🔌">

Port Scanner

Network security & port detection • 2026 standards

Port Scanning Fundamentals:

Scan Ports

Port States: Open, Closed, Filtered, Unfiltered

Scan Types:

  • TCP Connect Scan: Full three-way handshake
  • TCP SYN Scan: Half-open scan, stealthier
  • UDP Scan: Sends UDP packets, checks for ICMP errors
  • ACK Scan: Tests firewall filtering rules

Port Categories:

  • Well-known (0-1023): System services
  • Registered (1024-49151): User applications
  • Dynamic (49152-65535): Temporary ports

Security Implications: Open ports represent potential entry points. Proper port management and monitoring are critical for network security.

Target Configuration

Example: 192.168.1.1, google.com, 10.0.0.1/24
Examples: 22,80,443 or 1-1000 or 8000-9000

Scan Options

Scan Results

192.168.1.1
Target Host
Scanning
Scan Status
12
Open Ports
45s
Scan Duration
Open Ports
12
Active Services
Closed Ports
850
Filtered
Filtered Ports
38
Firewalled
Scan Speed
220
ports/sec
Open Ports & Services:
Port 22 (SSH) Open
Port 80 (HTTP) Open
Port 443 (HTTPS) Open
Port 3389 (RDP) Open
Port 53 (DNS) Open
Service Information:
Port 22: OpenSSH 8.4p1 Ubuntu
Port 80: Apache 2.4.41 Ubuntu
Port 443: nginx 1.18.0
Port 53: bind 9.16.1-Ubuntu
Security Analysis:
SSH Security: Port 22 open with strong encryption
Web Server: HTTP port 80 exposed, consider HTTPS only
RDP Access: Port 3389 filtered by firewall
Exposed Services: Multiple services accessible from network
Recent Scans:
192.168.1.1 12 open ports
10.0.0.1 8 open ports
google.com 4 open ports
Port Protocol Status Service Version
22 TCP Open ssh OpenSSH 8.4p1
80 TCP Open http Apache 2.4.41
443 TCP Open https nginx 1.18.0
53 TCP Open domain bind 9.16.1
3389 TCP Open ms-wbt-server Windows Terminal Service
Service Port Version Risk Level
OpenSSH 22 8.4p1 Low
Apache HTTP 80 2.4.41 Medium
nginx 443 1.18.0 Low
bind 53 9.16.1 Low

Port Scanning Fundamentals

Port States

Ports can be open (accepting connections), closed (responding but not accepting), or filtered (blocked by firewall).

Scan Methods

TCP SYN scan is fastest and stealthiest. TCP connect is most reliable. UDP scans are slower due to protocol characteristics.

Security Guidelines:
  • Only scan authorized networks
  • Minimize open ports
  • Monitor for unauthorized access
  • Keep services updated

Security Considerations

Risk Management

Each open port represents a potential attack vector. Proper firewall configuration and regular monitoring are essential for security.

Best Practices
  1. Close unnecessary ports
  2. Use service hardening
  3. Implement network segmentation
  4. Regular security audits
Security Rules:
  • Default-deny firewall policy
  • Regular port monitoring
  • Service patching schedule
  • Access control measures

Network Security Learning Quiz

Question 1: Multiple Choice - Port States

What does it mean when a port is described as "filtered" during a port scan?

Solution:

The answer is C) The port is blocked by a firewall and not responding. When a port is "filtered," it means that the scanner sent a probe to the port but received no response. This typically indicates that a firewall or other network filtering device is blocking the traffic to that port.

Pedagogical Explanation:

Port states help identify the network topology and security measures in place. Understanding the difference between open, closed, and filtered ports is crucial for network security assessment and penetration testing.

Key Definitions:

Open Port: Accepts connections and responds to probes

Closed Port: Rejects connections with RST (TCP) or ICMP error (UDP)

Filtered Port: No response due to firewall or filter

Important Rules:

• Filtered ports indicate firewall presence

• No response = filtered or dropped

• Different scan methods may yield different results

Tips & Tricks:

• Remember: Open = response, Closed = rejection, Filtered = no response

• Firewalls often filter high-risk ports

• Use multiple scan methods for thoroughness

Common Mistakes:

• Confusing filtered with closed ports

• Not understanding firewall impact on scans

• Assuming no response means port is down

Question 2: Port Scan Methods

Which port scanning method is considered the most stealthy and why?

Solution:

TCP SYN scan (also known as "half-open" scan) is the most stealthy. In this method, the scanner sends a SYN packet to initiate a connection but never completes the three-way handshake by sending an ACK. This means:

• The target system doesn't establish a full connection

• The scan may not be logged in application logs

• It's faster than TCP connect scan

• It can identify listening services without completing connections

However, it requires root privileges on many systems.

Pedagogical Explanation:

Stealth scanning aims to avoid detection by intrusion detection systems. Different scan methods have trade-offs between stealth, accuracy, and required permissions.

Key Definitions:

Three-Way Handshake: SYN → SYN-ACK → ACK connection establishment

Stealth Scan: Method that minimizes logging and detection

Privilege Requirements: Administrative rights needed for certain scans

Important Rules:

• SYN scan is stealthy but requires root

• Connect scan is reliable but more detectable

• UDP scans are inherently slower

Tips & Tricks:

• Use SYN scan for stealthy reconnaissance

• Connect scan for accuracy when stealth isn't needed

• UDP scans require patience due to protocol nature

Common Mistakes:

• Not understanding permission requirements

• Assuming all scans have same stealth level

• Not considering protocol differences

Question 3: Word Problem - Port Security Analysis

A network administrator discovers that ports 22, 80, 443, 3389, and 25 are all open on a server. Analyze the security implications of each port and recommend which ones should be restricted or monitored more closely.

