Network Security & Port Scanning: Which Ports Should Be Open?

1. What is a Network Port? The TCP/UDP Transport Layer Architecture

While an IP address delivers a data packet across global routes to the correct physical or virtual machine, a modern operating system runs dozens of concurrent services, processes, and applications (such as web servers, database engines, mail daemons, and SSH consoles). Network Port numbers (ranging from 0 to 65,535) provide the 16-bit abstraction layer that directs inbound and outbound network packets to the exact listening software application.

Port numbers are governed by the Internet Assigned Numbers Authority (IANA) and categorized into three distinct ranges:

• Well-Known Ports (0 to 1,023): Reserved for privileged system services and ubiquitous internet protocols (HTTP, HTTPS, SSH, DNS).
• Registered Ports (1,024 to 49,151): Assigned by IANA for vendor-specific applications, database engines, and commercial services.
• Dynamic / Ephemeral Ports (49,152 to 65,535): Allocated dynamically by operating systems for outbound client-side connections.

2. Essential Network Ports: Security Directory

Port Number	Protocol / Service	Default Transport	Security Exposure Recommendation
80 & 443	HTTP / HTTPS	TCP	Publicly Accessible: Required for public web servers and SSL web applications.
22	SSH (Secure Shell)	TCP	Strictly Restricted: Never expose directly to the internet without key-based authentication, fail2ban, or VPN access.
3389	RDP (Remote Desktop)	TCP/UDP	NEVER Public: Prime vector for brute-force attacks and ransomware deployment. Enforce VPN isolation.
21 / 23	FTP / Telnet	TCP	DISABLED: Legacy plaintext protocols vulnerable to packet sniffing. Replace with SFTP/SSH.
53	DNS (Domain Name System)	UDP/TCP	Restricted: Authoritative DNS only; recursive resolvers should never be publicly open to prevent amplification attacks.
25 / 587	SMTP / Submission	TCP	Specialized: Port 25 for mail server relaying; Port 587 with STARTTLS for authenticated mail clients.
3306 / 5432	MySQL / PostgreSQL	TCP	INTERNAL ONLY: Exposing production SQL databases directly to the public internet is a critical security vulnerability.
6379 / 27017	Redis / MongoDB	TCP	INTERNAL ONLY: Default configurations often lack authentication; keep strictly bound to 127.0.0.1 or private VPC.

3. Understanding Port States: Open, Closed, and Filtered

When an automated port scanner queries a remote host, it categorizes ports into three primary states based on the packet responses received:

1. Open (Listening): A background server application is actively bound to the port and returned an acknowledgment (such as a TCP SYN-ACK). Traffic can enter the application.
2. Closed (Reset): The host received the packet, but no service is listening on that port. The operating system kernel immediately returns a TCP RST packet indicating the port is unoccupied.
3. Filtered (Firewall Dropped): The packet elicited zero response or triggered an ICMP Administratively Prohibited reply. An intermediate or host-based firewall (such as iptables, UFW, or AWS Security Groups) dropped the packet, concealing whether the port is open or closed.

4. Scanning Methodologies: TCP Full Connect vs. SYN Stealth Scans

Security engineers use different scanning methodologies to evaluate attack surfaces:

• TCP Connect Scan: The scanner establishes a full 3-way TCP handshake (SYN -> SYN-ACK -> ACK) using standard operating system socket calls. Highly reliable, but logged by target applications.
• SYN Stealth Scan (Half-Open): The scanner transmits a SYN packet. If the target returns SYN-ACK, the scanner immediately terminates the connection with a RST packet before completing the handshake. This avoids application-level session logging.

5. Firewall Hardening Best Practices for Server Administrators

To protect enterprise cloud servers and VPS instances against automated exploitation:

• Adopt a Default Deny Policy: Block all inbound traffic by default, explicitly whitelisting only essential service ports (e.g., ufw default deny incoming).
• Change Default Management Ports: Moving SSH from port 22 to an arbitrary high port (e.g., port 2222) eliminates over 95% of automated internet-wide credential stuffing bots.
• Deploy Intrusion Prevention (Fail2ban / CrowdSec): Automatically block IP addresses that generate repeated authentication failures or rapid port sweeps.

6. Audit Your Server Ports in Seconds with ToolPing

Verify your firewall rules and check which ports are exposed to the internet using the free ToolPing Port Scanner Tool, or check certificate configurations with our SSL Checker.