Got any questions?
We do our best to respond within 2 business hours (GMT)
Written by: Aptive
Learn the basics of port scanning, a network security technique used to identify open ports, services, and potential vulnerabilities on a system. Discover different types of port scans, their uses in cybersecurity, and how they help assess and secure network infrastructures.
Port scanning is the process of systematically testing a computer network for open ports, which are communication endpoints used by applications to send and receive data. Each service running on a networked device, such as a web server or an email server, operates on a specific port number. For instance, web servers typically use port 80 for HTTP and port 443 for HTTPS.
During a penetration test a security professional or an attacker performs a port scan, they are sending packets to a range of port numbers on a target system and analysing the responses. This helps to determine which ports are open, closed, or filtered by a firewall. The results of a port scan can reveal valuable information about the services running on a device, and this knowledge can be used for both defensive and offensive purposes.
Before we explain what port scanning is, it is important to understand what a port is. A port is a virtual endpoint on a computer or network device that allows communication between different services and applications over a network. Each TCP port is associated with a specific number, typically ranging from 0 to 65535, and serves as a communication channel for data packets. For example, port 80 is commonly used for web traffic (HTTP), while port 22 is used for secure shell access (SSH). Ports help direct incoming and outgoing network traffic to the appropriate applications, facilitating efficient data exchange.
Port scanning involves various methods to discover open or closed ports on a system, which helps to identify services running on those ports. Each technique serves a different purpose, often balancing efficiency and stealth. Here’s an overview of the most common types of port scanning:
Ping Scanning Ping scanning is used to determine whether a target machine is online or reachable. This is done by sending ICMP (Internet Control Message Protocol) echo requests (commonly called “ping” requests) to a system. If the system responds with an ICMP echo reply, it indicates the machine is active and reachable. However, many modern firewalls block ICMP traffic, reducing the reliability of this method for discovering live hosts.
TCP XMAS Packet Scan The TCP XMAS scan gets its name from the fact that the packet it sends is “lit up like a Christmas tree,” meaning it has several flags set in the TCP header (FIN, URG, and PSH). This scan is designed to probe for open ports by sending packets with unusual flag configurations to a target. An open port typically ignores the packet, while a closed port responds with an RST (reset) packet. This scan is more stealthy because it does not complete a normal handshake, making it harder for some firewalls and intrusion detection systems (IDS) to detect.
TCP FIN Packet Scan In a TCP FIN scan, the attacker sends a TCP packet with the FIN flag set, which usually signals the end of a connection in normal TCP communications. An open port should ignore the FIN packet, while a closed port will respond with an RST packet. Like the XMAS scan, the FIN scan is a stealth technique used to avoid detection, as it does not engage in the full TCP handshake process, making it less conspicuous to network defences.
Stealth Scan (SYN Scan) The SYN scan, also known as a half-open scan or stealth scan, is one of the most commonly used port scanning techniques. It works by sending a TCP SYN (synchronise) packet to initiate a connection. If the target port is open, the system responds with a SYN-ACK (acknowledgement). Instead of completing the handshake by sending an ACK, the scanner sends an RST (reset) packet, aborting the connection. This scan is called “stealthy” because it doesn’t complete the full connection, making it harder for the target to log the scan as a regular connection attempt.
UDP Scanning UDP scanning is used to determine whether a port using the UDP (User Datagram Protocol) is open. Unlike TCP, UDP is a connectionless protocol, meaning there is no handshake to establish a session. This makes UDP scanning more difficult, as it often relies on receiving an ICMP “port unreachable” message if a port is closed. If no response is received, the port is assumed to be open or filtered. Since many systems throttle or block ICMP responses, UDP scans can be slow and unreliable but are still important for identifying services like DNS, SNMP, or DHCP, which run over UDP.
SYN (Half-Open) Scan The SYN scan is a variation of the stealth scan, sending only the SYN packet to initiate the connection but not completing the handshake. This scan is faster than other methods and less likely to be logged by the target system because it does not establish a full TCP session. If the port is open, the target responds with a SYN-ACK packet, indicating readiness to complete the connection, but the scanner immediately responds with an RST packet to tear down the connection.
Each method offers different advantages and levels of stealth, helping researchers and attackers alike to assess network services or exploit vulnerabilities.
When performing a port scan, the results help determine the status of different ports on the target system. These results typically fall into a few key categories, each of which reveals something about the state of the port and the services running on it.
