[ TCP connect scan | Check open/closed/filtered ports ]
// Only scan systems you own or have permission to test.
// Comma-separated or range. Max 30 ports per scan.
21 FTP: File Transfer Protocol. Often open on web hosting servers. Should be disabled if not used.
22 SSH: Secure Shell. Critical for server management. Brute-force attacks are common — always use key-based auth.
80/443 HTTP/HTTPS: Web servers. 443 should always be open; 80 should redirect to 443.
3389 RDP: Remote Desktop Protocol. Extremely common attack target. Never expose to the internet unless behind a VPN.
3306 MySQL / 5432 PostgreSQL: Databases should NEVER be open to the internet. Restrict to localhost or private network.
Port scanning is the process of probing a network host to discover which TCP or UDP ports are open and accepting connections. Every internet-facing server has 65,535 possible TCP ports and 65,535 UDP ports. Each open port represents a running service — a web server on port 80, a database on port 3306, an SSH daemon on port 22.
Port scanning is a fundamental tool in both network administration (knowing what's exposed) and security testing (finding attack surface). System administrators run regular port scans to verify that only intended services are accessible and that no unauthorized services have been started. Security professionals use port scans as the first step in understanding a target's attack surface during authorized penetration tests.
An open port means a service is actively listening and accepted our TCP connection (completed the SYN → SYN-ACK → ACK handshake). Open ports represent services that are accessible from the internet. Examples: a web server on port 443, an SSH server on port 22, a mail server on port 25. Open ports are not inherently dangerous — a secure, patched HTTPS server on port 443 is perfectly safe. Danger arises when unnecessary or unpatched services are open.
A closed port means the host is reachable and responded with a TCP RST (reset) packet — the port is accessible but no service is currently listening. Closed ports tell an attacker the host is alive and the port is reachable (useful reconnaissance), but no immediate service is exploitable. Consider firewalling off closed ports to prevent this information leakage.
A filtered port returns no response (timeout). A firewall, packet filter, or router is silently discarding the probe packets. From a security perspective, filtered is better than closed because it gives attackers less information. Most cloud providers (AWS, Azure, GCP) default to filtering all ports not explicitly opened in security group rules.
| Port | Service | Risk if exposed | Recommendation |
|---|---|---|---|
| 21 | FTP | High — credentials sent in plaintext | Disable. Use SFTP (port 22) instead |
| 22 | SSH | Medium — constant brute-force attacks | Change to non-standard port + key-only auth |
| 23 | Telnet | Critical — fully plaintext | Disable immediately, use SSH |
| 25 | SMTP | High if open relay | Require AUTH, restrict to trusted IPs |
| 80 | HTTP | Low — redirect to HTTPS | Keep open, redirect all traffic to 443 |
| 443 | HTTPS | Low if TLS is current | Keep open, monitor cert expiry |
| 3306 | MySQL | Critical | Never expose to internet — bind to localhost |
| 3389 | RDP | Critical — top attack vector | Close, use VPN + RDP internally only |
| 5432 | PostgreSQL | Critical | Never expose to internet |
| 6379 | Redis | Critical — no auth by default | Bind to localhost + set password |
| 27017 | MongoDB | Critical — many unsecured installs | Bind to localhost + enable auth |
| 8080 | HTTP alt | Medium | Check what's running — often dev servers |
Only open ports that are absolutely necessary. On Linux servers, use ufw or iptables. On cloud providers, use security groups (AWS), firewall rules (GCP/DigitalOcean), or NSGs (Azure). The default rule should be: deny all inbound, then explicitly allow only what's needed.
An open port running an outdated, unpatched service is a critical vulnerability. Subscribe to security advisories for every service you run and apply patches promptly. Most large-scale breaches exploit known vulnerabilities for which patches already exist.
For services like SSH, RDP, or database management tools, consider placing them behind a VPN and keeping the ports filtered to all public IPs. Port knocking is another technique that keeps ports invisible until a specific sequence of connection attempts is made.
Malware, misconfigured applications, and unauthorized services can open new ports. Run regular port scans against your own systems and alert on any newly opened port. Tools like nmap and this online scanner can help establish a baseline and detect drift.
For comprehensive port scanning beyond what a browser-based tool can offer, these tools are industry standard:
nmap -sV -p 1-65535 target-ipnc -zv target-ip port