Port scans explained: How to protect yourself from hidden cyberthreats

Every network, whether at home or in a company, is exposed to potential security risks. Open ports are often unnoticed entry points for cyber attacks and pose a serious threat. Many users do not realise that attackers are constantly checking these digital ‘doors’ to exploit vulnerabilities. A port scan is therefore an indispensable tool for uncovering and closing such security gaps. Security tools such as Avira Free Security help you to protect your systems from a variety of online threats and increase the security of your network.

Basics: What is a port, port scanning and a port checker?

Ports are a fundamental part of any network communication and play a central role in connecting services and devices. Understanding how ports work and how they can be secured is critical to protecting your network.

What is a port?

A port is a virtual connection interface through which devices in a network communicate with each other. Imagine ports as doors in a house: each door leads to a specific function or service.

An example is port 80, which is used for websites (HTTP), or port 443, which enables secure connections (HTTPS).

Ports work in conjunction with IP addresses. While the IP address identifies the “house,” the ports indicate which rooms (services) are accessible. There are a total of 65,535 ports, divided into three standardised ranges:

1. Well-known Ports (0–1023): Used for well-known and commonly used services like HTTP, HTTPS, and FTP.
2. Registered Ports (1024–49151): These are registered for specific applications or services, such as SQL databases or many enterprise solutions.
3. Dynamic/Private Ports (49152–65535): These are used dynamically by applications, for example, for temporary connections in certain protocols.

Ports can have three states:

• Open, when they accept connections;
• Closed, when they actively reject connections;
• Filtered, when they are blocked by a firewall or security policy and thus do not respond to requests.

What does a port scan do?

A port scan is performed systematically and depends on the chosen scan type. Port scans are often carried out using specialised tools known as port scanners:

1. The scanner defines a target: either a single IP address or a whole range.
2. Data packets are sent to specific ports.
3. The responses from the ports indicate whether they are open, closed, or filtered.

Attackers use port scans to find vulnerabilities. At the same time, port scanning is an essential tool for IT professionals and security-conscious users to secure their networks.

What is a port checker?

A port checker is a tool that helps you, as a user, specifically check individual ports on your device or network. While a port scanner typically analyses multiple ports at once, a port checker focuses on a specific port.

With a port checker, you can verify whether a specific service is active or if a port is properly configured. This is particularly important for identifying potential security risks: open ports that are not needed could be exploited by attackers.

By regularly checking ports, you can ensure that only the ports necessary for your requirements are accessible, thereby enhancing the security of your network.

Goals and use cases of port scans: Why check ports?

Port scans are not only important for attackers, but also for defenders. The primary purpose of a port scan is to determine which ports are active on a system and which services are running behind them.

For security-conscious users and IT professionals, a port scan offers the opportunity to actively protect the network. Open ports can pose vulnerabilities, especially if they are not needed.

A regular scan helps to minimise risks by identifying and closing potentially dangerous ports.

Practical Use Cases of Port Scans include:

• Network Security: Identify vulnerabilities before attackers do.
• System Administration: Ensure that only necessary services are active.
• Troubleshooting: Find blocked ports that could impair the functionality of a program.

Types of port scans: Overview of scan techniques

Port scans can be conducted using various methods, depending on the goal and available knowledge. Each method has specific advantages and disadvantages:

Ping scan: Detect devices in the network

A Ping Scan checks if devices in the network are active by sending ICMP data packets (Internet Control Message Protocol) to IP addresses. If a device responds, it is online. Although this is not a direct port scan, the Ping Scan is often the first step in identifying potential targets.

TCP scan: Checking open ports

A TCP scan is one of the most common techniques for checking ports. The scanner uses the Transmission Control Protocol (TCP), a connection-oriented protocol that ensures data is transmitted correctly between two devices.

During the scan, an attempt is made to establish a connection to a target port. The scanner checks whether the port actively responds to requests. If this is the case, the port is considered “open,” as it is ready to accept connections.

Examples of open TCP ports:

• HTTP (Port 80): For unencrypted websites.
• HTTPS (Port 443): For encrypted websites.

TCP scans are considered reliable because they provide clear responses from the target device. However, firewalls can easily detect and block such scans since they monitor unusual connection attempts and actively prevent them.

UDP scan: Identifying services in networks

A UDP scan checks ports that use the User Datagram Protocol (UDP). UDP is a connectionless protocol that sends data without waiting for an acknowledgment from the receiver, unlike TCP, which establishes and confirms connections.

Since UDP does not provide feedback, scans are often more challenging and error-prone than TCP scans. Nevertheless, they are crucial for identifying services that use UDP, such as:

• DNS (Domain Name System): Resolves domain names into IP addresses (Port 53).
• VoIP (Voice-over-IP): Uses UDP for fast voice transmission.

A UDP scan usually takes longer than a TCP scan because missing responses must be interpreted. However, it provides valuable insights into non-TCP-based services and potential vulnerabilities.

SYN scan: Performing quick port checks

A SYN scan, also known as a “half-open scan,” is a technique that uses an incomplete TCP connection to check ports.

