Level 3 · 3C Networks · Lesson 2 of 3
Open ports: scanning with permission
A port scan asks, door by door, whether any service is listening. It's the first thing an attacker does to find a way in, and the first thing a defense team does to know what's exposed. The best-known tool is called nmap.
How to read a result
Each port shows up as open (a service is listening), closed (nothing there) or filtered (a firewall hides it). What matters is comparing what's open with what's really needed: anything open that isn't used is one door too many.
grep open escaneo.txt
grep -c open escaneo.txt- The first line keeps only the report's open ports.
- The second counts them. Then you compare that list with what the server needs.
The usual alarms
A database (for example MySQL on 3306) open to the internet, an unencrypted remote access like telnet (23), a remote desktop (3389) or exposed admin panels. Whatever shouldn't be public is closed with the firewall or left listening only on the inside.
Going deeper
Changing the port isn't hiding
Moving a service to an unusual port (for example SSH to 2222) cuts down a little of the bots' noise, but it isn't security: a full scan finds it anyway. What protects you is closing what isn't used, updating what is and requiring strong passwords or keys.
Review questions
In a scan, what does it mean when a port is “open”?
Answer: That a service is listening there. Open means something answers on that port: a door you can knock on.
Your web server has 3306 (database) open to the internet. What should you do?
Answer: Close it to the public and let the database talk only to the app, from the inside. What doesn't need to be public isn't exposed. Changing the number doesn't hide it from a scan.
When is it OK to scan a server's ports?
Answer: When it's yours or you have the owner's written permission. Scanning your own systems or with authorization is part of defense work. Someone else's without permission, no.