If your organisation requires an external scan to assess what ports are exposed consider checking out our vulnerability testing and penetration testing services.
While the terminology differs depending on the port scanning tool that is being leveraged by the security tester, the typical output from tooling is as follows:
Open An open port means that there is a service actively listening for connections on that port. This is significant because it indicates that a service, such as a web server (on port 80 or 443), an email server (on port 25), or an SSH service (on port 22), is accessible. Open ports are essential for communication between devices, but they can also be entry points for attacks if they are associated with vulnerable or misconfigured services. Discovering open ports helps security professionals identify which services are exposed and determine whether they are appropriately secured.
Closed A closed port means that no service is listening on that port, but the port is accessible and responding to probes. This is useful information because it confirms that the host exists and can be reached, but it also indicates that no services are running on that specific port. Closed ports can still respond with an RST (reset) packet, which means they are not blocked by a firewall. While a closed port isn’t an immediate security risk, attackers could try to reopen or exploit it if conditions change.
Filtered A filtered port result indicates that the port is being protected by a firewall or other security mechanism, and the scanning tool cannot determine whether the port is open or closed. Instead of getting a direct response, the scanner receives no response or an ICMP error (such as “destination unreachable”). This suggests that the traffic is being dropped or blocked by a firewall, intrusion prevention system (IPS), or some other security filter. Filtered ports are usually harder to exploit, but they can also conceal useful services from an attacker.
Unfiltered An unfiltered port is one that is reachable, but the scanner cannot determine whether it is open or closed. This result is often associated with scanning techniques that lack a clear response, such as a UDP scan, where the lack of response may be due to packet filtering or timeouts. While not as definitive as other results, unfiltered ports suggest that traffic is allowed to reach the port but more analysis is required to know its status.
Open|Filtered When a port is marked as open|filtered, it means the scan is unable to definitively conclude whether the port is open or being filtered. This result is often seen in UDP scans and some types of stealth scans (like SYN scans). Since UDP is connectionless, the lack of a response could mean that the port is either open or silently filtered by a firewall. Similarly, certain TCP scans may trigger no response, leading to ambiguity.
Closed|Filtered A closed|filtered port result is rare, but it occurs when the scanner cannot distinguish between a port that is closed and one that is being filtered. This can happen in situations where a firewall or security system behaves in a way that prevents clear detection, for instance, by dropping packets but not sending reset responses.
Below are some common ports along with their associated protocols and services:
| Port Number | Protocol | Service Name | Description |
|---|---|---|---|
| 20 | TCP | FTP Data | File Transfer Protocol (Data transfer) |
| 21 | TCP | FTP | File Transfer Protocol (Control) |
| 22 | TCP | SSH | Secure Shell (Secure remote access) |
| 23 | TCP | Telnet | Unencrypted text communication |
| 25 | TCP | SMTP | Simple Mail Transfer Protocol (Email) |
| 53 | TCP/UDP | DNS | Domain Name System (Name resolution) |
| 67 | UDP | DHCP | Dynamic Host Configuration Protocol (Server) |
| 68 | UDP | DHCP | Dynamic Host Configuration Protocol (Client) |
| 80 | TCP | HTTP | Hypertext Transfer Protocol (Web traffic) |
| 443 | TCP | HTTPS | Hypertext Transfer Protocol Secure (Secure web traffic) |
| 110 | TCP | POP3 | Post Office Protocol (Email retrieval) |
| 143 | TCP | IMAP | Internet Message Access Protocol (Email retrieval) |
| 3389 | TCP | RDP | Remote Desktop Protocol (Remote desktop access) |
| 3306 | TCP | MySQL | MySQL Database Service |
| 5432 | TCP | PostgreSQL | PostgreSQL Database Service |
This table provides a concise overview of some of the most commonly used ports in networking, highlighting their respective protocols and services.
Open Ports: These should be scrutinised for running services, especially if they are unexpected or unnecessary. Attackers focus on open ports as potential entry points, so organisations should ensure they are properly secured with up-to-date patches and strong configurations.
Closed Ports: While closed, they indicate a device is accessible, and network admins might consider using firewall rules to block traffic to these ports to make them less visible to attackers.
Filtered Ports: These suggest a well-configured firewall is in place, but it’s also possible that legitimate services may be hidden behind the filtering. Further analysis may be necessary to assess whether all filtering rules are correctly applied.
