Skip to content

Intermediate · Scanning with nmap · topic 12 of 35 · 16 min

Ports, services and what scanning does

Explanation

A port is a numbered door on a machine where a service listens, such as 80 for web or 22 for SSH. Scanning asks each door whether it is open. Knowing which services are open and which versions they run tells a tester what to examine next.

Ports: numbered doors

When one computer talks to another, it does not just reach "the machine"; it reaches a specific service through a numbered door called a port. A web server listens on port 80 (HTTP) or 443 (HTTPS). SSH (remote login) listens on 22. Email, databases and other services each have their usual ports. There are 65,535 ports.

PortServiceNote
22SSHSecure remote login
80HTTPWeb, unencrypted
443HTTPSWeb, encrypted with TLS
3306MySQLA database
3389RDPWindows remote desktop
25 / 587SMTPSending email

What a scan actually asks

Scanning is sending small messages to a range of ports and noting the replies. A port can be open (a service is listening), closed (nothing listening but the host replied), or filtered (a firewall blocked the reply, so you cannot tell). The pattern of open ports is like a list of the doors into a building.

Think of it like this: Imagine walking along a corridor and gently trying each door handle to see which rooms are open. Scanning does that for a computer's ports. An authorised building manager does it to check security; a burglar does the same thing to break in. The action is identical — authorisation is everything.

Why versions matter

Knowing a port is open is useful; knowing the exact software and version behind it is far more useful. "Port 21 open" is a start; "vsftpd 2.3.4" tells a tester to look up whether that version has known issues. That is why service and version detection, covered next, is such an important step.

Careful: Scanning contacts the target, so it is active. Only scan systems you are authorised to test and that are in scope. Scanning a random internet host can be treated as an offence under the IT Act, as module 1 explained.

Detection and defence (preview)

Scanning is noisy: it creates many connections in a short time, which firewalls, IDS and SIEM can flag. Defenders reduce exposure by closing unused ports, putting services behind a firewall, and alerting on scan-like traffic. A tester should expect their scans to be noticed on a well-run network.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

Ports, services and what scanning does · 1/7

Port = a door, 1 to 65535

A port is a numbered door where a service listens.

Prefer a video by a teacher? Find free videos on “computer ports explained open closed filtered beginners” on YouTube ↗

In real life: Mapping a lab box

A learner scans the Metasploitable VM in her lab and sees ports 21, 22, 23, 80 and 3306 open. Each is a door: FTP, SSH, Telnet, web and MySQL. She now knows where to look. She also notes that a real server should not expose Telnet (port 23) at all, because it is unencrypted — a defensive observation she records alongside the finding.

Practice (0/3 done)

Task 1 · Question

A port is…

Task 2 · Question

Which port is normally HTTPS?

Task 3 · Code · Python

Write service_for(port) that returns the common service name for a few ports: 22 -> "SSH", 80 -> "HTTP", 443 -> "HTTPS", 3306 -> "MySQL". For any other port return "unknown".

Quick quiz

Question 1

1.An "open" port means…

Question 2

2."Filtered" in a scan usually means…

Question 3

3.Why does the service version matter?

Question 4

4.A defender can reduce scan exposure by…

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

An "open" port means…

Answer: A service is listening there

Open means a service is listening and accepting connections.

"Filtered" in a scan usually means…

Answer: A firewall blocked the reply, so you cannot tell

Filtered means something (often a firewall) stopped the reply.

Why does the service version matter?

Answer: It tells you whether that exact software has known issues

A specific version lets a tester check for known weaknesses.

A defender can reduce scan exposure by…

Answer: Closing unused ports and using a firewall

Fewer open ports and a firewall shrink the attack surface.

Which port range does your computer usually pick its source port from?Related

Answer: 49152–65535

Clients use dynamic (ephemeral) ports, 49152–65535 in the IANA range.

From Ports and protocols

Enumeration is noisier than scanning because it…Related

Answer: Sends many requests and produces many 404s

The volume of requests and error responses stands out in logs.

From Enumeration: digging into services

A SYN scan (-sS) is often preferred because it is…Related

Answer: Faster and does not complete the handshake

It sends only the first handshake step; faster and slightly quieter, but still detectable.

From nmap scan types

A matching defence is to…Related

Answer: Hide/patch versions and disable unused services

Reveal less, patch, and reduce the attack surface.

From Service, version and OS detection, and NSE

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: nmap scan types →

Next steps

  1. 2 more topics in “Scanning with nmap” before its exam: nmap scan types, Service, version and OS detection, and NSE.
  2. Module 4 exam: scanning with nmap · 12 questions · 20 min, without help. 3 topics of this module still to finish first.
  3. Then the next module, Enumeration and vulnerability assessment. 35 topics left in the course before the final exam.

← Previous: Active reconnaissance