The Transmission Control Protocol (TCP) initiates connections with a “Three-Way Handshake”:

1. The scanner sends a SYN packet (Synchronise) to the target port.
2. If the port is open, it responds with a SYN-ACK packet (Synchronise + Acknowledge).
3. Normally, the scanner would reply with an ACK packet (Acknowledge) to complete the connection.

In a SYN scan, however, the handshake is not completed. Instead, the scanner aborts the process after receiving the SYN-ACK packet, resulting in an incomplete connection.

This method has two advantages:

• Speed: Since the full connection setup is skipped, a SYN scan is faster than a regular TCP scan.
• Stealth: Many firewalls do not immediately recognise SYN scans as suspicious because the connections remain incomplete.

Security experts use SYN scans to efficiently check networks for open ports without drawing unnecessary attention.

XMAS scan: Advanced scanning technique

An XMAS scan is a specialised technique used to identify specific vulnerabilities in networks. It involves sending unusual data packets with activated flags to target ports.

In the TCP header (part of the data transmission), there are so-called flags. These flags indicate the type of communication a data packet initiates.

In an XMAS scan, all the flags are activated — including URG (Urgent), PSH (Push), and FIN (Finish). Since all flags are set to “on,” the scan visually resembles a Christmas tree, which is how it gets its name.

How does an XMAS scan work?

• The scanner sends the unusual XMAS packet to a port.
• Open ports typically ignore this unusual request and do not respond.
• Closed ports, on the other hand, send a specific error message in return (depending on the implementation of the TCP/IP protocol).

The TCP/IP protocol is a standard that defines how data packets are transmitted between devices on the internet, with TCP ensuring a reliable connection and IP directing the packets to the correct address.

When is an XMAS scan used?

This technique is primarily used in penetration tests to specifically identify vulnerabilities, particularly in older or misconfigured systems. However, modern firewalls are often capable of detecting and blocking XMAS scans, meaning they are less commonly used today.

Important: XMAS scans are complex and require a deep understanding of the TCP/IP protocol.

Risks and dangers of port scanning: Is a port scan illegal?

Whether a port scan is legal depends on the context. In IT security, port scanning is used to protect networks. However, conducting a port scan without the owner’s consent can be problematic:

• Legal use: If you perform a port scan on your own network or with explicit permission, it is legally acceptable. Such scans serve IT security and maintenance purposes.
• Illegal use: A port scan conducted without consent can be seen as unauthorised access or preparation for a cyber attack. In many countries, this can lead to criminal prosecution.

Security risks from port scanning

Attackers use port scanning to uncover vulnerabilities in a network. Open ports can be exploited to inject malware, ransomware, or other malicious software.

By performing port scans, an attacker could discover that an outdated service is running, which is no longer secure. This information could be used to prepare large-scale DDoS (Distributed Denial of Service) attacks, where networks are deliberately overwhelmed.

Additionally, spoofing techniques may be employed to conceal the origin of an attack. To minimise such risks, it is crucial to close unused ports and correctly configure firewalls.

Protection against unwanted port scanning: Securing networks

Port scanning itself is not dangerous, but the information gathered from it can assist attackers in their assaults. Therefore, it is essential to protect your systems against unwanted port scans. Here are some best practices:

1. Configure the firewall
   A firewall is the first line of defence against unwanted access to data and systems. By configuring firewalls to block or hide unnecessary ports, you significantly reduce the risk.
2. Close unnecessary ports
   Many services use ports that do not need to be active all the time. If a service is no longer required, disable the associated port. This reduces the attack surface of your network.
3. Intrusion Detection Systems (IDS)
   These systems detect and report suspicious activities, such as port scans, in real time. IDS solutions provide additional security through early detection of attacks.
4. Use security solutions
   Tools like Avira Free Security help minimise the risks posed by open ports. These solutions offer extra protection through features such as malware defence, firewall integration, and monitoring of suspicious network activities.

Even for mobile devices, security solutions are useful, such as Avira Free Antivirus for iOS or Android. They complement the protection and prevent smartphones from serving as entry points for attacks.

How do I check if a port is open?

To check if a port is open, you can use a port checker. Alternatively, a port scanner provides a more comprehensive analysis of your network.

Should I disable port scanning?

Port scanning itself is not dangerous, but open ports can represent security vulnerabilities. Instead of disabling scans, you should regularly check which ports need to be active and close unnecessary ones.

How long does a port scan take?

The duration depends on the number of ports being scanned and the method used. A simple TCP scan often takes only seconds, while a thorough UDP scan may take several minutes.

What is the difference between a port scan and an IP scan?

A port scan focuses on the ports of a specific device, while an IP scan aims to identify active devices within a network. Both techniques are often used in combination.

Conclusion: Security through port scanning and effective protective measures

Port scanning is an important tool that presents both risks and opportunities. It helps you identify vulnerabilities in your network and address them early. Unmonitored open ports can serve as an invitation for attackers – but with the right measures and tools, these risks can be minimised.

With a solution like Avira Free Security, you can strengthen your network security and protect your system effectively. Take the first step towards a more secure digital environment by regularly checking your network and ensuring that there are no unnecessary vulnerabilities.