What is an online port scanner?

An online port scanner is a browser-based tool that probes a target host for open, closed, and filtered network ports without installing desktop software like Nmap or Masscan. Port scanning sends crafted TCP or UDP packets to numbered ports and interprets responses according to RFC 793 semantics. An open port responds to a TCP SYN probe with SYN-ACK, indicating a listening service. A closed port returns RST. A filtered port produces no response when a firewall drops the packet. ScanSuite uses the Nmap engine from cloud scan nodes, giving an external perspective on which services — web servers, SSH, databases — are reachable from the internet.

How does the ScanSuite port scanner work?

When you enter a target and click Scan, ScanSuite validates the address, resolves hostnames via DNS if needed, and dispatches an Nmap TCP SYN scan to a cloud node. The free tier probes the top 100 most frequently open TCP ports — the same frequency-ranked list Nmap maintains from real-world statistics and IANA registry data. Each port receives a SYN packet without completing the three-way handshake, minimizing connection logs. Responses are classified as open (SYN-ACK), closed (RST), or filtered (timeout or ICMP unreachable). Results stream to your browser in real time. Completed scans produce a structured report with port number, state, and service name plus a shareable public URL valid for 24 hours.

What is a TCP SYN scan?

A TCP SYN scan, Nmap's default stealth mode (-sS), sends a SYN packet to each target port without completing the three-way handshake defined in RFC 793. If the port is open, the target responds with SYN-ACK. The scanner sends RST to tear down the half-open connection rather than completing the handshake with ACK. Closed ports respond with RST immediately. Filtered ports produce no response within the timeout period. SYN scanning is faster and quieter than a full connect scan (-sT) because it never establishes complete TCP sessions. ScanSuite's free tier uses Nmap SYN scanning for accurate port state detection with fewer connection log entries on the target.

What do open, closed, and filtered ports mean?

Open means a service is actively listening and accepted the TCP SYN probe with SYN-ACK — this port accepts connections and may present an attack surface requiring hardening. Closed means the host is reachable but no service listens; the host responds with RST. Filtered means a firewall, router ACL, or IPS dropped the probe or returned ICMP administratively prohibited — the scanner cannot determine whether a service listens behind the filter. Filtered results are common on cloud targets protected by security groups. Open ports warrant immediate security review. Filtered ports document active network defenses. Closed ports confirm no externally exposed service on that port.

Which ports does the free scanner check?

The free tier scans the top 100 most common TCP ports as defined by Nmap's frequency statistics, cross-referenced with the IANA service port registry. This list includes SSH (22), Telnet (23), SMTP (25), DNS (53), HTTP (80), POP3 (110), NetBIOS (139), HTTPS (443), SMB (445), SMTPS (465), IMAPS (993), Microsoft SQL Server (1433), Oracle (1521), MySQL (3306), RDP (3389), PostgreSQL (5432), and VNC (5900), among others. These ports cover the majority of externally exposed services found in production environments. The free tier also supports up to six custom ports alongside the top-100 scan. For comprehensive coverage of all 65,535 TCP ports, top-1000, or top-10000 ranges, upgrade to Premium ScanSuite.

Is port scanning legal?

Port scanning is legal when performed on systems you own or have explicit written authorization to test, such as during contracted penetration tests, internal audits, or your own cloud infrastructure. Scanning third-party systems without permission may violate computer misuse laws including the US Computer Fraud and Abuse Act and UK Computer Misuse Act. ISP terms may prohibit scanning from residential connections — ScanSuite's cloud nodes operate under platform terms. OWASP testing guidance treats port scanning as standard reconnaissance during authorized assessments. Always obtain written scope approval and coordinate with asset owners before scanning production targets.

How is ScanSuite different from running Nmap locally?

Both ScanSuite and local Nmap CLI or Zenmap use the Nmap scanning engine for port discovery. The critical difference is scan origin and perspective. Local Nmap runs from your machine's network position — behind NAT, VPN, or corporate firewalls — showing what your workstation can reach. ScanSuite runs scans from external cloud nodes, mirroring what an internet-based attacker observes. This external vantage point is essential for validating cloud security groups, perimeter firewalls, and CDN configurations. Local Nmap offers full scripting (NSE), custom timing templates, traceroute, and offline report formats ScanSuite does not replicate in the browser. Many security professionals use ScanSuite for external exposure checks and local Nmap for internal segment discovery — complementary workflows.

