portstate

Portstate refers to the current status of a network port on a host or device. It is a concept widely used in network scanning, firewall management, and connectivity troubleshooting. Portstate indicates whether a port is open, closed, filtered, open|filtered, or unknown, and it helps administrators understand which services are reachable from a given vantage point.

An open port means a service is listening on that port and can accept connections. A closed port responds to probes but has no service listening, indicating it is not accepting connections. A filtered port is one where packets are blocked by a firewall or other network device, preventing the scanner from determining whether the port is open. Open|filtered denotes ambiguity: the port could be open but behind filtering, or it could be filtered and closed. Unknown is used when there is insufficient information to classify the port state.

Portstate is typically determined through probes sent by tools such as Nmap, Netcat, or other network scanners. The responses observed—such as a SYN-ACK, a RST, or no response—are used to infer the state. In TCP, the handshake and subsequent responses help distinguish open versus closed, while in UDP, lack of response may indicate filtering rather than a closed state.

Understanding portstate is important for security assessments, asset inventory, and network troubleshooting. It informs decisions about firewall rules, exposure of services to networks, and potential remediation steps. Limitations include the possibility of false readings due to rate limiting, dynamic port behavior, or anti-scan defenses. Portstate does not reveal the full security posture or the contents of the services behind open ports; it only characterizes reachability and exposure.

See also: port scanning, TCP state, firewall, Nmap.