Every device connected to the internet has 65,535 TCP ports and 65,535 UDP ports. Most of them are closed. A handful are listening. And a small, dangerous subset are listening when they should not be.
Port scanning is how you find out which is which. It is also how attackers find their way in before you do.
What a port actually is
A port is not a physical thing. It is a 16-bit number that the operating system uses to route incoming network connections to the right program. When your browser connects to a web server, it sends traffic to port 443 (HTTPS) or port 80 (HTTP). Your SSH client connects to port 22. MySQL listens on 3306. These assignments are standardized by IANA, though any program can listen on any port.
When a port is "open," there is a process actively waiting for connections on that port. "Closed" means the OS responds with a reset, confirming the port exists but nothing is listening. "Filtered" means a firewall is silently dropping packets so you cannot tell either way. That last state is common and maddening to diagnose.
How nmap became the standard
Gordon Lyon, who goes by "Fyodor" online, wrote the first version of nmap in 1997 and posted it to the Phrack hacker zine. It has been the de facto standard for port scanning ever since. The reason is simple: it does everything. TCP SYN scans, UDP scans, version detection, OS fingerprinting, scriptable probes via the Nmap Scripting Engine. Security teams use it for audits. Attackers use it to case targets. The tool itself is neutral.
A basic scan looks like this:
nmap -sV -p 22,80,443,3306,3389 192.168.1.1
The -sV flag tells nmap to probe open ports for service version information. Without it, you know a port is open but not what is running. With it, you might learn the server is running OpenSSH 8.9 or Apache 2.4.54, which tells you exactly which CVEs to check.
The scan types that matter
A TCP SYN scan, also called a half-open scan, is the default in nmap when run as root. Instead of completing the three-way TCP handshake, nmap sends a SYN packet and waits. An open port replies with SYN-ACK. nmap sends RST to abort the connection before it fully establishes. This is fast, stealthy relative to a full connect scan, and leaves minimal log entries on the target.
A full connect scan completes the handshake. It is louder and slower, but it works without root privileges because it uses the OS networking stack directly. It also shows up clearly in logs.
UDP scanning is a different problem entirely. UDP is connectionless, so there is no handshake to observe. nmap sends a UDP packet and waits. If the port is closed, the target typically returns an ICMP "port unreachable" message. If it is open, there is often just silence, which is indistinguishable from filtering. UDP scans are slow and imprecise, but they matter because many critical services sit on UDP: DNS on port 53, DHCP on 67/68, SNMP on 161, NTP on 123.
What Shodan knows about your server
Shodan is a search engine that continuously scans the entire public internet and indexes what it finds. As of 2024, it had over 500 million indexed devices. Go to shodan.io and search for your organization's IP range. You may be surprised what it has catalogued.
The platform is used legitimately by security researchers and system administrators checking their own exposure. It is also used by attackers doing reconnaissance without ever touching a target directly. What Shodan reveals is sobering: in 2024 its data showed more than 2.5 million Redis instances publicly accessible without authentication, and over 800,000 exposed MongoDB databases. Most of those owners had no idea.
The ports that get people into trouble
Port 22 (SSH) left open to the public internet will receive automated brute-force attempts within minutes of a server going live. This is not theoretical, it is the baseline noise of the internet. Changing SSH to a non-standard port (say, 2222) reduces noise but provides no real security. What actually helps is key-based authentication only, with password auth disabled.
Port 3389 is RDP, Remote Desktop Protocol. It was one of the primary vectors for ransomware distribution in 2019 and 2020, including the BlueKeep vulnerability (CVE-2019-0708) and the later EternalBlue-based attacks. RDP exposed directly to the internet is still a common finding in penetration tests.
Ports 3306 and 5432 are MySQL and PostgreSQL respectively. Both should never be reachable from outside your network perimeter unless you have an explicit reason. The same applies to port 27017 for MongoDB and 6379 for Redis, neither of which has authentication enabled by default in older configurations.
Port 445 is SMB, the Windows file sharing protocol. EternalBlue exploited an SMB vulnerability to enable WannaCry and NotPetya in 2017. SMB on port 445 exposed to the internet remains a high-severity finding in any security audit.
What masscan tells you about speed
Robert Graham wrote masscan in 2013 to demonstrate a point: the entire public IPv4 address space can be scanned in under six minutes with a fast enough network connection. It is asynchronous, blindingly fast, and routinely used by researchers to take internet-wide measurements. Censys and Shodan both use similar techniques at scale.
The implication is that if your server has an open port, it will be found quickly. Obscurity through non-standard ports buys hours at best. Actual security comes from authentication, patching, and not exposing services that have no business being public.
Running a scan against yourself
Before reaching for nmap, try our Port Checker tool for a quick external view of common ports. For a thorough internal audit, nmap with the -A flag (OS detection, version detection, script scanning, traceroute) gives you what a real attacker would see from outside your network.
A few things to check: any port open that you cannot explain, any service running an outdated version with known CVEs, any administrative interface (web-based router admin, database management tool) reachable from outside your LAN.
Frequently asked questions
Is port scanning illegal?
In most jurisdictions, scanning your own systems is clearly legal. Scanning systems you do not own without permission is a grayer area and can violate computer fraud laws in the US, UK, and EU even if the scan itself causes no damage. The courts have generally treated unauthorized scanning as at minimum a civil wrong. When in doubt: only scan what you own.
Why does nmap show a port as filtered?
A firewall is dropping packets without sending a response. This could be a stateful firewall rule, a security group in AWS/GCP, or a host-based firewall like iptables or Windows Firewall. Filtered is not the same as closed, it means there may or may not be something listening, but you cannot tell from outside.
What is the difference between TCP and UDP scanning?
TCP has a handshake, so you get reliable open/closed signals. UDP is connectionless, so detecting open ports requires application-layer knowledge. nmap's UDP scan is much slower because it has to handle timeouts for every "silence" response.
Can I scan IPv6 addresses with nmap?
Yes. Add the -6 flag: nmap -6 2001:4860:4860::8888. IPv6 scanning via masscan-style internet-wide sweeps is impractical due to the address space size, which is actually a security advantage of IPv6.
Check your own exposure: Port Checker and Site Check.