Network Intelligence
Scan common ports safely. Educational tool — shows open/closed ports and service names. No aggressive scanning.
Port scanning is the process of probing a host to determine which network ports are open, closed, or filtered. Each port represents a potential entry point for network services: port 80 for HTTP, port 443 for HTTPS, port 22 for SSH, port 3389 for RDP. Open ports indicate running services, and understanding which services are exposed is fundamental to network security, asset inventory, and attack surface management.
For security professionals, port scanning is a core reconnaissance technique. Before assessing a system, you need to know what services are running. An unexpected open port like 3306 (MySQL) exposed to the internet represents a critical vulnerability. A system with SSH open but no business justification for remote access warrants investigation. Port scanning reveals the attack surface that firewall rules and network configuration create.
This tool performs safe, educational port scanning against common ports only. It connects to standard service ports and reports whether they accept connections, then identifies the service typically associated with each port. This provides a basic understanding of a system's exposed services without the aggressive scanning techniques that can trigger intrusion detection systems.
A port scanner attempts to establish a TCP connection to a range of ports on a target host. For each port, the scanner sends a SYN packet and waits for a response. If the target responds with SYN-ACK, the port is open and a service is listening. If it responds with RST, the port is closed. If there is no response, the port may be filtered by a firewall.
Different scan types serve different purposes. A SYN scan (half-open scan) completes the TCP handshake partially, making it faster and stealthier than a full connect scan. A TCP connect scan completes the full handshake, which is more reliable but more easily logged. This tool uses safe connect scanning that establishes a normal connection, making it visible but non-disruptive.
Understanding scan types matters for both attackers and defenders. Attackers use stealthier scan types to avoid detection, while defenders need to recognize different scan signatures in their logs. SYN scans leave partial connection logs, while connect scans create full connection entries. Recognizing these patterns in firewall and IDS logs is a key detection skill.
Understanding common ports and their associated services is essential for both scanning and interpretation. Port 21 (FTP) and port 23 (Telnet) are legacy services that transmit credentials in plaintext and should never be exposed to the internet. Port 22 (SSH), port 3389 (RDP), and port 5900 (VNC) provide remote access and are primary targets for brute-force attacks.
Web services run on ports 80 (HTTP), 443 (HTTPS), and sometimes 8080 or 8443 for development and management interfaces. Database ports like 3306 (MySQL), 5432 (PostgreSQL), and 27017 (MongoDB) should never be exposed to the public internet. Mail ports 25 (SMTP), 110 (POP3), 143 (IMAP), and 587 (submission) indicate email infrastructure.
When scanning reveals unexpected open ports, investigate immediately. An unknown port may indicate unauthorized software installation, a misconfigured service, or a backdoor left by an attacker. Document all expected ports for your infrastructure and treat deviations as security events requiring investigation.
Port scanning is a dual-use technique: it is essential for defensive security but can also be used for malicious reconnaissance. The legality of port scanning depends on jurisdiction and authorization. Scanning your own systems or systems you have explicit written authorization to test is legal and necessary. Scanning systems without authorization may violate computer fraud and abuse laws in many countries.
This tool is designed for educational and authorized testing purposes. It scans common ports using safe connect scanning that does not exploit services or attempt to gain unauthorized access. For comprehensive authorized assessments, professional tools like Nmap offer advanced features including OS detection, version scanning, and script-based vulnerability detection.
When performing authorized port scanning, document your scope and authorization before starting. Use the minimum scan type necessary for your objectives. Monitor for service disruption and stop immediately if issues arise. The goal is to understand the attack surface, not to test service resilience. Always follow responsible disclosure practices if you discover vulnerabilities.