Online Port Scanner
An online port scanner probes a target host for open TCP and UDP ports by sending crafted packets and interpreting responses — revealing which network services are reachable and whether firewalls filter traffic, using engines like Nmap or Masscan without local installation.
Enter an IPv4 address, IPv6 address, or hostname and click Scan. ScanSuite runs an Nmap TCP SYN scan against the top 100 most common ports from cloud nodes, streaming open, closed, and filtered results to your browser. Free tier requires no signup; Premium unlocks full port ranges, UDP, Masscan, and OS fingerprinting.
Introduction to Online Port Scanning
Port scanning is the process of probing a network host to determine which TCP or UDP ports accept connections, which are closed, and which are obscured by firewalls. Every exposed service — web servers on 443, SSH on 22, databases on 3306 — listens on a port. Mapping that surface is a foundational step in network security assessments, penetration testing, and system administration.
ScanSuite's online port scanner brings Nmap-grade discovery to your browser. The free tier performs a TCP SYN scan of the top 100 most frequently open ports against any public IPv4 or IPv6 target, streaming results in real time without installing Nmap, Zenmap, or Masscan locally. Premium subscribers unlock custom port ranges up to all 65,535 TCP and UDP ports, the Masscan high-speed engine, service version detection, OS fingerprinting, and permanent private reports.
What Is an Online Port Scanner?
A port scanner sends probe packets to numbered ports on a target IP address or hostname and classifies each port as open, closed, or filtered based on the response. TCP behavior follows RFC 793: an open port replies to a SYN probe with SYN-ACK; a closed port replies with RST; a filtered port yields no response or an ICMP unreachable message when a firewall drops the packet. UDP scanning uses a different heuristic because UDP is connectionless — absence of an ICMP port-unreachable message often suggests an open or filtered state.
Desktop tools like Nmap CLI and Zenmap remain the gold standard for deep network discovery with scripting, traceroute, and hundreds of scan options. Masscan prioritizes raw speed across large address spaces at the cost of less service detail. An online port scanner runs scans from cloud infrastructure, giving you an external attacker's perspective on exposure — ideal when corporate policy blocks local Nmap installation or when you need a quick, shareable report during incident triage.
Authorization
Scan only hosts you own or have written permission to test. Port scanning someone else's network can violate their terms and, in some places, the law. This tool sends packets from ScanSuite scan nodes, not from your laptop.
External perspective matters. A service bound to 0.0.0.0 may appear open from inside your LAN but correctly filtered from the internet — or the reverse, when misconfigured cloud security groups expose databases publicly. ScanSuite probes targets from distributed scan nodes, mirroring what an unauthorized external actor would observe rather than what your laptop sees behind NAT.
Browser-based scanning removes installation friction on locked-down workstations, jump boxes, and mobile devices. Security teams validating firewall rule changes, developers confirming staging environments match production exposure, and students learning TCP handshake behavior all benefit from instant access. Combine results with our DNS lookup tool to resolve hostnames, SSL checker to validate certificates on discovered HTTPS ports, and packet analyzer to inspect traffic patterns on suspicious services.
Who Uses Port Scanning Tools?
Penetration testers and red teams map attack surfaces during authorized assessments, correlating open ports with MITRE ATT&CK technique T1046 (Network Service Discovery). SOC analysts scan indicators from threat intelligence to understand adversary infrastructure. System administrators verify that only intended services are reachable after firewall changes or cloud migrations.
DevOps engineers validate Kubernetes ingress rules, load balancer listeners, and security group configurations before production cutovers. Compliance auditors document external exposure for PCI-DSS, SOC 2, and ISO 27001 evidence. Students preparing for Security+, CEH, and OSCP certifications practice interpreting Nmap output alongside hands-on labs. ScanSuite serves each audience with a free Nmap-powered tier and Premium capabilities for comprehensive enterprise scanning.
Scan types
Nmap names three ideas people mix up. A TCP connect scan (-sT) completes the handshake. A SYN scan (-sS) sends SYN and stops at the reply. Service detection (-sV) reads banners, and nmap -A adds OS detection, version detection, script scanning, and traceroute. This free scanner runs a TCP SYN scan of the top 100 ports. It does not run a connect scan, version detection, or nmap -A.
When you submit a target, ScanSuite validates the IPv4 address, IPv6 address, or hostname, resolves DNS if needed, and queues a scan job on a cloud scan node. The free tier uses the Nmap engine with a TCP SYN scan (-sS) against the top 100 TCP ports — the same frequency-ordered list Nmap maintains based on real-world scan statistics and the IANA port registry. SYN scanning sends a SYN flag without completing the three-way handshake, reducing log noise on the target compared to a full connect scan.
