Tool · Network

Port Scanner

A TCP connect scan against a host or IP: fifteen common ports by default, or a custom list of up to fifty. Each port gets two and a half seconds to complete a handshake, and the scan runs in small batches rather than all at once.

Port preset

The vantage point is the whole story

The connection is opened from PermitANY's server, not your machine. So it answers "what does this host expose to an arbitrary host on the internet?" — the question that matters about your own perimeter, and the one no internal scan can answer, because an internal scan sits inside the firewall that is supposed to be doing the work.

It cannot answer "can I reach this port from where I am sitting?". Your path has a different source address, route and policy. A port open here and closed from your desk is not a contradiction — it is the firewall rule, the geo-block or the source-based ACL working. A private address will never work here at all.

What a closed port does not prove

A TCP connect scan completes the three-way handshake, so an open result is solid: something accepted a connection. The negative is weak, in three ways.

Closed and filtered look identical. A port returning RST because nothing listens and a port whose packets a firewall silently drops land in the same column. The difference matters — service absent versus service possibly running and protected — and telling them apart needs the timing and ICMP detail a raw-socket scanner sees. They are reported together deliberately, not guessed at.
A timeout is a timeout, not an answer. Two and a half seconds is generous for a healthy host and short for one behind congestion or rate limiting. Trip a protection device and the first few ports answer while the rest appear uniformly closed — that shape is itself the clue.
Nothing here touches UDP. DNS, SNMP, NTP, IKE, syslog and every forgotten TFTP server are UDP, and this tool has no view of them. An empty result does not mean a quiet host.

An open port does not prove what is behind it

The service name comes from the port number alone — no banner is read and no protocol spoken. "3306 open" means something accepted a TCP connection on 3306: commonly MySQL, sometimes an SSH tunnel endpoint, occasionally a honeypot, often a load balancer health check listener that speaks nothing at all. It says nothing about version, patch level or authentication. An open port is attack surface, not a vulnerability.

Authorisation is not a formality. Scanning hosts you do not own or have written permission to test is a civil or criminal matter depending on jurisdiction, and a connect scan is fully logged at the target — complete handshakes with a source address, stealthy by no definition. Scan your own perimeter.

The default fifteen, and why these

21 / 23FTP and Telnet — cleartext credentials; finding either open is itself the finding

22SSH — expected on infrastructure, worth questioning on anything public

25 / 110 / 143SMTP, POP3, IMAP — mail; 25 open on a non-mail host suggests a relay

53DNS over TCP — used for zone transfers and large answers

80 / 443HTTP and HTTPS — plus 8080 and 8443, where admin interfaces hide

445SMB — should never answer from the internet, and still does

3306 / 5432MySQL and PostgreSQL — a database reachable from outside is a misconfiguration

3389RDP — the single most reliably brute-forced port on the internet

When to use something else

For a range rather than a host, from inside your own network, subnet-scanner sweeps a subnet and host-vulnerability-scanner goes past the open port to the service and its version. When the question is why a port is unreachable rather than whether, network-path-analyzer walks the path hop by hop, and path-mtu-analyzer finds the case that looks like a firewall and is not: the handshake completes, then the connection hangs on the first large packet. To prove what is on the wire rather than infer it, packet-capture-analysis settles the argument, and acl-security-review is where to take the rule set once you know which ports answer and should not.