Port Scanner
Twenty well-known ports, one TCP connect each, from sysosx's server — and three honest answers, not two. A port can be open (something answers), closed (the host actively refuses), or filtered (silence — usually a firewall dropping packets, not proof nothing is there). The default target is scanme.nmap.org, the public host the nmap project runs precisely so people can learn scanning; for any other host, scan your own servers or ones you are authorised to test.
Want this watched continuously? Monitor this free with myeventwatch — expiry and downtime alerts, no card required.
What the scan measures
A port scan is often described as "checking which doors are open", and the metaphor is accurate enough to be useful — with one correction. A door can be open, locked, or simply unanswered: knocking and hearing nothing is not the same as finding the door locked, and a scanner that reports only open and closed is hiding the third case. This scanner therefore reports open, closed and filtered as three distinct states. Open means the connect succeeded, so a service is listening and accepting connections. Closed means the host sent a reset — it is alive and it has nothing on that port. Filtered means the full one-second wait passed in silence, which is what a firewall dropping packets looks like from outside; the port may have a service behind that firewall, and the scan cannot say otherwise. Keeping filtered separate is the difference between a result you can act on and one that quietly misleads you.
The scan is deliberately narrow. It probes a fixed list of about twenty ports — web (80, 8080, 8443, 443), mail (25, 110, 143, 993, 995), DNS (53), remote access (22, 23, 3389, 5900), file sharing (445), databases (3306, 5432, 27017) and a few others — with plain TCP connects and nothing else. There is no banner reading, so the scan never learns (or leaks) a service version; no UDP, whose "filtered" answers are far noisier; and no way to supply your own ports, because an arbitrary-port input turns a first-look tool into a general mapping service. The target itself is resolved once and every connect goes to that one pinned address, so a name that changes mid-scan cannot redirect the probes elsewhere. Under the hood, the page calls GET /api/check/port-scan on sysosx's server, which runs the twenty connects in parallel and caches the result for ten minutes.
Reading a result
Start with the open ports — they are the actual attack surface, the services the internet can reach. An open 22 or 3389 means remote access is reachable from anywhere, which may be intended (a server you administer) or may be the first thing to restrict to your own addresses. An open database port (3306, 5432, 27017) facing the internet is almost never intended and deserves immediate attention: databases are meant to be reached by applications, not by the whole internet. Open 80 and 443 are normal for a web server; open mail ports are normal for a mail server; everything else open should be able to explain itself. Closed ports need nothing: the host is alive and refusing, which is the expected state for most of the list on most servers. Filtered ports deserve a second look only if you expected something there — a service you run that the scan cannot see is usually a firewall rule doing its job, or a service bound to the wrong interface, and the scan alone cannot tell those apart. A result with no open ports at all is a normal result, not an error: it means none of the twenty usual services are reachable from this server's vantage point, which is exactly what a hardened host looks like.
Related tools: SSL grader for the TLS setup on port 443 once you know it is open, website health check for reachability and records together, and DNS propagation checker when the question is where a name points rather than what answers on it.
Further reading: what open ports say about a server — how to read a scan like an operator, which open ports are normal and which are a page-at-3am waiting to happen.
Frequently asked questions
How is this different from running nmap?
Nmap scans everything, every way: full port ranges, UDP, version detection, OS fingerprinting. This tool does one narrow thing from sysosx's server — TCP connects to a fixed list of about twenty well-known ports, and nothing else. No banner reads, no version detection, no UDP, no custom ports. That narrowness is the point: it answers "what is listening on the usual ports?" without becoming a general-purpose scanner anyone can aim at anything.
What do open, closed and filtered actually mean?
Open means a TCP connect succeeded — something is listening and accepting connections on that port. Closed means the host actively refused the connection (a reset packet), which is how a live host with nothing on that port answers. Filtered means the port gave no answer at all within one second — typically a firewall silently dropping packets. Filtered is not closed: a filtered port may have a service behind a firewall, and the only honest statement is "no answer". The result table keeps all three states separate for exactly that reason.
Why only twenty ports, and why can I not add my own?
Because a port scanner with an arbitrary port input is a tool for mapping any host on the internet, and this site is not going to be that. The list covers the ports that matter for a first look — web, mail, DNS, databases, remote access, file sharing — and the server refuses everything outside it. If you need a full scan of a host you own, run nmap from your own machine, where you control the scope and the consequences.
Why is scanme.nmap.org the default?
Because it exists for exactly this purpose: the nmap project runs it as a public target anyone may scan, to learn how scanning works. It is the one host on the internet where scanning needs no permission discussion. For any other host, the rule is simple: scan your own servers, servers you are authorised to test, or public test targets — never a stranger's infrastructure.
Why is the result cached for ten minutes, and why five fresh scans an hour?
One scan is twenty parallel TCP connects, not one handshake, so it costs more than the other checks and is easier to abuse for bulk probing. Ten-minute caching means a repeat check of the same host costs nothing, and the stricter fresh limit (five an hour per visitor, two a minute at most) keeps the tool usable for a human checking their own servers without becoming a probing service. A cached result is labelled as such; a host's open ports rarely change minute to minute.