Check which common TCP ports are open on a server you run, seen from the internet rather than from inside your own network. Only scan hosts you own or have permission to test.
A port scan checks whether a host is accepting connections on particular TCP ports. Each open port represents a service listening for traffic — a web server, a mail server, a database — and therefore a way in that needs to be deliberately intended rather than accidental.
This tool checks a set of commonly used ports. Only scan hosts you own or have permission to test.
Open means something accepted the connection. A service is listening and reachable from the internet.
Closed means the host answered but refused — it is online, nothing is listening on that port. This is a perfectly healthy state.
Filtered means nothing came back at all. A firewall is most likely dropping the packets silently. From outside it is impossible to distinguish "a firewall is blocking this" from "the host is down", which is the entire point of dropping rather than refusing.
A handful of port numbers cover most of what a scan turns up:
Scanning your home IP usually shows everything filtered, and that is the correct result. A typical router does network address translation and forwards nothing inbound unless told to, so there is nothing to connect to.
An unexpected open port on a home connection is worth chasing down. The usual culprits are UPnP — where an application asked the router to open a port automatically — or a port-forwarding rule set up for something long since abandoned. Both are worth reviewing in the router's admin interface.
Port scanning a host you do not control is, at best, impolite, and depending on where you and the target are located it may be unlawful. Many providers treat unsolicited scanning as an acceptable-use violation regardless of intent.
Use this against your own servers, or with the documented permission of whoever owns the target. Requests through this tool are rate limited.
A port scan tests whether a host accepts connections on specific TCP ports. Each open port means a service is listening there, so a scan gives you an inventory of what a machine exposes to the network.
It depends on the jurisdiction and on whether you have permission. Scanning your own systems is fine. Scanning someone else's without authorisation may breach computer misuse law and will usually violate your provider's acceptable use policy.
No response came back at all, which normally means a firewall dropped the packets silently instead of refusing them. It deliberately makes a blocked port indistinguishable from an offline host.
That is the expected result for a typical home connection. The router performs network address translation and forwards no inbound traffic by default, so there is nothing listening to reach.
Any port exposing a service that should not be public. Databases on 3306 or 5432, remote desktop on 3389 and plain FTP on 21 are the usual concerns. The risk comes from the service and how well it is secured, not the port number itself.