Port states — open, closed, filtered, and what the common ports mean

A TCP port can answer three ways. Each one tells you something different about the host, its firewall and what's running.

n check and n ports <host> try to open a TCP connection to each port. Three outcomes:

| State | What happened | What it means |

|---|---|---|

| open | the handshake completed | a service is listening and the firewall lets you in |

| closed | the host answered *reset* | the host is up and reachable, nothing listens there, no firewall in the way |

| filtered | nothing came back | a firewall dropped the packet — on the host, the router, or in between |

*Closed* is informative: it proves reachability. *Filtered* everywhere usually means a host firewall that drops everything except what it explicitly allows (Windows Defender Firewall on a public profile behaves like this).

The ports netscrew checks first, and why

• 22 SSH · 3389 RDP · 5900 VNC — remote access. Open to the LAN is normal; open to the internet is a risk to know about.
• 445 SMB — file sharing. Never expose it to the internet; on the LAN, n bench and n mount use it.
• 80/443 HTTP(S) · 8080/8443 · 5000/9090 — web UIs and dashboards; n web <host> names them.
• 53 DNS — a resolver (Pi-hole, a router, AdGuard).
• 135/139 — Windows RPC/NetBIOS; noisy, LAN-only.

Scope

Netscrew scans ports on machines you own or administer. Wide audits (all 65 535 ports) are opt-in with --full and are intended for your own hosts.