Skip to main content

​
Overview

The Port Scanner identifies open TCP and UDP ports on target hosts using Nmap, the industry-standard port scanning tool. Knowing which network services are exposed to the Internet is a key step in network security assessments. The Port Scanner is a discovery tool: it maps your network’s exposed services but does not test them for vulnerabilities. Discovered ports, services, and OS information are added to your Attack Surface. It does not generate findings.

​
Parameters

​
Custom scan options

These parameters are only available when using Custom scan type:

​
Port presets

You can also specify a port range (e.g., 1-1024 for privileged ports) or a port list (comma-separated, e.g., 22,80,443,3306,8080).
The “Top X ports” presets use different, curated port lists for TCP and UDP based on which ports are most commonly open for each protocol. TCP lists emphasize web (80, 443, 8080), SSH (22), and database ports, while UDP lists focus on DNS (53), DHCP (67-68), SNMP (161-162), and NTP (123) ports.
See Port lists for the exact ports covered by each preset.

​
Scan techniques

For TCP scanning, you can choose the scan technique. For detailed explanations, see the Nmap port scanning techniques documentation.
Most scans should use TCP SYN (the default). Alternative techniques are useful for firewall evasion or specialized assessments.

​
Scan types

Light is a quick reconnaissance scan. Deep (the default) covers a wide range of ports and is recommended for security assessments.

​
How it works

1

Check if host is alive (optional)

If enabled, the scanner sends ICMP echo requests and TCP/UDP probes to verify the host is reachable before scanning.
2

Port scanning

Nmap probes the specified ports using the selected technique (SYN scan for TCP by default, UDP scan for UDP).
3

Service detection

For Light and Deep scans, Nmap identifies services using banner grabbing, service-specific probes, and response analysis.
4

OS detection (Deep only)

Analyzes TCP/IP stack responses to fingerprint the operating system based on TCP options, sequence numbers, and timing characteristics.
5

Traceroute (Custom, TCP only)

If enabled, determines the network path to the target, showing IP addresses of intermediate routers.

​
UDP scanning considerations

UDP scanning is slower than TCP because UDP is connectionless. The scanner must wait for timeouts to determine if ports are closed or filtered. For UDP:
  • No response typically means open|filtered
  • An ICMP “port unreachable” error indicates closed
If the scanner reports “host seems down” or finds no open ports on a host you know is up, re-run the scan with Check alive disabled. The host may be blocking ICMP probes.

​
Follow-up actions

From the results, you can launch additional scans directly:
Use VPN profiles to scan internal networks behind firewalls.