What is it?
Network scanning is the process of probing systems to discover which hosts are live, which ports are open, and which services are running on them. Nmap is the industry-standard tool for this. A scanned port can return one of three states: Open (a service is actively listening), Closed (reachable, but nothing is listening), or Filtered (a firewall or ACL is silently dropping the probe, so nmap cannot even tell if it’s open or closed).
Why should I learn it?
Scanning is the phase that turns “here’s an IP range” into “here’s what’s actually running and reachable.” Every later phase — enumeration, vulnerability assessment, exploitation — depends on accurate scanning results.
How it works
A TCP SYN scan (nmap -sS <target>) sends a SYN packet to each port → an open port replies SYN-ACK, so nmap records it as open and never completes the handshake → a closed port replies RST → a filtered port gets no reply at all, because a firewall dropped it silently. This is why “filtered” doesn’t mean “safe” — it just means the scanner couldn’t determine the state.
Real-world example
A scan against a web server typically shows port 443 open (HTTPS is meant to be public), while an internal database port like 3306 shows as filtered — a firewall correctly blocking it from reaching an unauthorized scanner, exactly as it should.
Troubleshooting mindset
If a scan comes back with everything showing “filtered,” don’t assume the host is down — it’s far more likely a firewall is dropping unsolicited probes, which is actually a sign the network is defended correctly.
Common mistake
Do not memorise the definition without connecting it to real engagement practice. Ask: what does this concept mean for what I’m allowed to actually do, and how would I prove I stayed within scope?
Quick recap
- Understand the job of the phase or technique.
- Know where it sits in the overall testing methodology.
- Always tie it back to authorization and scope.
- Connect the topic to the next phase of the engagement.
Interview connection
Explain the concept in simple words first, then connect it to authorization and real engagement practice. That is stronger than repeating a tool name.
References & Further Reading
- AddySec original content — written for the Ethical Hacking track to build practical, interview-ready understanding.
Apni Bhasha mein samjho
Port sirf open ya closed nahi hota — filtered bhi ho sakta hai (firewall ne response hi drop kar diya). Teeno states ka matlab alag hai.
Kaise padho?
Concept ko pehle flow ke saath samjho. Phir English note ke technical terms, commands aur tables dekho — technical terminology same rahegi.