Free tools Windows power users keep installed
One-click scans. No signup required.
To check a server you own or are authorized to assess, run nmap server.example.com. For a complete TCP inventory, use sudo nmap -sS -p- server.example.com; without raw-packet privileges, use nmap -sT -p- server.example.com. Add -sU when UDP matters, and add -sV when you need the application and version behind a port.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Nmap reports whether ports are open, closed, filtered, or in an ambiguous state. Those states describe what the scan could observe at that moment; they are not, by themselves, a security verdict. Scan only systems and address ranges that are in scope, and coordinate with the system owner if monitoring, rate limits, or production impact are concerns.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What an Nmap port scan actually tells you
Nmap sends probes to a target hostname or IP address and records the response for each tested port. Its standard table contains a port number, protocol, state, and service name. When version detection succeeds, the table also includes version details.
The practical question is whether a process is accepting network traffic. The Nmap Reference Guide defines open this way: "Open means that an application on the target machine is listening for connections/packets on that port." An open result is evidence of a listener, not proof that the service is intended, correctly configured, or secure.
#1 Best Overall
- Used Book in Good Condition
Use the hostname or address of a server you own or have explicit authorization to test. A scan can trigger intrusion-detection alerts, consume network or host resources, and violate policy when aimed at an unapproved system.
Prepare the target and your scanning machine
Confirm the scope
- Write down the exact hostname or IP address to scan.
- Confirm that the address belongs to your server or is covered by your authorization.
- Decide whether the task is a quick check, a complete TCP inventory, a UDP check, or service identification.
- Note whether you need a saved report for a change record, incident review, or hand-off.
Choose the required privilege level
A SYN scan (-sS) uses raw packets and normally requires elevated privileges, shown as sudo in the examples below. A TCP connect scan (-sT) uses the operating system’s connection facility and is the alternative when elevated privileges are unavailable.
Make sure Nmap is available
Run the commands from a terminal on a machine that can reach the target. If the command is not found, install Nmap using your operating system’s approved package process, then rerun the command. Keep the Nmap version and the date of each report with your records when repeatability matters.
Run a quick default scan
For an initial view of commonly used TCP services, run:
nmap server.example.comReplace server.example.com with the server’s hostname or IP address. The output includes a port table when Nmap receives enough information to classify ports. This is a fast first question: which familiar TCP services appear reachable?
A default scan is not an all-port inventory and does not include a UDP assessment. Move to the targeted commands below when you need broader coverage or stronger identification.
Scan every TCP port
Use a SYN scan when raw-packet privileges are available
sudo nmap -sS -p- server.example.comThe -p- option requests all TCP ports rather than only the default set. The -sS option selects a SYN scan. This combination is a practical baseline for finding TCP listeners across the full port range when you can run Nmap with the necessary privileges.
Use a TCP connect scan without elevated privileges
nmap -sT -p- server.example.com-sT performs a TCP connect scan through the operating system. It provides the same all-TCP-port coverage requested by -p-, but uses a different scan method and does not depend on raw-packet privileges.
When host discovery makes the server look offline
Nmap normally performs discovery probes before scanning. Some firewalls and network devices block those probes even though the requested TCP ports are reachable. In that case, tell Nmap to skip host discovery:
sudo nmap -Pn -sS -p- server.example.com-Pn treats the target as available and proceeds with the port scan. It does not disable firewalls or make a filtered port open; it only avoids stopping because discovery did not receive the expected response.
Check UDP ports separately
TCP and UDP are different protocols, so a TCP scan cannot tell you whether a UDP service is exposed. A practical UDP check is:
sudo nmap -sU --top-ports 100 server.example.com-sU selects UDP scanning and --top-ports 100 limits the run to 100 commonly selected UDP ports. UDP checks often take longer than TCP checks because many services do not respond directly. Nmap may therefore report open|filtered when the available responses cannot distinguish a listening service from filtering.
If a UDP result matters operationally, record the exact command and investigate the relevant port with service or application checks. Do not interpret a lack of response as proof that no UDP service exists.
Identify the application and version
A service name beside a port is a useful hint, but it is not proof of the application actually running there. Administrators can place services on unusual ports, and a port-number lookup alone cannot verify the software.
After discovering relevant ports, request version detection:
nmap -sV -p 22,80,443 server.example.comThe -p list limits probing to ports 22, 80, and 443 in this example. The -sV option sends service-specific probes to open or open|filtered ports and reports application and version information when identification succeeds. This gives stronger evidence than the service label inferred from a port number.
Version detection can generate more traffic than a state-only scan. Use it on the ports that need identification, especially on production systems where owners monitor unusual probe patterns.
Choose scan coverage deliberately
There is no single command that answers every port question. Select the smallest scan that provides the evidence you need, then expand it when the result is incomplete.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Question | Command pattern | What it covers | Important qualification |
|---|---|---|---|
| What common TCP services respond? | nmap server.example.com |
Default TCP scan and basic port states | Not an all-port inventory and not a UDP scan |
| Are any TCP ports listening anywhere? | sudo nmap -sS -p- server.example.com |
All TCP ports with a SYN scan | Requires raw-packet privileges in the usual setup |
| Need all TCP ports without elevated privileges? | nmap -sT -p- server.example.com |
All TCP ports with a connect scan | Uses the operating system’s connection facility |
| Did discovery probes falsely mark the host down? | nmap -Pn -sS -p- server.example.com |
All TCP ports while skipping host discovery | Use only for an authorized target; it scans even without discovery confirmation |
| Do common UDP services respond? | sudo nmap -sU --top-ports 100 server.example.com |
100 selected UDP ports | Often slower; open|filtered is common |
| Which software is behind known ports? | nmap -sV -p 22,80,443 server.example.com |
Service and version probes for listed ports | Identification can fail or remain uncertain |
These choices differ on five practical axes:
- Coverage: common TCP ports, every TCP port, or selected UDP ports.
