Port Scanner (TCP) - Check Open Ports From Outside

A port is not a physical thing — it is a number in a TCP packet that tells the operating system which waiting program should receive the data. A web server listens on 443, a mail server on 25, a database on 3306. Scanning a port means trying to open a TCP connection to it and watching what comes back. The three-way handshake makes this a clean test: your machine sends a SYN, and an open port replies with a SYN-ACK, a closed port replies with a RST (reset), and a firewalled port replies with nothing at all. Those three responses map directly to the three results this tool shows — open, closed, and filtered.

This scanner completes the full handshake (a TCP connect scan) rather than the half-open SYN scan a low-level tool like nmap can do with raw sockets, because completing the handshake is all a normal network application is allowed to do. The practical difference is that a connect scan is visible in the target's logs, where a half-open scan tears the connection down before the application layer notices. For auditing your own server that visibility is fine; it is worth knowing if you expect a scan to be quiet.

Because the connection originates from our server, the results are the external view — what a stranger on the internet sees when they look at your host. That is exactly the perspective you want when checking a firewall, and exactly the wrong perspective for checking a service that is only meant to be reachable from inside your own network, which will show as filtered from outside even though it is working perfectly.

This is a focused reachability check, not a full security scanner. It tests up to 20 TCP ports, does not probe UDP (which is stateless and needs different techniques), and does not fingerprint versions or test for known vulnerabilities. For a complete audit — every port, service versions, scriptable vulnerability checks — run nmap or a dedicated scanner from a machine you control against a host you own. Think of this tool as the quick “is that port exposed from outside?” question, answered without installing anything.

It also refuses to be pointed anywhere it should not go. Private, loopback, and link-local ranges are blocked, and because the dangerous case is a public hostname resolving to an internal address, the name is resolved first and the scan is refused if the resolved IP falls in a blocked range — closing the server-side request forgery hole where a diagnostic endpoint gets used to probe a cloud provider's internal network. Beyond the technical guard, there is a legal one: unsolicited scanning of systems you do not own can violate a host's terms of service and local law. Scan your own infrastructure, or targets you have written permission to assess, and nothing else.