Port Scanner
Check which common ports respond on a host and understand what each exposed service means. Scan only systems you are authorised to test.
Last reviewed by the Radiatus Cloud team
Need this monitored 24/7?
Radiatus delivers managed cloud & network operations.
Scan only what you are authorised to scan
Port scanning a host you do not own or have written permission to test is unlawful in many jurisdictions, including under the UK Computer Misuse Act and equivalent legislation elsewhere, regardless of whether any harm results. Use this against your own infrastructure, or within the documented scope of an engagement you have been contracted for. Scanning is also visible: it appears in target logs and in intrusion detection alerts.
What the three states mean
Open means something accepted the connection and a service is listening. Closed means the host replied with a reset, so it is reachable but nothing is listening on that port. Filtered means no reply arrived at all, which usually indicates a firewall silently dropping the packet. The distinction matters: a closed port confirms the host is alive, while a filtered one tells you almost nothing about whether the service exists.
Ports worth understanding
22 is SSH and should be key-only with password authentication disabled. 3389 is RDP and should never face the internet directly; it is a persistent ransomware entry point and belongs behind a VPN. 3306 MySQL, 5432 PostgreSQL, 6379 Redis, 27017 MongoDB and 9200 Elasticsearch should bind to localhost or a private interface only. Redis, MongoDB and Elasticsearch have each historically shipped with no authentication by default, and internet-exposed instances have caused very large breaches. 445 SMB should never be internet-facing. 23 Telnet transmits credentials in plaintext and should not be running at all.
An open port is not automatically a vulnerability
Ports 80 and 443 are open on every web server by design. The questions worth asking are whether the service should be reachable from where you are scanning, whether it is patched, whether it requires authentication, and whether it is the current version. A fully patched service on an open port is normal operation; an unauthenticated database on a public interface is not.
Browser limits
A browser cannot open raw TCP sockets, so any browser-based scanner is inferring reachability from HTTP or WebSocket connection behaviour and timing. That is far less accurate than a real scanner and cannot distinguish closed from filtered reliably. For genuine assessment use nmap from a machine you control, with appropriate authorisation.
Related tools
- DNS Misconfiguration — Analyze DNS records (TXT, SPF) for security gaps.
- TLS Compat Tester — Check client-server compatibility for TLS versions.
- Firewall Rule Risk — Evaluate firewall rules for over-permissive exposure.
- Port Exposure Explainer — Understand risks of specific open ports.
Frequently Asked Questions
Is port scanning legal?
Scanning your own infrastructure is fine. Scanning systems you do not own or have written permission to test may be an offence in many jurisdictions regardless of harm caused, including under the UK Computer Misuse Act. Get authorisation in writing first.
What is the difference between closed and filtered?
Closed means the host actively replied with a reset, so it is reachable but nothing is listening. Filtered means no reply arrived, usually a firewall dropping the packet silently. Filtered tells you very little about whether the service exists.
Does an open port mean I am vulnerable?
No. Ports 80 and 443 are open on every web server by design. What matters is whether the service should be reachable from that network, whether it is patched and current, and whether it requires authentication.
Which ports should never face the internet?
Database ports such as 3306, 5432, 6379, 27017 and 9200; RDP on 3389; SMB on 445; and Telnet on 23. Several of those databases historically shipped without authentication, and exposed instances have caused major breaches.
Why is a browser-based scanner less accurate?
Browsers cannot open raw TCP sockets, so results are inferred from HTTP or WebSocket behaviour and timing. That cannot reliably distinguish closed from filtered. Use nmap from a machine you control for real assessment.
Privacy & Security
Scanned from your IP address via browser.
About This Tool
This tool runs entirely in your browser. No data is sent to any server, ensuring complete privacy. Simply use the interface above to get started — no registration or login required.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.