Solution:

Security analysis of each port:

• Port 22 (SSH): Generally secure, but monitor for brute force attempts

• Port 80 (HTTP): Security risk - unencrypted traffic, consider redirecting to HTTPS

• Port 443 (HTTPS): Secure encrypted traffic, properly configured

• Port 3389 (RDP): High security risk - direct desktop access, should be restricted to VPN

• Port 25 (SMTP): Security risk - potential for spam relay, should be restricted

Recommendations:

• Close port 25 or restrict to internal mail servers

• Restrict RDP access to VPN or jump hosts

• Redirect HTTP to HTTPS and close port 80

• Implement SSH key authentication and rate limiting

Pedagogical Explanation:

Each open port represents a potential attack surface. The security risk depends on the service running and how it's configured. Critical services should have additional security measures.

Key Definitions:

Attack Surface: Number of ways an unauthorized user can enter system

Service Hardening: Securing services to reduce vulnerabilities

Network Segmentation: Isolating network sections for security

Important Rules:

• Minimize open ports to essential services only

• Regularly audit open ports

• Apply principle of least privilege

Tips & Tricks:

• Use service-specific firewalls

• Implement network access controls

• Regular vulnerability scanning

Common Mistakes:

• Leaving unnecessary ports open

• Not considering service configurations

• Forgetting to monitor open ports

Question 4: Application-Based Problem - Firewall Configuration

A company wants to allow employees to access internal web applications while blocking external access. The web server currently has ports 80 and 443 open to the internet. Explain how to configure the firewall to achieve this goal and what port scanning results would indicate successful implementation.

Solution:

Firewall configuration approach:

1. Block inbound traffic on ports 80 and 443 from external IP ranges

2. Allow inbound traffic on ports 80 and 443 from internal IP ranges

3. Consider using VPN for remote access

Expected port scan results:

• External scans should show ports 80 and 443 as "filtered"

• Internal scans should show ports 80 and 443 as "open"

• The difference confirms the firewall is working correctly

Additional security measures:

• Implement web application firewall (WAF)

• Use SSL/TLS termination at firewall

• Monitor for unauthorized access attempts

Pedagogical Explanation:

Effective firewall configuration requires understanding both network topology and business requirements. Port scanning can be used to verify firewall rules are working as intended.

Key Definitions:

Firewall Rule: Policy defining allowed/denied network traffic

Network Segmentation: Dividing network into secure zones

Access Control: Managing who can access network resources

Important Rules:

• Default-deny policy is safest

• Test firewall rules after implementation

• Document all firewall exceptions

Tips & Tricks:

• Use port scanning to verify firewall effectiveness

• Implement layered security approach

• Regular firewall rule audits

Common Mistakes:

• Not testing firewall rules after configuration

• Using overly permissive rules

• Not monitoring firewall logs

Question 5: Multiple Choice - UDP Scanning

Why is UDP scanning generally slower than TCP scanning?

Solution:

The answer is B) UDP doesn't have a handshake mechanism. UDP scanning is slower because:

• UDP is connectionless, no handshake to confirm reachability

• Scanner must wait for ICMP "Port Unreachable" messages

• Many firewalls block ICMP error messages

• No reliable way to distinguish between closed and filtered ports

• Must use longer timeouts to account for possible ICMP blocking

Pedagogical Explanation:

The connectionless nature of UDP makes it difficult to determine port status definitively. This requires more sophisticated techniques and longer scanning times compared to TCP.

Key Definitions:

Connectionless Protocol: No connection establishment required

ICMP Errors: Messages indicating network problems

Port Reachability: Ability to communicate with a port

Important Rules:

• UDP scans are inherently slower than TCP scans

• Results may be less reliable

• Requires longer timeouts

Tips & Tricks:

• Expect longer scan times for UDP

• Results may be inconclusive

• Use specific UDP scans for known services

Common Mistakes:

• Expecting UDP scans to be as fast as TCP scans

• Not accounting for ICMP blocking

• Assuming UDP scan results are as reliable as TCP

FAQ

Q: What's the difference between TCP and UDP port scanning?

A: The key differences:

  • TCP Scanning: Uses connection-oriented protocol, more reliable results
  • UDP Scanning: Connectionless protocol, slower and less reliable
  • TCP: Can use SYN, ACK, FIN scans for different purposes
  • UDP: Relies on ICMP error messages which may be blocked

TCP scans are faster and more reliable, while UDP scans require longer timeouts and may produce inconclusive results.

Q: Is port scanning legal?

A: Port scanning legality depends on context:

  • Authorized networks: Generally legal for security testing
  • Unauthorized networks: May violate computer crime laws
  • Terms of Service: May violate network agreements
  • Intent matters: Reconnaissance vs. actual attacks

Always obtain proper authorization before scanning networks you don't own. Many jurisdictions consider unauthorized scanning a criminal offense.

About

Network Team
This port scanner tool was created
This calculator was created by our Developer Tools Team , may make errors. Consider checking important information. Updated: April 2026.