Port scanning

What it means

Port scanning is the practice of sending connection requests to the numbered ports on a server to see which are open and what service is listening behind them. A web server usually answers on 443, remote administration on 22 or 3389, a database on its own port. Tools such as Nmap automate it.

The idea that makes it click: each open port is a service that someone has to keep patched and configured. Scanning does not break anything by itself. It is a map-making step, and the map shows which services are reachable from where the scanner stands.

Why it matters

Attackers scan the internet continuously and pick up new servers within hours of them appearing. A database port left open to the world, or an old admin service nobody remembered, is found long before you review it. That is part of your attack surface.

For your business the effect is simple: exposed services get probed and, if weak, used. Open databases, cache servers and remote desktop ports have a long record in breaches. Knowing what is open from outside is the first step of vulnerability management.

How it shows up

You meet it in two ways. Defenders scan their own addresses from outside, to compare what is open with what should be, and attackers do the same without asking. In cloud accounts, an overly broad security group is the usual reason a port is open that nobody intended.

Repeating mistakes: a test database opened to the internet for convenience, management interfaces on public addresses, and services left running after a project ended. The fix is a default of closed, with only the needed ports allowed, plus a firewall rule per service. Rescan after each infrastructure change, not once a year.