Port Scanning Techniques

Open ports reveal the services a host is running, which is your map of the attack surface. Port scanning determines which TCP and UDP ports are open, closed, or filtered.

Nmap offers several scan techniques, each with trade-offs in speed, stealth, and the privileges required.

Nmap reports each port in one of these states:

• open: a service is actively accepting connections.
• closed: reachable but no service listening.
• filtered: a firewall is blocking probes, so Nmap cannot tell.
• open|filtered and closed|filtered: ambiguous results.

Understanding scans requires the TCP handshake:

• Client sends SYN.
• Server replies SYN-ACK if the port is open.
• Client sends ACK to complete the connection.

A closed port replies with RST. Scan types differ in how far through this handshake they go.

The SYN scan (-sS) is the default when run as root. It sends a SYN, sees the SYN-ACK (open) or RST (closed), then sends RST to never complete the handshake.

This 'half-open' scan is fast and relatively stealthy because the full connection is never established. It requires raw socket privileges.

The connect scan (-sT) completes the full three-way handshake using the OS networking API. It needs no special privileges, so it is the fallback for unprivileged users.

Because it fully connects, it is louder and more likely to be logged by the target's services.

The UDP scan (-sU) finds services like DNS, SNMP, and DHCP that use UDP. UDP is connectionless, so scanning is slow and tricky:

• No response often means open|filtered.
• An ICMP port-unreachable means closed.

UDP services are frequently overlooked, so they can hide valuable findings.

Several scans send unusual flag combinations to slip past simple firewalls and avoid SYN logging:

• FIN (-sF): only the FIN flag.
• NULL (-sN): no flags set.
• Xmas (-sX): FIN, PSH, and URG set, 'lit up like a Christmas tree'.

These rely on RFC behavior and often work only on certain stacks.

Control which ports are scanned to balance speed and coverage:

• -p 80,443 specific ports.
• -p 1-1000 a range.
• -p- all 65535 ports.
• --top-ports 100 the most common ports.
• -F fast scan of the top 100.

The -T flag sets timing from 0 (paranoid) to 5 (insane):

• -T0/-T1: very slow, for evading IDS.
• -T3: the balanced default.
• -T4: faster, common on reliable networks.
• -T5: aggressive, may miss results.

Faster scans are louder and risk inaccuracy.

Nmap offers options to test firewall and IDS resilience:

• -f fragments packets.
• -D uses decoy source addresses.
• --source-port spoofs a trusted source port like 53.

Use these only in authorized tests to evaluate detection capabilities.

Real scans blend these options. A common thorough TCP scan picks the scan type, all ports, faster timing, and saves output.

Start broad to find open ports, then run focused follow-up scans (version detection, scripts) only on the ports that are actually open. This two-phase approach is faster and quieter than doing everything at once.

Match the scan to its behavior.

You learned port scanning techniques:

• Port states: open, closed, filtered and ambiguous variants.
• SYN scan (-sS) is the stealthy default; connect (-sT) needs no privileges but is louder.
• UDP (-sU) is slow but uncovers overlooked services.
• FIN/NULL/Xmas scans evade simple firewalls.
• Control ports with -p, speed with -T, and test evasion with -f/-D.

Next: service and OS detection.