- Privilege and method: SYN (
-sS) versus connect (-sT). - Identification depth: state-only results versus service/version probes (
-sV). - Evidence retention: terminal output versus a normal, XML, or grepable report.
- Operational impact: broader and deeper scans create more traffic and may require coordination.
Understand every port state
| State | Meaning | What to do next |
|---|---|---|
| open | An application on the target is listening for connections or packets on that port. | Confirm that the listener is intended, then use -sV if you need application and version details. |
| closed | No application is listening at the time of the scan, although the port could later be opened. | Compare the result with the server’s expected configuration and rescan after changes. |
| filtered | A firewall, filter, or other network obstacle prevents Nmap from deciding whether the port is open or closed. | Check filtering rules, security groups, routing, and the scan’s network path with the owner. |
| unfiltered | Nmap received a response but could not determine whether the port is open or closed. | Use a scan method or service check that supplies more evidence. |
| open|filtered | Nmap cannot distinguish an open port from a filtered one from the available responses. | Common in UDP scanning; investigate the specific port and filtering behavior. |
| closed|filtered | Nmap cannot distinguish a closed port from a filtered one. | Check whether a firewall is suppressing the response before concluding that no service exists. |
States describe the evidence available from that scan path and time. A port can appear differently from another network location, after a firewall change, or when a service starts or stops.
Read the port table without overtrusting it
A typical row has the form PORT STATE SERVICE, with a VERSION field when version detection identifies the software. The protocol matters: a TCP row and a UDP row for the same number represent different exposure.
Do not confuse the service label with proof
Nmap’s service database associates familiar names with port numbers. That association helps you recognize a likely service, but software can listen on a nonstandard port. Treat the label as a starting point and use -sV when the identity affects a firewall decision, inventory, or incident response.
Do not treat open as automatically unsafe
An open port is an observed listener. Whether it should be reachable depends on the server’s role, the interface, the network segment, and the intended access policy. Compare the result with your approved service inventory instead of closing every open port indiscriminately.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSave scan results for review and comparison
Terminal output disappears when the session ends unless you save it. Nmap provides three useful output forms:
nmap -oN report.txt server.example.com
nmap -oX report.xml server.example.com
nmap -oG report.gnmap server.example.com-oNwrites normal, human-readable output.-oXwrites XML for tools or structured processing.-oGwrites grepable output for text-oriented review.
Grepable output records port, state, protocol, service, and version-related fields when version detection was requested and succeeded. Keep the target, command, scan date, scanner location, and authorization context with the file so a later reader can interpret it correctly.
A repeatable server-audit workflow
- Define the target and authorization. Confirm the hostname or IP address and the permitted time and scope.
- Run the default check. Start with
nmap server.example.comto see whether expected common TCP services appear. - Expand TCP coverage when required. Use
sudo nmap -sS -p- server.example.com, or switch tonmap -sT -p- server.example.comwhen raw-packet privileges are unavailable. - Retry without discovery if necessary. If Nmap reports that discovery indicates the host is down while you know the address is reachable, use
-Pnwith the authorized all-TCP scan. - Add UDP deliberately. Run
sudo nmap -sU --top-ports 100 server.example.comwhen UDP services are part of the threat model or inventory. - Identify software on relevant ports. Apply
-sVto the discovered port list, such asnmap -sV -p 22,80,443 server.example.com. - Save the evidence. Choose normal, XML, or grepable output and retain the exact command with the report.
- Compare with intended exposure. Investigate unexpected open listeners, unexplained filtered ports, and version results that do not match the server inventory.
Troubleshoot common results
Nmap says the host appears down
Discovery probes may be blocked even when the host is available. Confirm the address and authorization, then use -Pn to skip host discovery. If the resulting ports are still filtered, the network path or firewall may be preventing a decision.
The scan shows filtered instead of open or closed
Filtered means a firewall or other obstacle interfered with the determination. Check host firewalls, cloud or perimeter rules, security groups, routing, and any intermediate filtering from the same network location. Do not relabel filtered as closed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
UDP ports remain open|filtered
UDP frequently lacks a response that conclusively proves a port is closed. Allow more time for the scan, verify the port’s expected service, and use version detection or an application-level check where appropriate. The ambiguous state is an evidence limitation, not confirmation of a listener.
The service name looks wrong
Port-number names are suggestions. Run -sV against the port and compare the reported identity with the process and configuration on the server. A service on an unusual port can be legitimate, while a familiar port can host different software.
The scan is too intrusive for the maintenance window
Reduce scope by listing only the ports you need with -p, avoid unnecessary version probes, and coordinate with the owner before a broad or UDP scan. Preserve the command and timing so monitoring alerts can be correlated with the activity.
Use the results to improve the server safely
Start with the intended exposure list: which services must be reachable, from which networks, and over which protocol. For every unexpected open result, identify the listening application and owner before changing configuration. For every expected service that appears filtered, determine whether the filtering is deliberate or an outage.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →After a configuration change, rerun the same command from the same scanning location and compare saved reports. A changed state can reflect a firewall rule, routing path, service lifecycle, or scan method rather than a change on the server itself, so retain enough context to explain the difference.
Official documentation for deeper reference
The Nmap documentation index identifies the Nmap Network Scanning guide and the Nmap Reference Guide as the project’s primary documentation. The service and application version-detection chapter explains how -sV interrogates open or open|filtered ports with service-specific probes. The command reference documents scan options and output switches, including -oN, -oX, and -oG.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