What is the difference between Nmap and Masscan?

Nmap is a comprehensive network discovery tool supporting TCP SYN scans, UDP scans, service version detection (-sV), OS fingerprinting (-O), and the Nmap Scripting Engine (NSE). It prioritizes accuracy and depth over raw speed. Masscan is designed for high-speed scanning across large IP ranges and port spaces but provides less service detail. ScanSuite's free tier uses Nmap for the top 100 TCP ports. Premium subscribers can select Masscan for rapid sweeps across top-1000, top-10000, or all 65535 ports, then follow up with Nmap -sV on discovered open ports. Choose Nmap for reliable state classification; choose Masscan when speed across large ranges matters most.

Can firewalls detect and block port scans?

Yes. Stateful firewalls, web application firewalls (WAFs), and intrusion detection or prevention systems (IDS/IPS) commonly detect port scan patterns and respond by dropping probe packets, rate-limiting source IPs, or generating alerts. When a firewall filters traffic, ScanSuite reports those ports as filtered rather than open or closed — this is expected behavior indicating active network defenses. Some targets may block all unsolicited inbound SYN packets, producing entirely filtered results except for ports explicitly allowed by security group rules. Cloud providers like AWS, Azure, and GCP security groups directly control which ports respond to external probes. Scan results reflect the target's defensive posture at scan time. Coordinate with network teams if scans trigger operational alerts.

Does the free port scanner support UDP?

No. The free tier performs TCP SYN scanning only. UDP port scanning requires Premium ScanSuite because UDP is connectionless — Nmap must send protocol-specific payloads and interpret ICMP port-unreachable messages to classify states, which is slower and less definitive than TCP SYN scanning. Common UDP services include DNS (53), DHCP (67/68), SNMP (161), NTP (123), and TFTP (69). If you need UDP coverage, upgrade to Premium and select UDP protocol alongside your desired port range. For DNS-specific diagnostics without full UDP scanning, use our free DNS lookup tool to query A, AAAA, MX, and TXT records directly.

Can I scan IPv6 addresses?

ScanSuite supports IPv6 targets when you provide a valid IPv6 address or a hostname that resolves to AAAA records. IPv6 scanning uses the same Nmap TCP SYN methodology as IPv4, probing the top 100 TCP ports on the target's IPv6 address. IPv6 adoption introduces unique considerations: larger address spaces, varied firewall defaults, and dual-stack deployments where a hostname resolves to both A and AAAA records. Use our DNS lookup tool to verify AAAA resolution before scanning. External scan nodes must have IPv6 connectivity to the target — some IPv6-only or IPv6-preferred hosts may show different port exposure than their IPv4 counterparts. Premium scanning provides broader port range and protocol options for IPv6 assessments.

How accurate are online port scan results?

ScanSuite uses the same Nmap engine trusted by security professionals worldwide, so port state classification follows established RFC 793 semantics with high accuracy under normal network conditions. Results reflect a single point in time — dynamic cloud infrastructure, auto-scaling groups, and CDN frontends may change open ports between scans. Load balancers may respond on behalf of backend pools, showing open ports that represent the balancer rather than individual servers. Rate limiting and temporary firewall rules can produce inconsistent filtered states across repeated scans. For authoritative exposure documentation, scan after configuration changes stabilize, scan multiple times during change windows, and correlate results with DNS lookup and SSL checker findings on discovered services.

What is MITRE ATT&CK T1046 and how does port scanning relate?

MITRE ATT&CK technique T1046, Network Service Discovery, describes adversaries scanning IP networks to identify running services, open ports, and vulnerable software versions. Attackers use tools like Nmap and Masscan during the discovery phase of an intrusion to map targets before exploitation. Defenders use the same techniques during authorized assessments to identify exposure before attackers do. Understanding T1046 helps security teams contextualize port scan findings within threat models — an unexpected open port on 3389 (RDP) or 445 (SMB) may indicate lateral movement opportunities documented in subsequent ATT&CK techniques. ScanSuite supports defensive use of network service discovery by providing external perspective scanning with documented reports suitable for remediation tracking and compliance evidence.