Each port response is classified: SYN-ACK means open, RST means closed, and timeout or ICMP administratively prohibited means filtered — often indicating an active firewall or intrusion prevention system. Results stream to your browser through a live feed. Free scans produce a shareable public report link valid for 24 hours. Premium scans support custom port ranges, UDP protocol, Masscan for high-speed discovery, Nmap service version detection (-sV), OS fingerprinting (-O), region selection, scheduling, and encrypted permanent report storage.
Example: Web server exposure check
Scanning a newly deployed web server at 203.0.113.50 might reveal ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) as open, with all other top-100 ports closed. Port 3306 (MySQL) appearing open from the internet indicates a critical misconfiguration requiring immediate firewall remediation. Ports showing filtered suggest cloud security groups are actively dropping probes.
Example: Firewall validation after rule change
After closing external SSH access, a re-scan should show port 22 as filtered rather than open. If port 22 remains open, the security group or iptables rule change did not propagate correctly. Comparing before-and-after scan reports provides evidence for change-management tickets and compliance audits.
Common ports
| Service | Transport | |
|---|---|---|
| 22 | SSH | TCP |
| 25 | SMTP | TCP |
| 53 | DNS | TCP and UDP |
| 80 | HTTP | TCP |
| 110 | POP3 | TCP |
| 143 | IMAP | TCP |
| 443 | HTTPS | TCP |
| 445 | SMB | TCP |
| 3306 | MySQL | TCP |
| 3389 | RDP | TCP |
| 5432 | PostgreSQL | TCP |
| 8080 | HTTP alternate | TCP |
Browser Scanner vs Nmap CLI
| Feature | ScanSuite Online Scanner | Nmap CLI / Zenmap | |
|---|---|---|---|
| Installation | None — browser only | Local install required | |
| Scan origin | External cloud nodes | Your machine's network position | |
| Engine | Nmap (free), Masscan (Premium) | Nmap, Masscan, custom scripts | |
| Live streaming | Real-time browser feed | Terminal output | |
| Reporting | Shareable web reports | Text/XML/GNMAP files locally | |
| Scripting (NSE) | Not available | Full Nmap Scripting Engine |
TCP Port States Explained
| State | TCP Behavior | Security Implication | |
|---|---|---|---|
| Open | SYN → SYN-ACK response | Service listening — review and harden | |
| Closed | SYN → RST response | Reachable but no service — lower risk | |
| Filtered | No response or ICMP unreachable | Firewall blocking — state unknown | |
| Open|filtered | Ambiguous UDP or idle scan | Possible service — needs deeper scan | |
| Closed|filtered | Mixed responses on UDP | Inconclusive — retry with UDP scan |
Free vs Premium Port Scanning
| Capability | Free Tier | Premium | |
|---|---|---|---|
| Engine | Nmap | Nmap + Masscan | |
| Port range | Top 100 TCP (+ up to 6 custom) | Top 1000, 10000, all 65535, custom | |
| Protocol | TCP only | TCP + UDP | |
| Service detection | Basic service name mapping | Version fingerprinting (-sV) | |
| OS fingerprinting | Not included | Nmap -O enabled | |
| Reports | Public link, 24 hours | Private encrypted, permanent | |
| Account required | No | Premium subscription |
Port Scanner Troubleshooting
If the scan fails to start, verify the target is a valid IPv4 address, IPv6 address, or resolvable hostname. Private RFC 1918 addresses (10.x, 172.16.x, 192.168.x) are not reachable from external scan nodes. If the target uses aggressive rate limiting or anti-scan WAF rules, results may show many filtered ports — retry during an approved maintenance window or scan from Premium with region selection.
If all ports appear filtered, the target network likely drops unsolicited SYN packets — common for hosts behind stateful firewalls or DDoS protection services. Host detection may report "up" via TCP acknowledgment to port 443 even when other ports filter. For hostname targets, confirm DNS resolution with our DNS lookup tool and verify the resolved IP matches your intended asset.
