A port scan sends probes to a host's network ports to see which ones respond. An answer shows a service is listening, a refusal shows the port is closed, and silence suggests a filter in the way. Attackers use scans to map targets. Defenders use the same technique to find what they accidentally expose.
What is a port?
A port is a 16 bit number that, with an address, identifies a service on a host. IANA's registry divides them into system ports (0 to 1023), user ports (1024 to 49151) and dynamic or private ports (49152 to 65535), and records which service names are assigned to which numbers. The registry was last updated on 15 October 2026 when we checked.
The assignments are conventions. A web server can run on any port, and a database can hide on a high one. Scanning does not rely on conventions, which is why attackers check all 65,535.
How does a scan tell open from closed?
It uses the rules of the transport protocol. RFC 9293 specifies TCP. Connections start with a SYN segment. A host with a service listening replies to a SYN with SYN and ACK. A host with nothing listening is in the CLOSED state, and the RFC says a reset is sent in response to any incoming segment except another reset, so a SYN to a closed port is rejected that way.
That produces three results. A SYN and ACK means open. A reset means closed, and the host is alive. No reply at all usually means a firewall dropped the probe. Scanners label these open, closed and filtered.
UDP is harder. There is no handshake, so an open port may simply stay silent, and a closed port may return an ICMP error that rate limits can suppress. UDP scans are slower and less certain.
What does an attacker learn?
Open ports show which services run. Banners and version responses suggest the software and sometimes its version. Combined with a list of known vulnerabilities, that points to the next step. Scanning sits at the start of an attack chain, under the Reconnaissance and Discovery goals in MITRE ATT&CK.
Scanning alone breaks nothing. It is the first look around, and on the internet it is routine background noise, so assume any public address will be probed.
A constructed example
A team spins up a database for a load test and attaches a public address so a contractor can reach it. The security group allows port 5432 from anywhere. Nobody writes a ticket.
A weekly scan of the company's own address range reports a new open port on a host that had none last week. The owner is traced from the cloud tags, the contractor moves to a private link, and the rule is deleted. The cost of the mistake was six days of exposure instead of six months.
Is scanning legal?
Scanning your own systems is routine. Scanning someone else's without permission may breach their terms or local law, and cloud providers have their own policies on testing. Get written authorisation for any third party scan and check your provider's rules before testing hosted assets.
How do you defend against scans?
You cannot stop probes from arriving. You can limit what answers and notice patterns. Close ports you do not need and restrict the rest by source address. Put management services such as SSH and RDP behind a VPN or an access broker. Treat a single source hitting hundreds of ports in a minute as a signal worth logging, though quiet slow scans will avoid simple thresholds.
NIST SP 800-41, its guideline on firewalls and firewall policy, covers writing and managing rules so only needed traffic is allowed.
How to check or apply this
- Scan your own address ranges on a schedule from outside the network.
- Compare each result against an approved list of services and owners.
- Close or restrict anything unexpected the same day.
- Move administrative ports behind a VPN or access broker.
- Log connection attempts and alert on one source touching many ports.
- Get written permission before scanning anything you do not own.
Quick check
Does a closed port mean the host is safe?
No. It means nothing is listening on that port. Other ports or other layers, such as the web application, can still be vulnerable.
Why do scanners report filtered ports?
Because the probe got no answer, which often means a firewall dropped it. The scanner cannot tell whether a service sits behind the filter.
Sources
- RFC 9293, Transmission Control Protocol
- IANA, Service Name and Transport Protocol Port Number Registry
- MITRE ATT&CK, Enterprise tactics
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
Last reviewed: 18 October 2026.
