Port Scanning Deep Dive

Host discovery narrowed a subnet full of dead addresses down to the machines that actually answered. That list is only addresses. It says a machine is alive. It says nothing about what that machine will talk to.

Port scanning is the next question, asked of every live host: which doors are open? Port scanning means probing a host's ports to find which ones have a program waiting behind them. A port is a 16-bit number, 0 through 65535, that picks out one conversation on a machine, so a single host can run a web server, a login service, and a database at once without their traffic colliding. Numbers under 1024 are the well-known ports, where standard services like SSH on 22 and HTTP on 80 sit by convention. Find an open port and you have found something that will answer. That is why scanning comes first: you cannot attack a service you do not know is there.

The handshake every TCP scan bends

Almost every TCP scan is a trick played on one exchange, so that exchange is worth pinning down. Before two machines send any TCP data, they run the three-way handshake. The client sends a SYN, meaning "I want to talk." The other side answers SYN-ACK, meaning "go ahead, I am here." The client sends ACK, and the connection is open.

That middle message is the whole tell. A machine only sends SYN-ACK from a port where something is listening: a daemon bound to a socket, waiting for connections. A port with nothing behind it does not negotiate. It answers a SYN with RST, a flat "nothing here, go away." So the reply to a single SYN already sorts a live service from a dead port, before any real data moves. Every scan below is built on reading that one reply.

SYN, connect, and UDP

nmap gives three scans that matter early, and the split between them comes down to privilege, speed, and how much noise each one leaves in the target's logs.

A SYN scan (-sS) sends the SYN, reads the reply, and stops. SYN-ACK back means the port is open, and the scanner never sends the final ACK. The scanning host's own kernel, seeing a SYN-ACK for a connection it never opened, fires off a RST that tears the half-open attempt down. Because the handshake never completes, this is called half-open scanning, and it is both fast and comparatively quiet. It is the default when nmap runs as root, because crafting a bare SYN by hand needs raw-socket access that only a privileged user has. There is a second reason it stays quiet: the connection never completes, so the listening application's accept never fires and the service has no session to log. Only a sensor watching raw packets on the wire notices at all.

A connect scan (-sT) hands the job to the operating system's own connect call, the same one every ordinary program uses to open a TCP connection. It runs the handshake all the way to ACK, so it needs no special privileges, which is exactly why nmap falls back to it when it is not root. The cost is noise. The connection fully opens and then closes, so the service sees a complete session and is far more likely to write it to a log.

A UDP scan (-sU) probes UDP services like DNS on port 53, SNMP on 161, and DHCP on 67. UDP has no handshake, so silence is ambiguous. An open UDP port often just swallows the packet and says nothing, and a firewall dropping the probe also says nothing, so nmap cannot tell those two apart and marks the port open|filtered. A closed UDP port is the only clean signal: the host answers with an ICMP port-unreachable message. Most operating systems rate-limit those ICMP replies to roughly one per second, so a UDP scan across many ports crawls. That is the case for skipping UDP on the first pass and coming back to a short list of high-value ports later. SNMP on UDP 161 alone has handed over credentials for entire networks, so "skip it" is not "skip it forever."

$sudo nmap -sS 10.10.14.23

$nmap -sT 10.10.14.23

$sudo nmap -sU --top-ports 20 10.10.14.23

Open, closed, filtered

Every TCP port nmap reports lands in one of three states, and each state is just a plain name for the packet the target sent back.

• open: a SYN-ACK came back. Something is listening. This is a live door and a real lead.
• closed: a RST came back. The host is up and reachable, but no service is bound to that port.
• filtered: nothing useful came back, or an ICMP error did. A firewall or filter is dropping the probe, and nmap cannot see whether anything sits behind it.

The gap between closed and filtered is the one people miss, and it changes what the scan is telling you. Closed is an answer: the host is right there, that particular door is just empty. Filtered is a wall: the probe never reached the port, or the reply never made it back. A scan that comes back all filtered means a firewall stands between the scanner and the host. A scan with a healthy mix of open and closed means the packets are reaching the machine directly, which is the easier position to work from.

Filtered also costs time. When a probe goes unanswered, nmap does not give up on the first try. It retransmits and waits before declaring the port filtered, which is why a heavily firewalled host scans far slower than one that answers every port with a clean RST or SYN-ACK.

Read that carefully. "Not shown: 997 closed tcp ports (reset)" means 997 ports answered with RST, so nmap folded them into one line instead of printing each. Three ports answered with SYN-ACK and got listed as open. The ssh, http, and mysql labels are not confirmed; they are lookups from a table of what usually runs on those numbers, and the next lesson is where that guess gets checked.

Scan wide, then scan deep

Left alone, nmap checks its top 1000 ports and no more. Real targets do not cooperate with that. A service gets moved off its usual port precisely so a lazy scan misses it: SSH relocated to 2222, an admin panel parked on 8834. The answer is two passes.

First, sweep every port. -p- tells nmap to scan all 65535 instead of the top 1000. Pair it with --min-rate 1000, a floor on packets sent per second, and -T4, a timing template that scans aggressively on a network that can take the load. nmap has six templates, -T0 through -T5; -T3 is the default, and -T4 is fast without being reckless. Save the result to a file with -oN.

Then scan deep, but only on the ports that came back open. Feed those into -p 22,80,3306 and run the slower, information-heavy scans there. Fingerprinting all 65535 ports would burn hours. Fingerprinting the three that are actually open takes seconds.

$nmap -p- --min-rate 1000 -T4 10.10.14.23 -oN allports.txt

$nmap -p 22,80,3306 10.10.14.23

One more flag earns its place next to these. Host discovery marks a machine down when it ignores ping, but plenty of hosts drop ping while quietly serving ports behind a firewall. If the target is known to exist, -Pn tells nmap to skip discovery and scan it anyway, so the firewall's silence does not hide a live box.

A finished sweep hands over a column of open ports and nmap's guess at each service. That guess is only a guess. The next lesson, service and version detection, is where the scan stops guessing and the target starts telling you exactly what it runs, down to the version string you feed into a search for known holes.