Port Scanner

Scan only what you are authorised to scan

Port scanning a host you do not own or have written permission to test is unlawful in many jurisdictions, including under the UK Computer Misuse Act and equivalent legislation elsewhere, regardless of whether any harm results. Use this against your own infrastructure, or within the documented scope of an engagement you have been contracted for. Scanning is also visible: it appears in target logs and in intrusion detection alerts.

What the three states mean

Open means something accepted the connection and a service is listening. Closed means the host replied with a reset, so it is reachable but nothing is listening on that port. Filtered means no reply arrived at all, which usually indicates a firewall silently dropping the packet. The distinction matters: a closed port confirms the host is alive, while a filtered one tells you almost nothing about whether the service exists.

Ports worth understanding

22 is SSH and should be key-only with password authentication disabled. 3389 is RDP and should never face the internet directly; it is a persistent ransomware entry point and belongs behind a VPN. 3306 MySQL, 5432 PostgreSQL, 6379 Redis, 27017 MongoDB and 9200 Elasticsearch should bind to localhost or a private interface only. Redis, MongoDB and Elasticsearch have each historically shipped with no authentication by default, and internet-exposed instances have caused very large breaches. 445 SMB should never be internet-facing. 23 Telnet transmits credentials in plaintext and should not be running at all.

An open port is not automatically a vulnerability

Ports 80 and 443 are open on every web server by design. The questions worth asking are whether the service should be reachable from where you are scanning, whether it is patched, whether it requires authentication, and whether it is the current version. A fully patched service on an open port is normal operation; an unauthenticated database on a public interface is not.

Browser limits

A browser cannot open raw TCP sockets, so any browser-based scanner is inferring reachability from HTTP or WebSocket connection behaviour and timing. That is far less accurate than a real scanner and cannot distinguish closed from filtered reliably. For genuine assessment use nmap from a machine you control, with appropriate authorisation.