Understanding Port States
Nmap classifies every tested port into one of six possible states. Reading Nmap output correctly is a fundamental skill — misinterpreting a "filtered" port as "closed" could mean missing a critical attack vector.
The Six Port States
Definition: An application is actively accepting TCP connections, UDP datagrams, or SCTP associations on this port.
Behavior: For TCP scans, the target responds with SYN-ACK. For UDP, the service may send application data or remain silent. For SCTP, the target sends INIT-ACK.
What it means: This is the most important result in any scan. An open port means a service is listening and can potentially be exploited, accessed, or further enumerated.
Port 80/tcp open http Apache httpd 2.4.41Definition: The port is accessible (receiving and sending packets) but no application is listening on it.
Behavior: For TCP, the target responds with RST (reset) to any connection attempt. For UDP, the target sends ICMP "port unreachable." For SCTP, ABORT is sent.
What it means: Closed ports are not directly exploitable but still reveal information. They confirm the host is alive, the port is not filtered by a firewall, and the IP stack is functioning normally.
Port 443/tcp closed httpsDefinition: Nmap cannot determine whether the port is open because packet filtering prevents probes from reaching it.
Behavior: No response is received from the target. The probe may have been dropped by a firewall, ACL, or network device. Some firewalls send no response; others may send ICMP admin-prohibited.
What it means: Filtered ports strongly suggest a firewall or security device is in place. This is valuable intelligence for mapping network defenses. Nmap cannot tell if the port is open behind the filter.
Port 22/tcp filtered sshDefinition: The port is accessible but Nmap cannot determine if it is open or closed.
Behavior: Only seen with ACK scans (-sA). The target responds to ACK probes, indicating the port is not filtered, but ACK scans cannot determine if the service is actually listening.
What it means: Unfiltered ports appear during firewall mapping. They tell you that no filter blocks ACK packets to that port, but you need a different scan type to determine the actual port state.
Port 80/tcp unfilteredDefinition: Nmap cannot distinguish between an open port and a filtered port.
Behavior: This ambiguous state occurs with UDP scans, IP protocol scans, FIN scans, NULL scans, and Xmas scans when no response is received. Open UDP ports often do not respond. Filtered ports also do not respond.
What it means: This is a common and frustrating result. It means you need additional scanning techniques: try a SYN scan for TCP ports, or use version detection (-sV) to trigger a service response.
Port 53/udp open|filtered domainDefinition: Nmap cannot distinguish between a closed port and a filtered port.
Behavior: Only seen with idle scans (-sI). The IPID increment analysis produces ambiguous results when the zombie host is not truly idle or when the target behavior is unusual.
What it means: This is the rarest state. It suggests issues with the idle scan technique itself rather than the target. Try a different scan type or a different zombie host.
Port 22/tcp closed|filtered sshHow Scan Types Produce Different States
The same port can produce different states depending on which scan technique you use. This table shows how Nmap classifies responses from each scan type.
| Scan Type | Open Response | Closed Response | Filtered Response |
|---|---|---|---|
| TCP SYN Scan (-sS) | SYN → SYN-ACK → RST | SYN → RST | SYN → [no response] |
| TCP Connect (-sT) | SYN → SYN-ACK → ACK | SYN → RST | SYN → [timeout] |
| UDP Scan (-sU) | UDP → [silence or data] | UDP → ICMP unreachable | UDP → [no response] |
| FIN/NULL/Xmas (-sF/sN/sX) | Probe → [no response] | Probe → RST | Probe → [no response] |
Reading Nmap Output
Nmap output follows a consistent format. Learning to read it quickly is essential during time-sensitive engagements like CTFs and live penetration tests.
Output Format Breakdown
PORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5Info
nmap-services file. It is often wrong if a service runs on a non-standard port. Always use -sV to confirm the actual service.Practical Tips
Tip
open|filtered, try using -sV or -sS to get a more definitive result. Version detection sends application probes that often trigger responses from open services.Warning
filtered port is closed. It may be open behind a firewall. Document filtered ports separately — they represent potential attack surface that could become exploitable if the firewall rules change.Info
--reason to see exactly why Nmap classified each port the way it did. This flag shows responses like "syn-ack", "reset", "no-response", or "admin-prohibited" for every port.