What is Port Scanning?
Also: port scan · TCP/UDP scan · port enumeration · service scanning
Definition
Port scanning is the act of sending crafted packets to a host's TCP and UDP ports to learn which ports are open, closed, or filtered, and then identifying the services and versions listening behind the open ones. It is the foundational discovery step that turns an unknown IP address into a concrete inventory of reachable, attackable services.
In depth
Every networked service binds to a numbered port, and a port can be in one of three observable states: open (a service accepted the probe), closed (the host replied but nothing is listening), or filtered (a firewall silently dropped the probe so no conclusion can be drawn). A port scanner systematically probes a range of ports and infers these states from the responses. The classic distinction is between a TCP connect scan and a TCP SYN scan. A connect scan (Nmap's -sT) uses the operating system's normal connect() call to complete the full three-way handshake (SYN, SYN/ACK, ACK), which requires no special privileges but is slower and is logged by the target application as a real connection. A SYN scan (Nmap's -sS) sends only a SYN, reads the SYN/ACK that signals an open port, then immediately sends a RST to tear the connection down before it completes. Because the handshake is never finished it is called half-open scanning; it is faster, generates less application-level logging, and requires raw-packet privileges (root or administrator).
UDP scanning (Nmap's -sU) is fundamentally harder and slower than TCP. UDP is connectionless, so an open UDP port often returns nothing at all, while a closed port returns an ICMP port-unreachable message. The scanner must therefore distinguish 'open' from 'filtered' largely by the absence of an ICMP error, and ICMP rate limiting on most operating systems forces long waits between probes. This is why services like DNS, SNMP, NTP, and exposed databases that speak UDP are frequently missed by quick scans and require deliberate, patient UDP coverage to surface.
Knowing that a port is open is only half the job; the more valuable signal is what is actually listening there. Service and version detection (Nmap's -sV) interrogates each open port with a sequence of protocol-specific probes and compares the replies against the nmap-service-probes database, which holds roughly 6,500 pattern matches spanning over 650 protocols. From this it deduces the protocol (SSH, HTTP, SMTP, FTP), the application name and version number, sometimes the device type or operating system family, and Common Platform Enumeration (CPE) identifiers. A simpler relative of this is banner grabbing, where the scanner simply reads the greeting a service emits on connection. Version data matters because vulnerability decisions hinge on it: an open port 22 is unremarkable, but 'OpenSSH 7.4 on port 22' maps directly to known CVEs.
Port scanning is distinct from, but feeds, several adjacent activities. Network discovery (host discovery) determines which IP addresses are alive at all before ports are probed; port scanning then enumerates services on those live hosts. Vulnerability scanning goes a step further, taking the discovered service and version data and matching it against vulnerability databases to flag exploitable weaknesses. Service fingerprinting and OS fingerprinting are the identification layers that sit on top of raw port-state results. In the EASM (External Attack Surface Management) context, port scanning is the engine that converts a list of resolved subdomains and IPs into the concrete, enumerable surface that everything else is built on. It is also an activity governed by responsible-use norms: scanning systems you do not own or have explicit authorization to test can violate computer-misuse laws and provider acceptable-use policies, so legitimate scanning is scoped, authorized, and rate-limited.
Why it matters
Attackers do not break into networks they cannot see; they break into the open port you forgot was listening. The cost of not running disciplined port scanning is paid in the gap between what you think is exposed and what actually answers the internet, a debug port left open after a deploy, a database bound to 0.0.0.0, an admin console reachable on a non-standard port. CISA's vulnerability scanning service exists precisely because internet-reachable open ports and risky services are where breaches begin, and it cross-references findings against the Known Exploited Vulnerabilities catalog. If you are not enumerating your own ports continuously, an adversary scanning the entire IPv4 space in minutes is building a more accurate inventory of your attack surface than you have, and they only need one stale, forgotten service to turn a missed scan into an incident.
How Legba Recon uses it
Legba Recon treats port scanning as the bridge between discovery and validation. After it resolves an organization's domains, subdomains, and IP ranges, Recon probes the relevant TCP and UDP port space to establish which ports are genuinely open versus filtered, then runs service and version detection to label each open port with its protocol, application, and version rather than guessing from the port number alone. That enriched fingerprint is what lets Recon move past 'port 3389 is open' to 'an exposed RDP service with these characteristics' and feed it into targeted validation checks for the specific exposures that matter. Recon performs this from the outside-in and within responsible-use limits, rate-limited and scoped to assets tied to your organization, so the report you receive mirrors what an external attacker would actually find while remaining safe to run against production.
Explore Legba Recon →Methodology
Each finding-type guide is built from Legba Recon's real detection and validation logic, reviewed by a named security contributor, and cited against primary sources such as OWASP, CISA, NIST, and MITRE. We update pages when the underlying guidance changes. See our contributors and company.
FAQs.
References.
- 01Port Scanning TechniquesNmap Project
- 02TCP SYN (Stealth) Scan (-sS)Nmap Project
- 03Service and Version DetectionNmap Project
- 04
- 05
- 06