Related tools
- packet-analyzer —
- Subnet Calculator — Calculate CIDR blocks
- DNS Lookup — Check DNS records
- DNS Lookup — Resolve hostnames before scanning to verify target IP addresses
- Subdomain Finder — Discover subdomains to expand scan targets beyond the apex domain
- Packet Analyzer — Inspect TCP traffic patterns in PCAP captures from scanned hosts
- What Is My IP — Check your public IP address and compare with scan targets
- Subnet Calculator — Calculate CIDR ranges for network segments you scan
- SSL Checker — Validate TLS certificates on open HTTPS ports discovered by scans
- All Free Tools — Browse the complete ScanSuite tool catalog
- Network Scanning — Enterprise network vulnerability scanning capabilities
- Network Scan — Launch comprehensive authenticated network vulnerability scans
Frequently Asked Questions
What does nmap do with the -A option?
`-A` turns on aggressive scanning: OS detection (`-O`), version detection (`-sV`), default script scanning (`-sC`) and traceroute (`--traceroute`). It gives much more detail but is slower and noisier, so it is easy to detect. Only use it on systems you are authorised to scan. This online tool does not run full `-A` scans.
Can I run an nmap scan online?
Yes. This tool scans a public host or IP from our servers with a TCP SYN (`-sS`) probe over the top 100 ports, or up to six custom ports. It cannot reach private or internal addresses, and wider ranges or UDP need a signed-in ScanSuite plan.
Is port scanning legal?
Scanning systems you own, or have written permission to test, is generally fine. Scanning other people's systems without permission may break laws or terms of service, depending on where you are. Only scan targets you are authorised to test.
What do open, closed and filtered mean?
An open port has a service accepting connections. A closed port answered but has nothing listening. A filtered port did not answer, usually because a firewall dropped the probe.
Is this an nmap online port scanner?
The free scan uses Nmap to check the top 100 TCP ports on a hostname or IP you are allowed to test. Results are labeled open, closed, or filtered. It is an external reachability check, not a full local Nmap audit.
What does an online port scanner show?
For each probed TCP port it shows whether the remote host accepted the connection, refused it, or did not answer. Only scan systems you own or have written permission to test.
What is an online port scanner?
An online port scanner is a browser-based tool that probes a target host for open, closed, and filtered network ports without installing desktop software like Nmap or Masscan. Port scanning sends crafted TCP or UDP packets to numbered ports and interprets responses according to RFC 793 semantics. An open port responds to a TCP SYN probe with SYN-ACK, indicating a listening service. A closed port returns RST. A filtered port produces no response when a firewall drops the packet. ScanSuite uses the Nmap engine from cloud scan nodes, giving an external perspective on which services \u2014 web servers, SSH, databases \u2014 are reachable from the internet.
How does the ScanSuite port scanner work?
When you enter a target and click Scan, ScanSuite validates the address, resolves hostnames via DNS if needed, and dispatches an Nmap TCP SYN scan to a cloud node. The free tier probes the top 100 most frequently open TCP ports \u2014 the same frequency-ranked list Nmap maintains from real-world statistics and IANA registry data. Each port receives a SYN packet without completing the three-way handshake, minimizing connection logs. Responses are classified as open (SYN-ACK), closed (RST), or filtered (timeout or ICMP unreachable). Results stream to your browser in real time. Completed scans produce a structured report with port number, state, and service name plus a shareable public URL valid for 24 hours.
What is a TCP SYN scan?
A TCP SYN scan, Nmap's default stealth mode (-sS), sends a SYN packet to each target port without completing the three-way handshake defined in RFC 793. If the port is open, the target responds with SYN-ACK. The scanner sends RST to tear down the half-open connection rather than completing the handshake with ACK. Closed ports respond with RST immediately. Filtered ports produce no response within the timeout period. SYN scanning is faster and quieter than a full connect scan (-sT) because it never establishes complete TCP sessions. ScanSuite's free tier uses Nmap SYN scanning for accurate port state detection with fewer connection log entries on the target.
What do open, closed, and filtered ports mean?
Open means a service is actively listening and accepted the TCP SYN probe with SYN-ACK \u2014 this port accepts connections and may present an attack surface requiring hardening. Closed means the host is reachable but no service listens; the host responds with RST. Filtered means a firewall, router ACL, or IPS dropped the probe or returned ICMP administratively prohibited \u2014 the scanner cannot determine whether a service listens behind the filter. Filtered results are common on cloud targets protected by security groups. Open ports warrant immediate security review. Filtered ports document active network defenses. Closed ports confirm no externally exposed service on that port.
Which ports does the free scanner check?
