What is a port scan and how do you detect or block one?

A port scan sends connection attempts to many ports on one or more hosts to learn which ones respond, revealing running services. Defenders run scans to find unintended exposure, and attackers run them for discovery. You cannot stop probes reaching a public address, but you can limit what answers and alert on scan patterns.

What is a port?

A port is a number that tells a computer which service should receive incoming traffic. A web server listens on 443, a mail server on 25, a remote desktop service on 3389. TCP, the protocol most services use, is defined in RFC 9293, which describes how a connection starts with a three-step handshake.

That handshake is what a scan uses. Send a request to a port, and the reply shows whether something is listening.

How does a scan tell open from closed?

In a basic connection scan, the scanner tries to complete the handshake. If the port is open, the host answers and the connection forms. If it is closed, the host sends a reset. If a firewall drops the packet, the scanner receives nothing and marks the port filtered.

Variations change how much they reveal and how loud they are, for example by sending a partial handshake or spreading probes over hours. The goal stays the same: build a list of reachable services.

Why does it matter?

MITRE ATT&CK lists this behaviour as Network Service Discovery (T1046) under the Discovery tactic. It describes adversaries attempting to get a listing of services running on remote hosts and network devices, including those that may be vulnerable to remote exploitation, with port, vulnerability and wordlist scans among the common methods. In cloud environments, the same applies between cloud hosts, and between a cloud environment and connected on-premises systems.

Inside a network, a scan after a first foothold shows an attacker where to move next.

What is the defender's use?

NIST SP 800-115, the guide to technical security testing, covers network discovery and port and service identification as basic testing techniques. Scanning your own address space tells you whether the firewall matches the intended design. An accidentally open database port on a public address is the classic finding.

Only scan systems you own or have written permission to test.

What does a constructed log pattern look like?

A firewall log shows one external address sending single connection attempts to ports 21, 22, 23, 25, 80, 110, 143, 443 and 3389 on one server within a few seconds, then repeating against the next server in the range. Real users do not do that. A rule that alerts when one source touches many distinct ports or many distinct hosts in a short window catches it.

What can you do about it?

• Reduce what answers. Close services you do not need. Put administrative interfaces behind a VPN or an identity-aware gateway.
• Default deny. A firewall that drops unsolicited traffic gives a scanner little to learn.
• Alert on patterns. Look for one source touching many ports or hosts. Tune thresholds to avoid flagging your own scanners.
• Rate limit and block repeat sources. Useful for noise, though attackers rotate addresses.
• Scan yourself. Run authorised scans on a schedule and diff the results.

Hiding services by changing port numbers hides little. A scan will find the service anyway.

How to check or apply this

1. List every public address you own, including cloud accounts and forgotten test hosts.
2. Run an authorised scan against them and record open ports.
3. Compare the result with your intended design and close the differences.
4. Add an alert for one source reaching many ports or hosts in a short time.
5. Allow your own scanner addresses so they do not flood the alerts.
6. Repeat monthly and after changes, and track new exposures to closure.

Quick check

Sources

• MITRE ATT&CK T1046, Network Service Discovery
• RFC 9293, Transmission Control Protocol
• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

Last reviewed: 18 October 2026.