Port Scanning: Concepts & Ethics

By the end of this lesson you can:

• Explain what a port scan determines and how (connect vs. SYN scans).
• Interpret port states: open, closed, filtered.
• State clearly what's legal and what's a crime — and why.
• Frame scanning as a defensive tool: auditing your own attack surface.

Recall from Lesson 3: a port is a numbered door, and a service listening on it is an open door. A port scan walks down the building checking which doors are open. To a defender that's a self-audit ("why is door 6379 open?"); to an attacker it's the first step of an intrusion — which is exactly why scanning others is treated so seriously by law.

What a scan determines

For each port, a scan figures out its state by how the target responds to the TCP handshake (Lesson 3):

OPEN      a service is listening → handshake completes (SYN-ACK)
CLOSED    nothing listening → connection refused (RST)
FILTERED  a firewall drops the packet silently → no response (timeout)

An open port means a service is reachable there; combined with banner-grabbing (Lesson 7) it can reveal what service and version — which tells an attacker what to target, and tells a defender what to lock down or patch.

Scan types

• TCP connect scan — complete the full handshake (what socket.connect does). Simple, no special privileges, but noisy (logged by the target). This is all we'll build.
• SYN ("half-open") scan — send SYN, get SYN-ACK, then never complete; stealthier and faster. Needs raw-socket/root privileges and tools like nmap. We'll discuss but not weaponise it.
• UDP scan — harder (no handshake); slow and unreliable.

⚠️ The legal line — read this twice

Where scanning is legal

✓ your own machine (127.0.0.1) and your own LAN devices
✓ VMs/containers you created, on an isolated lab network
✓ a signed penetration-test engagement (explicit, scoped, in writing)
✓ a bug-bounty program — ONLY within its published scope and rules
✓ purpose-built practice targets (e.g. scanme.nmap.org, which EXPLICITLY
  permits scanning; CTF/lab ranges like HackTheBox, TryHackMe)
✗ anything else — a stranger's server, a company you don't work for,
  "just to see" — is unauthorized and potentially criminal.

The defender's use: self-audit

The most valuable scan you'll ever run is against your own systems. It answers: which ports are exposed? Are any that shouldn't be (a database, a debug server, an old service)? Does the reality match my intended attack surface (Lesson 2)? Regular self-scans catch misconfigurations (Lesson 34) before attackers do. That's the framing for everything you build next lesson.

Being a good citizen even when authorised

• Rate-limit — a fast scan can look like an attack and stress the target.
• Scope tightly — only the ports/hosts agreed; never "wander."
• Log what you do — a record of authorised activity protects you.
• Report responsibly — findings go to whoever can fix them, privately.

Goal: a single-port probe against 127.0.0.1 that classifies the state (open/closed/filtered) — the building block of next lesson's scanner, framed as reading your own machine.

import socket

def port_state(host: str, port: int, timeout: float = 1.0) -> str:
    """Classify a TCP port. LOCALHOST / authorised hosts only."""
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.settimeout(timeout)
        result = s.connect_ex((host, port))    # 0 = connected
        if result == 0:
            return "open"
        elif result in (111, 61, 10061):       # ECONNREFUSED (varies by OS)
            return "closed"                      # something actively refused
        else:
            return "filtered/closed"             # timeout/drop → maybe firewalled

HOST = "127.0.0.1"     # your own machine — the only target this lesson
for port, label in [(3000, "dev server"), (5432, "PostgreSQL"),
                    (22, "SSH"), (9, "discard")]:
    print(f"{port:5} {label:12} → {port_state(HOST, port)}")

3000  dev server   → open
5432  PostgreSQL   → closed
22    SSH          → closed
9     discard      → filtered/closed

Read the result

The state classification turns raw connection results into the security picture from the concept section: open = a reachable service (audit it — should it be exposed?), closed = refused (nothing listening), filtered = no answer (often a firewall dropping packets). Run defensively against your own machine, this immediately surfaces questions like "is my dev database open?" Note the hard-coded HOST = "127.0.0.1" — the ethics aren't optional, they're built into the code. Next lesson turns this into a full, responsible scanner.

A port scan sends packets to a target to learn which ports are open (service listening), closed (refused), or filtered (firewalled/dropped) — it's active recon, fundamentally different from passive (Lesson 6). Because it touches the target, scanning a host you don't own or lack written authorization for is potentially a crime — intent and "no harm done" are not defences. Legal scanning is your own systems, scoped engagements, bug-bounty in scope, and purpose-built practice targets like scanme.nmap.org. The best use is defensive: self-audit your attack surface. Next lesson you build a scanner with an authorization allow-list baked in.