Online Port Scanner Guide: How to Check Open Ports and Public IP Vulnerabilities

What is an Online Port Scanner?

Every device connected to the internet uses virtual doors called Ports (numbered from 0 to 65535) to direct network traffic. A port scanner is a security diagnostic utility that probes a target Public IP Address to determine which ports are open to incoming connections, which are closed, and which are actively filtered by a network firewall.

When you browse the web, play multiplayer games, or host a local server, your operating system opens specific ports to communicate with remote hosts. However, leaving unnecessary ports exposed to the open internet allows automated botnets, port scanners, and malicious scripts to probe your router for unpatched software vulnerabilities.

How Port Scanning Works (SYN, ACK, and UDP Probes)

Port scanners operate by sending raw TCP or UDP network packets to specific port numbers on a target host and analyzing the response handshake:

• TCP SYN Scan (Stealth Scan): The scanner sends a SYN packet to a port. If the host responds with a SYN/ACK, the port is OPEN. If it responds with a RST (Reset), the port is CLOSED. If no response arrives, the port is FILTERED by a firewall.
• TCP Connect Scan: The scanner completes a full 3-way TCP handshake (SYN, SYN/ACK, ACK). This method is accurate but easily logged by firewalls and intrusion detection systems (IDS).
• UDP Port Scan: UDP is a connectionless protocol. Probing UDP ports involves sending empty packets; if the port is closed, the target returns an ICMP Port Unreachable message.

Most Commonly Targeted Ports and Security Risks

Cybercriminals continuously scan the global IPv4 address space for vulnerable open ports. The most commonly targeted ports include:

• Port 21 (FTP): Used for unencrypted file transfers. Weak password protection on FTP servers invites brute-force credential stuffing.
• Port 22 (SSH): Remote terminal administration. Exposed SSH ports on default port 22 are bombarded thousands of times per day by brute-force password scripts.
• Port 80 & 443 (HTTP & HTTPS): Standard web server ports. Must be secured against web application exploits like SQL injection and cross-site scripting.
• Port 445 (SMB): Server Message Block protocol. Notorious for zero-day exploits such as EternalBlue, which weaponized Ransomware attacks to spread across local networks.
• Port 3389 (RDP): Remote Desktop Protocol. One of the single largest attack vectors for corporate ransomware breaches when exposed directly without a VPN tunnel.

Open, Closed vs Stealth Port States

When you perform an online port scanner test on your home IP address, ports will report one of three states:

1. Open: An application on the target host is actively listening for incoming connection requests on this port. Inbound traffic is accepted.
2. Closed: The target host receives the connection request, but no application is listening. The network interface actively rejects the connection.
3. Stealth / Filtered: A firewall or router drops the incoming packet completely without sending any response back. To external port scanners, the host appears invisible.

How to Audit and Secure Your Router Ports

To ensure your home or business network is not exposed to unsolicited port probes:

• Disable UPnP (Universal Plug and Play): UPnP allows smart IoT devices to automatically open inbound router ports without user authorization, creating security backdoors.
• Use a Stealth Firewall: Ensure your router or OS firewall is configured to drop unrequested inbound packets rather than returning RST packets.
• Audit Your Public IP Regularly: Use our free IP address lookup tool to check your current public IP address and verify that your VPN or firewall is properly shielding your internal network.