TCP Port Scanner

Identify open, closed, or firewalled TCP ports on a given IP or domain to assess external attack surface.

Understanding Port States

This scanner attempts to establish a full TCP connection handshake (SYN-ACK) to the specified ports within a short timeout window.

OPEN: The target machine accepted the connection. A service (like a web server or SSH daemon) is actively listening.
CLOSED: The target machine explicitly rejected the connection (RST packet). The server is online, but no service is listening on that port.
FILTERED / TIMEOUT: The connection request was dropped entirely. This usually indicates a firewall (hardware or software like iptables/UFW) is actively blocking traffic to that port.

Security Best Practice: Production servers should only have essential ports OPEN to the public internet (usually 80 and 443). Administrative ports like SSH (22), RDP (3389), or Databases (3306, 5432) should be FILTERED and only accessible via VPN or whitelisted IPs.

Our Port Scanner checks which common TCP ports are open on a host, identifying the services exposed to the internet. Use it on infrastructure you own or are authorised to test, to find services listening that you did not intend to publish.

What is Port Scanning?

Port scanning determines which network ports on a host accept connections. Each open port represents a service listening and reachable from wherever the scan originated.

A TCP connection begins with a three-way handshake. A scanner attempts that handshake and interprets the response: a completed handshake means the port is open, an explicit reset means it is closed, and no response at all usually means a firewall is dropping the traffic silently.

The distinction between closed and filtered matters. A closed port means the host is reachable but nothing is listening. A filtered port means a firewall discarded the packet without replying, which tells an attacker less and is generally the preferable configuration for anything not intended to be public.

Determines which ports accept network connections
Each open port is a service reachable from the network
Open means listening; closed means reachable but nothing there
Filtered means a firewall dropped the packet without replying
Only scan hosts you own or are explicitly authorised to test

Why Port Scanning Matters

Services end up exposed without anyone intending it. A database installed for local development binds to all interfaces, a management port is opened during troubleshooting and never closed, a container publishes a port to the host, or a firewall rule is added for a test and forgotten. None of these produce any visible symptom.

Scanning your own infrastructure is how you find them. Exposed databases in particular are a persistent source of large data breaches, because default configurations frequently have weak or absent authentication, and the internet is scanned continuously by automated tools looking for exactly that.

Finds services exposed unintentionally through configuration drift
Exposed databases are a recurring cause of major data breaches
Management ports such as SSH and RDP are constantly attacked
The internet is scanned continuously by automated tooling
Regular self-scanning is a basic attack surface control

How This Port Scanner Works

The tool attempts TCP connections to a set of common ports and records the outcome.

Validates the host input against format and SSRF safety checks
Resolves the hostname to an address if needed
Attempts a TCP connection to each port in the scanned set
Records whether each port is open, closed or filtered
Identifies the service conventionally associated with each open port

How to Use the Port Scanner

Enter a hostname or IP address you own or are authorised to test
Run the scan to check the common port set
Review which ports are open
Confirm each open port corresponds to a service you intend to expose
Close or firewall anything unexpected, then re-scan to verify

Understanding Your Port Scan Results

Each port returns one of three states, and the common ports carry conventional meanings:

Field / Value	Meaning
`Open`	A service accepted the connection. Every open port is reachable attack surface and should correspond to something you deliberately publish.
`Closed`	The host replied with a reset — reachable, but nothing listening on that port. It confirms the host exists, which is itself minor information disclosure.
`Filtered`	No response at all, meaning a firewall dropped the packet. Generally the preferred state for anything not intended to be public, since it reveals less.
`22 SSH`	Remote shell access. Constantly targeted by credential stuffing. Should use key-based authentication only, and ideally be restricted by source address.
`80 and 443`	HTTP and HTTPS. Expected on a web server. Port 80 should redirect to 443 rather than serving content.
`3306, 5432, 27017, 6379`	MySQL, PostgreSQL, MongoDB and Redis. None of these should ever be reachable from the internet. Their exposure is a frequent cause of large breaches.
`3389 RDP`	Windows Remote Desktop. Heavily targeted, and a primary initial access vector for ransomware. Should be behind a VPN, never directly exposed.
`25, 465, 587`	SMTP ports. Expected on a mail server. Port 25 accepting mail for arbitrary destinations means an open relay, which is a serious misconfiguration.

Common Problems & How to Fix Them

This is a critical finding. Exposed MySQL, PostgreSQL, MongoDB, Redis and Elasticsearch instances are scanned for continuously and are a recurring cause of large data breaches — many ship with weak or no default authentication.

Bind the service to localhost or a private interface rather than 0.0.0.0, and add a firewall rule restricting the port to known internal addresses. Applications should reach the database over a private network, never across the public internet.

Direct RDP exposure is one of the most common initial access vectors for ransomware.

Put it behind a VPN, or use a bastion host with multi-factor authentication. If it must remain reachable, restrict the source addresses to a known allowlist and enable network level authentication and account lockout.

Port 22 receives continuous automated credential attempts on any public address.

Disable password authentication entirely and use keys only. Restrict the source addresses where possible, and deploy rate limiting such as fail2ban. Moving to a non-standard port reduces log noise but is not itself a security control.

Unidentified listening services are either forgotten software, a container publishing a port to the host, or something genuinely malicious.

Identify the process bound to the port on the host itself, using ss or netstat. Do not simply firewall it and move on — an unrecognised listener may indicate a compromise that needs investigating.

Either a firewall is dropping all traffic from the scanner, or the host is offline.

This is usually good news for a host that should not be publicly reachable. Verify from a network that is meant to have access, to confirm legitimate services are still working.

Best Practices

Expose only the ports a service genuinely requires
Bind databases and internal services to localhost or a private interface
Prefer filtered over closed for ports that should not be public
Restrict management ports by source address wherever possible
Re-scan after every infrastructure change or deployment
Investigate unrecognised open ports rather than simply blocking them
Scan from outside your network, since an internal scan sees a different picture

Security Recommendations

Only scan hosts you own or have explicit written authorisation to test, since unauthorised scanning may be unlawful
Treat any internet-reachable database port as a critical finding requiring immediate remediation
Never expose RDP directly, as it is a leading ransomware entry point
Assume every open port is being probed continuously by automated tooling
Use a VPN or bastion host for administrative access rather than exposing management ports
Combine port scanning with service version checks, since an open port running outdated software is the real risk
Apply the same discipline to IPv6, where firewall rules are frequently missing entirely

Frequently Asked Questions

A check of which network ports on a host accept connections. Each open port indicates a service listening and reachable from wherever the scan originated, which is how you map the attack surface of a system.

Scanning systems you own or have written authorisation to test is legitimate and routine. Scanning third-party systems without permission may constitute unauthorised access in many jurisdictions. Always obtain authorisation first.

Closed means the host replied with a reset — it is reachable but nothing is listening. Filtered means no reply came at all, because a firewall dropped the packet. Filtered reveals less and is preferable for anything not meant to be public.

Database ports such as 3306, 5432, 27017 and 6379 should never face the internet and are a recurring cause of breaches. RDP on 3389 is a leading ransomware entry point. SSH on 22 is safe when properly configured but is attacked continuously.

After every significant infrastructure change, and on a regular schedule regardless. Configuration drift is gradual and silent — ports opened for troubleshooting and never closed are a common finding.

It reduces automated noise in your logs but provides no real protection against a targeted attacker, who will simply scan for it. Key-based authentication and source restrictions are the controls that matter.

Because firewall rules differ by source. Internal scans see services intentionally restricted to the private network. Always scan from outside to see what the internet actually sees, which is the view that matters for exposure.