Open|Filtered Ports: These ambiguous results often require additional tools or techniques to gain more information. This result suggests that further probing might be needed to conclusively determine the status of the service.
Understanding port scan results is required for both attackers, who seek vulnerabilities, and defenders, who aim to lock down network services. The results give insights into the network architecture, potential weaknesses, and areas that need tighter security controls.
These tools vary in complexity, speed, and stealth capabilities, and many are essential for both network auditing and vulnerability assessment.
Here are some of the most common tools used for port scanning:
Nmap (Network Mapper)
Zenmap
Masscan
Netcat (nc)
Unicornscan
Project Discovery Naabu
Hping
ZMap
TCPing
OpenVAS
Summary:
Online port scanning search engines like Shodan are specialised tools that allow users to search for internet-connected devices, services, and systems that are publicly exposed. Unlike traditional search engines (like Google), which index websites and their content, Shodan and similar tools index information about devices connected to the internet, such as servers, webcams, routers, industrial control systems, and other networked devices.
Tools like Shodan enable security researchers and organisations to discover exposed systems, assess vulnerabilities, and take proactive steps to secure their internet-facing infrastructure.
For those old enough to remember, PC Flank was a website that provided online security testing services, particularly focusing on helping users assess their systems’ vulnerability to various internet-based threats. It allowed users to perform basic security tests, such as port scans, firewall tests, and checks for browser privacy leaks, to determine how exposed their computers were to potential cyber attacks. While PC Flank was popular among everyday internet users and small businesses, it also catered to those who wanted to ensure their personal systems were secure without needing in-depth technical knowledge.
Online Port Scanning: PC Flank offered a port scanning tool to check whether a user’s computer had open ports that could be exploited by attackers. By scanning for open TCP and UDP ports, users could identify potential vulnerabilities and take steps to close or secure those ports.
Stealth Test: This test checked whether the user’s system was “stealth” or invisible to external network probes. The goal was to see if a computer could effectively hide from port scans, reducing its exposure to attackers.
Browser Privacy Test: PC Flank also included tests to see how much information a user’s browser was leaking to websites. This test identified whether data like IP address, browser version, operating system, and cookies could be easily accessed, which could impact privacy.
Firewall Test: One of its more popular features was the firewall test. It examined how well a user’s firewall was configured to block unwanted incoming connections. If the firewall allowed too many open ports or failed to block common attack vectors, the test would flag this as a potential security issue.
Trojan Test: This test aimed to detect whether the user’s computer was vulnerable to Trojan horse attacks, which could allow an attacker to take control of the system or steal sensitive data.
PC Flank was intended to be a simple and accessible way for users to test their system’s exposure to common threats without having to install specialised security software. It provided basic but useful insights into how well a system was protected against unauthorised access and helped users take preventive action, such as improving their firewall settings or disabling vulnerable services.
Although PC Flank is no longer operational, it played an important role in raising awareness about the importance of personal security online. It provided a valuable educational resource for everyday users who may not have been familiar with network security principles. While the site may no longer be available, the types of tests it offered—port scanning, firewall checks, and privacy assessments—are still important aspects of maintaining a secure system. These functions are now often integrated into modern security software suites, but the core ideas behind PC Flank continue to be relevant today.
Firewalls use various mechanisms to prevent port scanning, primarily by controlling incoming and outgoing traffic based on predefined security rules. These mechanisms include:
Firewall rules define which types of traffic are allowed or denied based on parameters such as IP addresses, port numbers, and protocols. For example, a rule might allow traffic on port 80 (HTTP) while blocking traffic on port 23 (Telnet). Potential Defeats
Despite their effectiveness, firewall rules can potentially be defeated through various methods:
By understanding these mechanisms and potential weaknesses, organisations can better secure their networks against unauthorised access and attacks.
A firewall leak test was an essential component of network security, designed to evaluate a firewall’s ability to prevent unauthorised outbound traffic and protect against data breaches, thus ensuring the integrity and confidentiality of sensitive information. A leak test was used back when desktop personal firewalls (such as Zone Alarm) were popular, and a leak test would assess if any unpermitted traffic was “leaked” past the personal firewall.
In conclusion, port scanning is an essential technique in network security that enables professionals to identify open ports and services on systems, helping to uncover potential vulnerabilities. By understanding the various types of port scans and their applications, security researchers and administrators can better assess their network’s security posture and take proactive measures to safeguard their infrastructure.