Port scanning is the technique of sending probes to a host’s network ports to find out which ones are open and which services and versions are listening on them.
How port scanning works
Network services listen on numbered TCP and UDP ports – for example 22 for SSH, 443 for HTTPS or 3389 for RDP. A scanner sends packets to a range of ports and classifies them as open, closed or filtered (no reply, usually because of a firewall). Common scan types:
- TCP connect scan – completes the full three-way handshake; simple but easily logged.
- SYN (“half-open”) scan – sends SYN and analyses the response without completing the connection.
- UDP scan – slower and less reliable, since closed UDP ports may not answer.
- Service and version detection – grabbing banners to identify software and versions.
Nmap, released by Gordon Lyon in 1997, is the classic tool; masscan and ZMap can scan the entire IPv4 internet in minutes. Search engines such as Shodan and Censys publish the results of continuous internet-wide scans.
Why port scanning matters
For attackers, port scanning is reconnaissance: it reveals exposed RDP, VPN, database or management interfaces with known vulnerabilities. MITRE ATT&CK lists it under Active Scanning (T1595) and Network Service Discovery (T1046) for scanning inside a compromised network. After a new vulnerability is disclosed, mass scanning for affected systems often starts within hours. Defenders use the same technique to map their attack surface and during penetration testing.
How to defend against port scanning
- Close unused ports and expose management services only via VPN or zero-trust access.
- Filter inbound traffic with firewalls and segment internal networks.
- Detect scans with an intrusion detection system and investigate internal scanning, a sign of lateral movement.
- Regularly scan your own external IP ranges to find forgotten services before attackers do.
