency, timing
🎯 Smart Banner Grabbing Optional -sV mode with multi-stage probing
📊 JSON Output Machine-readable results with honeypot breakdown

Installation

From PyPI (Recommended)

pip install argus-scanner

From Source

git clone https://github.com/yourusername/argus-port-scanner.git
cd argus-port-scanner
pip install -e .

Usage

# Simple scan
argus -t example.com -p 1-1000

# Fast scan with JSON output
argus -t example.com -p 80,443,8080 -o results.json

# Deep service detection
argus -t example.com -p 1-1000 -sV

Options

Option Description
-t, --target Target IP or hostname
-p, --ports Ports to scan (e.g., 80,443 or 1-1000)
-c, --concurrency Concurrent connections (default: 500)
-o, --output Save results to JSON file
-sV Deep service detection with multi-stage probing

Honeypot Detection

Argus detects potential honeypots using multiple signals:

Check Weight What It Detects
Port Density 40 pts Too many open ports (100+ = max)
Banner Consistency 30 pts OS mismatches across services
Response Timing 30 pts Too-fast or zero-jitter responses

Confidence Levels: LOW (0-39), MEDIUM (40-59), HIGH (60+)

See docs/honeypot_detection.md for detailed scoring logic.


Example Output

╭────────────────────── Honeypot Detection ──────────────────────╮
│ ✓ Honeypot Score: 5/100 (LOW)                                  │
│   • Port Density: 0/40 - 4 open ports is normal                │
│   • Banner Consistency: 0/30 - OS indicators consistent        │
│   • Timing: 5/30 - Timing patterns appear normal               │
╰────────────────────────────────────────────────────────────────╯

              Scan Results for 23.55.244.114
┏━━━━━━┳━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Port ┃ State ┃ Service             ┃ Version/Banner           ┃
┡━━━━━━╇━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│   80 │ OPEN  │ [HTTP] AkamaiGHost  │ HTTP/1.0 400 Bad Request │
│  443 │ OPEN  │ [HTTP] AkamaiGHost  │ HTTP/1.0 400 Bad Request │
└──────┴───────┴─────────────────────┴──────────────────────────┘

Roadmap

Feature Status
UDP scanning Planned
IPv6 support Planned
Plugin-based analyzers Planned
PCAP-based timing analysis Research
Nmap NSE script compatibility Research

See docs/validation.md for real-world test results.


Contributing

See CONTRIBUTING.md for guidelines.

License

MIT License - see LICENSE for details.

Acknowledgments

  • Built with Rich for terminal UI
  • Uses Pydantic for configuration

Metadata

Release files for argus-scanner 1.0.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for argus-scanner 1.0.0
File Size Uploaded Provenance
argus_scanner-1.0.0.tar.gz 32.5 kB Without provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for argus-scanner 1.0.0
File Interpreter ABI Platform
argus_scanner-1.0.0-py3-none-any.whl Python 3 none any Details

Total release size: 65.0 kB

Release files / argus_scanner-1.0.0.tar.gz

Download URL argus_scanner-1.0.0.tar.gz
Size 32.5 kB
Tags Source
SHA-256 checksum
How to use checksums
f354f4c8531194ed6de739c0e5b431c585a8cf6f6f1aab37003e5e73e7429e13
BLAKE2b-256 checksum
How to use checksums
899030d35952debfe54b199306b9f8629594b245bee4938cf9c9ff3252ec74dc
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.2.0 CPython/3.14.0

Release files / argus_scanner-1.0.0-py3-none-any.whl

Download URL argus_scanner-1.0.0-py3-none-any.whl
Size 32.5 kB
Tags Python 3
SHA-256 checksum
How to use checksums
fdd7edb6b393045d59f05168cc86161f560c828e2699923d5bd0f64f1450c6cb
BLAKE2b-256 checksum
How to use checksums
041e40de5af2e4e02fa1c523dc1004ce2b00632d0b31194a963bf996a98c4bd8
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.2.0 CPython/3.14.0

Security for argus-scanner 1.0.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

Release history Release notifications | RSS feed

This release

1.0.0 This release

2 release files No provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page