The free tier scans the top 100 most common TCP ports as defined by Nmap's frequency statistics, cross-referenced with the IANA service port registry. This list includes SSH (22), Telnet (23), SMTP (25), DNS (53), HTTP (80), POP3 (110), NetBIOS (139), HTTPS (443), SMB (445), SMTPS (465), IMAPS (993), Microsoft SQL Server (1433), Oracle (1521), MySQL (3306), RDP (3389), PostgreSQL (5432), and VNC (5900), among others. These ports cover the majority of externally exposed services found in production environments. The free tier also supports up to six custom ports alongside the top-100 scan. For comprehensive coverage of all 65,535 TCP ports, top-1000, or top-10000 ranges, upgrade to Premium ScanSuite.
Is this port scanner free?
Yes. ScanSuite's free online port scanner requires no signup or account. It performs an Nmap TCP SYN scan of the top 100 ports with real-time streaming output and a shareable public report link valid for 24 hours. Free tier includes host detection, basic service name mapping, and live scan feed. Premium ScanSuite adds custom port ranges up to all 65,535 TCP and UDP ports, the Masscan high-speed engine, UDP protocol scanning, Nmap service version detection (-sV), OS fingerprinting (-O), global scan region selection, scan scheduling, and permanent encrypted private reports. The free tier is designed for quick external exposure checks, education, and incident triage; Premium serves comprehensive security assessments and compliance workflows.
How is ScanSuite different from running Nmap locally?
Both ScanSuite and local Nmap CLI or Zenmap use the Nmap scanning engine for port discovery. The critical difference is scan origin and perspective. Local Nmap runs from your machine's network position \u2014 behind NAT, VPN, or corporate firewalls \u2014 showing what your workstation can reach. ScanSuite runs scans from external cloud nodes, mirroring what an internet-based attacker observes. This external vantage point is essential for validating cloud security groups, perimeter firewalls, and CDN configurations. Local Nmap offers full scripting (NSE), custom timing templates, traceroute, and offline report formats ScanSuite does not replicate in the browser. Many security professionals use ScanSuite for external exposure checks and local Nmap for internal segment discovery \u2014 complementary workflows.
What is the difference between Nmap and Masscan?
Nmap is a comprehensive network discovery tool supporting TCP SYN scans, UDP scans, service version detection (-sV), OS fingerprinting (-O), and the Nmap Scripting Engine (NSE). It prioritizes accuracy and depth over raw speed. Masscan is designed for high-speed scanning across large IP ranges and port spaces but provides less service detail. ScanSuite's free tier uses Nmap for the top 100 TCP ports. Premium subscribers can select Masscan for rapid sweeps across top-1000, top-10000, or all 65535 ports, then follow up with Nmap -sV on discovered open ports. Choose Nmap for reliable state classification; choose Masscan when speed across large ranges matters most.
Can firewalls detect and block port scans?
Yes. Stateful firewalls, web application firewalls (WAFs), and intrusion detection or prevention systems (IDS/IPS) commonly detect port scan patterns and respond by dropping probe packets, rate-limiting source IPs, or generating alerts. When a firewall filters traffic, ScanSuite reports those ports as filtered rather than open or closed \u2014 this is expected behavior indicating active network defenses. Some targets may block all unsolicited inbound SYN packets, producing entirely filtered results except for ports explicitly allowed by security group rules. Cloud providers like AWS, Azure, and GCP security groups directly control which ports respond to external probes. Scan results reflect the target's defensive posture at scan time. Coordinate with network teams if scans trigger operational alerts.
Does the free port scanner support UDP?
No. The free tier performs TCP SYN scanning only. UDP port scanning requires Premium ScanSuite because UDP is connectionless \u2014 Nmap must send protocol-specific payloads and interpret ICMP port-unreachable messages to classify states, which is slower and less definitive than TCP SYN scanning. Common UDP services include DNS (53), DHCP (67/68), SNMP (161), NTP (123), and TFTP (69). If you need UDP coverage, upgrade to Premium and select UDP protocol alongside your desired port range. For DNS-specific diagnostics without full UDP scanning, use our free DNS lookup tool to query A, AAAA, MX, and TXT records directly.
Can I scan IPv6 addresses?
ScanSuite supports IPv6 targets when you provide a valid IPv6 address or a hostname that resolves to AAAA records. IPv6 scanning uses the same Nmap TCP SYN methodology as IPv4, probing the top 100 TCP ports on the target's IPv6 address. IPv6 adoption introduces unique considerations: larger address spaces, varied firewall defaults, and dual-stack deployments where a hostname resolves to both A and AAAA records. Use our DNS lookup tool to verify AAAA resolution before scanning. External scan nodes must have IPv6 connectivity to the target \u2014 some IPv6-only or IPv6-preferred hosts may show different port exposure than their IPv4 counterparts. Premium scanning provides broader port range and protocol options for IPv6 assessments.