Can I share port scan results with my team?

Free scans generate a public report URL immediately upon completion, accessible to anyone with the link for 24 hours. This supports incident response handoffs, change-management evidence, and collaborative triage without requiring recipients to create accounts. Reports list each probed port with its state, service name, and scan metadata including target, timestamp, and scan configuration. Premium subscribers store encrypted private reports permanently with export options for compliance audits, penetration test deliverables, and scheduled scan comparisons. Remember that public report links expose scan results to anyone who obtains the URL — avoid sharing reports containing sensitive internal hostnames if your policy restricts such disclosure.

Should I scan my own servers and network?

Yes — scanning infrastructure you own or manage is a security best practice recommended by OWASP, NIST, and CIS benchmarks. Regular external perspective scans reveal unintended exposure from misconfigured cloud security groups, default services left enabled after installation, shadow IT systems, and forgotten development endpoints. Many breaches exploit services that administrators assumed were firewalled but were publicly reachable. Schedule recurring scans after every infrastructure change, before compliance audits, and during incident response to compare current exposure against baselines. ScanSuite's free tier makes ad-hoc checks frictionless, while Premium scheduling supports continuous monitoring workflows with historical report comparison across scan runs.

How does port scanning compare to vulnerability scanning?

Port scanning identifies which ports are open, closed, or filtered — revealing the network service surface. Vulnerability scanning goes further by probing discovered services for known CVEs, misconfigurations, and weak credentials. ScanSuite's free port scanner maps exposure; Premium adds Nmap service version detection (-sV) to fingerprint software versions, enabling correlation with vulnerability databases. Full vulnerability assessment platforms like ScanSuite's enterprise network scanning at /scan/network combine port discovery with authenticated checks, web application testing, and compliance reporting. Start with port scanning to understand what is exposed, then layer vulnerability testing on confirmed open services. Port scanning alone does not exploit or confirm vulnerabilities — it is reconnaissance, not penetration.

What standards and references define port scanning behavior?

TCP port scanning semantics are grounded in RFC 793, which defines the Transmission Control Protocol including SYN, SYN-ACK, RST, and FIN flag behavior that Nmap uses to classify port states. The IANA service and port number registry assigns official port numbers and service names referenced in scan output. Nmap's official documentation at nmap.org describes scan types, timing, and output formats that ScanSuite's engine implements. OWASP's Web Security Testing Guide covers port scanning during authorized application assessments. MITRE ATT&CK technique T1046 documents adversary network service discovery tactics that defensive scanning helps mitigate. Understanding these authoritative sources helps analysts interpret results correctly and distinguish normal defensive filtering from indicators of compromise during security investigations.

Online Port Scanner — Free Nmap TCP Scan

An online port scanner probes a target host for open TCP and UDP ports by sending crafted packets and interpreting responses — revealing which network services are reachable and whether firewalls filter traffic, using engines like Nmap or Masscan without local installation.

Enter an IPv4 address, IPv6 address, or hostname and click Scan. ScanSuite runs an Nmap TCP SYN scan against the top 100 most common ports from cloud nodes, streaming open, closed, and filtered results to your browser. Free tier requires no signup; Premium unlocks full port ranges, UDP, Masscan, and OS fingerprinting.

Port scanning is the process of probing a network host to determine which TCP or UDP ports accept connections, which are closed, and which are obscured by firewalls. Every exposed service — web servers on 443, SSH on 22, databases on 3306 — listens on a port. Mapping that surface is a foundational step in network security assessments, penetration testing, and system administration.

ScanSuite's online port scanner brings Nmap-grade discovery to your browser. The free tier performs a TCP SYN scan of the top 100 most frequently open ports against any public IPv4 or IPv6 target, streaming results in real time without installing Nmap, Zenmap, or Masscan locally. Premium subscribers unlock custom port ranges up to all 65,535 TCP and UDP ports, the Masscan high-speed engine, service version detection, OS fingerprinting, and permanent private reports.

