Network Security Fundamentals: How Nmap and Port Scanning Work

An IP address routes traffic to a specific host machine, but a port number tells the operating system which particular service should process that incoming packet.

Ports range from 0 to 65535: Well-known ports (0–1023) host critical infrastructure services like HTTP (80), HTTPS (443), and SSH (22); Registered ports (1024–49151) host applications; and Dynamic/Ephemeral ports (49152–65535) are assigned by operating systems for outbound client sessions.

A legitimate TCP connection completes a 3-way handshake: Client sends SYN -> Server responds with SYN-ACK -> Client confirms with ACK.

Nmap's default privileged scan is the TCP SYN Scan ('nmap -sS'). Instead of completing the handshake, Nmap sends a RST (Reset) packet the instant it receives SYN-ACK from the server. Because the connection is never fully established, older logging daemons frequently failed to record the event.

Open: An application actively accepts incoming TCP connections on this port.

Closed: The port is accessible (it receives and responds to probes), but no application is listening. The target returns an RST packet.

Filtered: Nmap cannot determine if the port is open because a firewall, router ACL, or host-based iptables rule dropped the probe packet before it reached the socket.

Every open port is a potential door for exploitation. Defensive administrators practice aggressive port hygiene: bind internal services strictly to localhost (127.0.0.1) rather than all interfaces (0.0.0.0).

Deploy host-based firewalls (such as UFW on Ubuntu or firewalld on RHEL) to drop unsolicited incoming connections by default.