Skip to main content

​
Overview

The Port Scanner identifies open TCP and UDP ports on target hosts using Nmap, the industry-standard port scanning tool. Knowing which network services are exposed to the Internet is a key step in network security assessments. The Port Scanner is a discovery tool: it maps your network’s exposed services but does not test them for vulnerabilities. Discovered ports, services, and OS information are added to your Attack Surface. It does not generate findings.

​
Parameters

ParameterDescription
TargetThe hostname or IP address to scan.
ProtocolChoose between TCP (default) or UDP scanning.
Scan typeLight, Deep (default), or Custom mode. See Scan types below.
Check aliveWhen enabled (default), the scanner checks if the host is up before scanning. Disable this if the host doesn’t respond to ICMP but you know it’s online. Learn more about Check alive.

​
Custom scan options

These parameters are only available when using Custom scan type:
ParameterDescription
Ports to scanChoose from common presets, specify a range, or provide a comma-separated list. See Port presets below.
Detect service versionEnables Nmap service detection to identify what’s running on each port.
Detect operating systemEnables OS fingerprinting based on TCP/IP stack analysis.
Do tracerouteShows the network path to the target (TCP only).
Scan techniqueThe TCP scan method to use. See Scan techniques below.

​
Port presets

PresetTCP portsUDP ports
Top 10 ports~10~10
Top 100 ports~112~101
Top 1000 ports~1,009~1,000
Top 5000 ports~5,003~5,000
Full port range65,53565,535
You can also specify a port range (e.g., 1-1024 for privileged ports) or a port list (comma-separated, e.g., 22,80,443,3306,8080).
The “Top X ports” presets use different, curated port lists for TCP and UDP based on which ports are most commonly open for each protocol. TCP lists emphasize web (80, 443, 8080), SSH (22), and database ports, while UDP lists focus on DNS (53), DHCP (67-68), SNMP (161-162), and NTP (123) ports.
See Port lists for the exact ports covered by each preset.

​
Scan techniques

For TCP scanning, you can choose the scan technique. For detailed explanations, see the Nmap port scanning techniques documentation.
TechniqueFlagDescriptionUse case
TCP SYN-sSHalf-open scan, fast and stealthyDefault, recommended
Connect-sTFull TCP connectionWhen SYN scan isn’t possible
ACK-sAExamines firewall rulesFirewall mapping
Window-sWAnalyzes TCP Window fieldSpecific systems
Maimon-sMFIN/ACK probeBSD-derived systems
TCP NULL-sNNo flags setBypass non-stateful firewalls
FIN-sFFIN flag onlyBypass non-stateful firewalls
Xmas-sXFIN, PSH, URG flagsBypass non-stateful firewalls
SCTP INIT-sYSCTP protocol scanSCTP services
COOKIE-ECHO-sZAdvanced SCTP scanSCTP services
IP-sOIP protocol scanProtocol identification
Most scans should use TCP SYN (the default). Alternative techniques are useful for firewall evasion or specialized assessments.

​
Scan types

Scan typeTCP ports scannedUDP ports scannedFeatures
Light~187 top ports~101 top portsService detection
Deep~3,845 top ports~1,000 top portsService detection, OS detection
CustomUser-definedUser-definedAll options configurable
Light is a quick reconnaissance scan. Deep (the default) covers a wide range of ports and is recommended for security assessments.

​
How it works

1

Check if host is alive (optional)

If enabled, the scanner sends ICMP echo requests and TCP/UDP probes to verify the host is reachable before scanning.
2

Port scanning

Nmap probes the specified ports using the selected technique (SYN scan for TCP by default, UDP scan for UDP).
3

Service detection

For Light and Deep scans, Nmap identifies services using banner grabbing, service-specific probes, and response analysis.
4

OS detection (Deep only)

Analyzes TCP/IP stack responses to fingerprint the operating system based on TCP options, sequence numbers, and timing characteristics.
5

Traceroute (Custom, TCP only)

If enabled, determines the network path to the target, showing IP addresses of intermediate routers.

​
UDP scanning considerations

UDP scanning is slower than TCP because UDP is connectionless. The scanner must wait for timeouts to determine if ports are closed or filtered. For UDP:
  • No response typically means open|filtered
  • An ICMP “port unreachable” error indicates closed
If the scanner reports “host seems down” or finds no open ports on a host you know is up, re-run the scan with Check alive disabled. The host may be blocking ICMP probes.

​
Follow-up actions

From the results, you can launch additional scans directly:
Discovered serviceSuggested action
HTTP/HTTPSRun Website Scanner, URL Fuzzer, or Website Recon
SSH, FTP, RDP, SMBTest credentials with Password Auditor
HTTPS, SMTP, IMAPAnalyze encryption with SSL/TLS Scanner
Any serviceRun Network Scanner to test for vulnerabilities
Use VPN profiles to scan internal networks behind firewalls.