Overview
Scanning determines which ports on a target are open and what may be behind them. Understanding port concepts — building on the networking path — is the foundation. This lesson reviews ports in the scanning context.
Learning objectives
- Recall ports and port states relevant to scanning.
- Explain what open/closed/filtered mean.
- Connect port states to attack surface.
Core concept
Recall that a port (0–65535) identifies a service endpoint on a host. Scanning probes ports to determine their state, commonly reported as:
- Open — a service is listening and accepting connections (part of the attack surface).
- Closed — no service is listening, but the host responded (reachable).
- Filtered — a firewall or filter is blocking, so the state cannot be determined.
Knowing which ports are open reveals the services exposed on a host — the entry points worth investigating.
How it works
A scan sends probes to ports and interprets the responses to classify each as open, closed, or filtered. Open ports indicate listening services (the attack surface); closed ports mean the host is up but nothing is listening there; filtered means something is blocking the probe (often a firewall), leaving the true state unknown. This mapping of port states turns a bare host into a picture of its exposed services, which service identification (from active recon) then details further. Port states directly inform where to focus enumeration and testing.
Practical example
Scanning an in-scope host classifies ports: 22, 80, and 443 open (SSH and web services listening — the attack surface), most others closed (host up, nothing listening), and a few filtered (a firewall blocking, state unknown). From this, the tester knows the host exposes SSH and web services and that a firewall is present. The open ports become the focus for service identification and further testing; the filtered ports note firewall presence.
Cybersecurity relevance
Port scanning is a foundational recon/assessment activity (and classic attacker behavior), revealing a host's exposed attack surface. The state distinctions matter: open ports are entry points, filtered ports indicate defensive controls. For defenders, minimizing open ports (attack-surface reduction, from the networking firewall lessons) and filtering unnecessary ones is key hardening, and detecting scans is an early-warning signal. Understanding port states is the basis for interpreting scans correctly, which later lessons build on.
Common mistakes
- Treating filtered as closed (or vice versa) — filtered means the state is unknown due to blocking.
- Focusing only on common ports and missing services on unexpected ports.
- Equating an open port with a vulnerability — it is an entry point to investigate, not itself a flaw.
Key takeaways
- Scanning classifies ports as open (service listening — attack surface), closed (host up, nothing listening), or filtered (blocked, state unknown).
- Open ports reveal exposed services and entry points; filtered ports indicate firewalls/filters.
- Port scanning maps a host's attack surface (classic recon); minimizing open ports is key hardening, and understanding states is the basis for interpreting scans.
Check your understanding
- What is the difference between a closed port and a filtered port?
- Why are open ports significant when assessing a host's attack surface?