How accurate are online port scan results?
ScanSuite uses the same Nmap engine trusted by security professionals worldwide, so port state classification follows established RFC 793 semantics with high accuracy under normal network conditions. Results reflect a single point in time \u2014 dynamic cloud infrastructure, auto-scaling groups, and CDN frontends may change open ports between scans. Load balancers may respond on behalf of backend pools, showing open ports that represent the balancer rather than individual servers. Rate limiting and temporary firewall rules can produce inconsistent filtered states across repeated scans. For authoritative exposure documentation, scan after configuration changes stabilize, scan multiple times during change windows, and correlate results with DNS lookup and SSL checker findings on discovered services.
What is MITRE ATT&CK T1046 and how does port scanning relate?
MITRE ATT&CK technique T1046, Network Service Discovery, describes adversaries scanning IP networks to identify running services, open ports, and vulnerable software versions. Attackers use tools like Nmap and Masscan during the discovery phase of an intrusion to map targets before exploitation. Defenders use the same techniques during authorized assessments to identify exposure before attackers do. Understanding T1046 helps security teams contextualize port scan findings within threat models \u2014 an unexpected open port on 3389 (RDP) or 445 (SMB) may indicate lateral movement opportunities documented in subsequent ATT&CK techniques. ScanSuite supports defensive use of network service discovery by providing external perspective scanning with documented reports suitable for remediation tracking and compliance evidence.
Can I share port scan results with my team?
Free scans generate a public report URL immediately upon completion, accessible to anyone with the link for 24 hours. This supports incident response handoffs, change-management evidence, and collaborative triage without requiring recipients to create accounts. Reports list each probed port with its state, service name, and scan metadata including target, timestamp, and scan configuration. Premium subscribers store encrypted private reports permanently with export options for compliance audits, penetration test deliverables, and scheduled scan comparisons. Remember that public report links expose scan results to anyone who obtains the URL \u2014 avoid sharing reports containing sensitive internal hostnames if your policy restricts such disclosure.
Should I scan my own servers and network?
Yes \u2014 scanning infrastructure you own or manage is a security best practice recommended by OWASP, NIST, and CIS benchmarks. Regular external perspective scans reveal unintended exposure from misconfigured cloud security groups, default services left enabled after installation, shadow IT systems, and forgotten development endpoints. Many breaches exploit services that administrators assumed were firewalled but were publicly reachable. Schedule recurring scans after every infrastructure change, before compliance audits, and during incident response to compare current exposure against baselines. ScanSuite's free tier makes ad-hoc checks frictionless, while Premium scheduling supports continuous monitoring workflows with historical report comparison across scan runs.
How does port scanning compare to vulnerability scanning?
Port scanning identifies which ports are open, closed, or filtered \u2014 revealing the network service surface. Vulnerability scanning goes further by probing discovered services for known CVEs, misconfigurations, and weak credentials. ScanSuite's free port scanner maps exposure; Premium adds Nmap service version detection (-sV) to fingerprint software versions, enabling correlation with vulnerability databases. Full vulnerability assessment platforms like ScanSuite's enterprise network scanning at /scan/network combine port discovery with authenticated checks, web application testing, and compliance reporting. Start with port scanning to understand what is exposed, then layer vulnerability testing on confirmed open services. Port scanning alone does not exploit or confirm vulnerabilities \u2014 it is reconnaissance, not penetration.
What standards and references define port scanning behavior?
TCP port scanning semantics are grounded in RFC 793, which defines the Transmission Control Protocol including SYN, SYN-ACK, RST, and FIN flag behavior that Nmap uses to classify port states. The IANA service and port number registry assigns official port numbers and service names referenced in scan output. Nmap's official documentation at nmap.org describes scan types, timing, and output formats that ScanSuite's engine implements. OWASP's Web Security Testing Guide covers port scanning during authorized application assessments. MITRE ATT&CK technique T1046 documents adversary network service discovery tactics that defensive scanning helps mitigate. Understanding these authoritative sources helps analysts interpret results correctly and distinguish normal defensive filtering from indicators of compromise during security investigations.
Summary
ScanSuite's free online port scanner uses Nmap to perform TCP SYN scans against the top 100 ports on any public IPv4, IPv6, or hostname target. Results stream in real time showing open, closed, and filtered port states. Premium unlocks Masscan, UDP scanning, custom port ranges, service version detection, and OS fingerprinting — a browser-based alternative to Nmap CLI and Zenmap for external exposure assessment.