Port scanner online
Scan a public host for the 22 TCP services most often left exposed, from SSH and RDP to open databases, and see what is open, closed or filtered.
Only scan hosts you own or have permission to test. scanme.nmap.org is provided by the Nmap project for exactly this.
Open, closed, filtered
- Open (green): the TCP handshake completed. A service is listening and reachable. Red means it's one that shouldn't usually be public.
- Closed: the host sent a reset. It's reachable, but nothing listens on that port.
- Filtered (amber): silence. A firewall dropped the probe, the normal state for a hardened host.
What each port is for and whether it should be open: see common port numbers. To test one specific port (a game server, Plex, a custom app), use the open port checker.
Questions people ask
Which ports does this scanner check?
The 22 TCP ports behind the most commonly exposed services: FTP, SSH, Telnet, SMTP (25/465/587), DNS, HTTP/HTTPS and alternates, POP3/IMAP and their TLS variants, SMB, RDP, and the default ports of MS SQL, MySQL, PostgreSQL, Redis and MongoDB.
Why not scan all 65,535 ports?
A full scan from a shared web service would be slow and look like an attack to your provider's intrusion detection. For a full audit of your own network, run
nmap -p- your-host from a machine you control.What should be open on a typical web server?
Usually only 80 and 443, plus 22 restricted to your IPs. Databases (3306, 5432, 6379, 27017), RDP (3389) and SMB (445) should never be reachable from the whole internet; automated attacks find them within minutes.
What does "filtered" mean in a scan?
No response at all within the timeout: a firewall is dropping the probe. This is the normal, desirable state for ports you don't use.