PortScanning

Port scanning is the practice of probing a host or network to determine which network ports are accessible and which services are listening on those ports. It is used for network inventory, security assessments, and troubleshooting, as well as by attackers seeking entry points. The results help administrators map services, verify configurations, and identify potential misconfigurations or exposed services.

Scan results typically indicate an open port (service reachable), closed port (no response or reset), or filtered port (traffic blocked by firewall or filtering device). Port state assessment may be affected by firewalls, NAT, rate limiting, and intrusion detection systems, which can mask or alter outcomes.

Common scan techniques examine how a target responds to different protocol probes. TCP-based scans rely on the behavior of the TCP three-way handshake and flag usage, while UDP scans test for reachable UDP services. Some scans use stealthier flag combinations to evade simple protections. Scans may be authenticated as a legitimate administrator in authorized engagements or conducted without consent, which raises legal and ethical concerns.

Tools such as Nmap and Masscan automate port scanning and service discovery, but their use should follow applicable laws and organizational policies. Scans can generate significant network traffic and trigger alerts, so planning and authorization are essential.

Defenses against unauthorized scanning include firewalls that filter or rate-limit incoming probes, IDS/IPS that detect scanning patterns, network segmentation, and regular asset inventories to maintain accurate service maps.