Port Scanning, Explained
Port scanning probes a host to discover which ports are open and what services listen behind them. It is the mapping step that precedes almost everything else — you cannot attack, or defend, what you have not first enumerated. For defenders, scanning your own systems is how you find the exposure an attacker would find first.
How does a port scan work?#
A scanner sends packets to a range of ports and reads the responses to classify each as open, closed, or filtered:
| Scan type | How it works | Trait |
|---|---|---|
| TCP connect | Completes the full handshake | Reliable, noisy |
| SYN (“half-open”) | Sends SYN, never finishes | Fast, stealthier |
| UDP | Probes connectionless services | Slow, tricky |
| Version/service detection | Interrogates open ports | Identifies software |
The result is a picture of the host’s reachable services and ports, often with software versions — exactly the input an attacker uses to look for known vulnerabilities.
Why does it matter to both sides?#
For attackers, scanning is the reconnaissance stage of the Cyber Kill Chain. For defenders, it is a routine part of attack-surface management — scan yourself regularly, and you discover the forgotten open port before someone else does.
Port scanning is the front door of reconnaissance. See Nmap for the tool, and more at the Network Security hub.
Frequently asked questions#
What is port scanning?
Port scanning probes a host to discover which network ports are open and what services are listening on them. By sending packets to a range of ports and interpreting the responses, a scanner builds a map of the host’s reachable services — the first step in both attacking and defending a system, since you must know what is exposed.
Is port scanning legal?
Scanning systems you own or have written permission to test is legal and routine. Scanning systems without authorization is, at best, a legal gray area and, in many jurisdictions and contexts, an offense — and it is often logged and treated as hostile reconnaissance. As always, authorization is the line.