ScanSuite's free online port scanner uses Nmap to perform TCP SYN scans against the top 100 ports on any public IPv4, IPv6, or hostname target. Results stream in real time showing open, closed, and filtered port states. Premium unlocks Masscan, UDP scanning, custom port ranges, service version detection, and OS fingerprinting — a browser-based alternative to Nmap CLI and Zenmap for external exposure assessment.

Frequently Asked Questions

What is an online port scanner?: An online port scanner is a browser-based tool that probes a target host for open, closed, and filtered network ports without installing desktop software like Nmap or Masscan. Port scanning sends crafted TCP or UDP packets to numbered ports and interprets responses according to RFC 793 semantics. An open port responds to a TCP SYN probe with SYN-ACK, indicating a listening service. A closed port returns RST. A filtered port produces no response when a firewall drops the packet. ScanSuite uses the Nmap engine from cloud scan nodes, giving an external perspective on which services — web servers, SSH, databases — are reachable from the internet.
How does the ScanSuite port scanner work?: When you enter a target and click Scan, ScanSuite validates the address, resolves hostnames via DNS if needed, and dispatches an Nmap TCP SYN scan to a cloud node. The free tier probes the top 100 most frequently open TCP ports — the same frequency-ranked list Nmap maintains from real-world statistics and IANA registry data. Each port receives a SYN packet without completing the three-way handshake, minimizing connection logs. Responses are classified as open (SYN-ACK), closed (RST), or filtered (timeout or ICMP unreachable). Results stream to your browser in real time. Completed scans produce a structured report with port number, state, and service name plus a shareable public URL valid for 24 hours.
What is a TCP SYN scan?: A TCP SYN scan, Nmap's default stealth mode (-sS), sends a SYN packet to each target port without completing the three-way handshake defined in RFC 793. If the port is open, the target responds with SYN-ACK. The scanner sends RST to tear down the half-open connection rather than completing the handshake with ACK. Closed ports respond with RST immediately. Filtered ports produce no response within the timeout period. SYN scanning is faster and quieter than a full connect scan (-sT) because it never establishes complete TCP sessions. ScanSuite's free tier uses Nmap SYN scanning for accurate port state detection with fewer connection log entries on the target.
What do open, closed, and filtered ports mean?: Open means a service is actively listening and accepted the TCP SYN probe with SYN-ACK — this port accepts connections and may present an attack surface requiring hardening. Closed means the host is reachable but no service listens; the host responds with RST. Filtered means a firewall, router ACL, or IPS dropped the probe or returned ICMP administratively prohibited — the scanner cannot determine whether a service listens behind the filter. Filtered results are common on cloud targets protected by security groups. Open ports warrant immediate security review. Filtered ports document active network defenses. Closed ports confirm no externally exposed service on that port.
Which ports does the free scanner check?: The free tier scans the top 100 most common TCP ports as defined by Nmap's frequency statistics, cross-referenced with the IANA service port registry. This list includes SSH (22), Telnet (23), SMTP (25), DNS (53), HTTP (80), POP3 (110), NetBIOS (139), HTTPS (443), SMB (445), SMTPS (465), IMAPS (993), Microsoft SQL Server (1433), Oracle (1521), MySQL (3306), RDP (3389), PostgreSQL (5432), and VNC (5900), among others. These ports cover the majority of externally exposed services found in production environments. The free tier also supports up to six custom ports alongside the top-100 scan. For comprehensive coverage of all 65,535 TCP ports, top-1000, or top-10000 ranges, upgrade to Premium ScanSuite.
Is this port scanner free?: Yes. ScanSuite's free online port scanner requires no signup or account. It performs an Nmap TCP SYN scan of the top 100 ports with real-time streaming output and a shareable public report link valid for 24 hours. Free tier includes host detection, basic service name mapping, and live scan feed. Premium ScanSuite adds custom port ranges up to all 65,535 TCP and UDP ports, the Masscan high-speed engine, UDP protocol scanning, Nmap service version detection (-sV), OS fingerprinting (-O), global scan region selection, scan scheduling, and permanent encrypted private reports. The free tier is designed for quick external exposure checks, education, and incident triage; Premium serves comprehensive security assessments and compliance workflows.