Online Port Scanner
Check open, closed, and filtered TCP ports on any domain or IP. Scan 19 common ports or define custom ranges up to 100 — free and instant.
Why Port Scanning Matters for Server Security
Every open port on your server is a potential attack surface. Port scanning lets you audit your server's exposure from an external perspective — exactly what an attacker sees when probing your infrastructure.
Common security issues port scanning reveals:
- Exposed databases: MySQL (3306), PostgreSQL (5432), Redis (6379), and MongoDB (27017) should never be publicly accessible.
- Unrestricted SSH: Port 22 open to 0.0.0.0/0 is a brute-force target — restrict to known IPs.
- Development servers: Ports like 8080 or 3000 accidentally left open in production environments.
- Legacy services: Telnet (23), unencrypted FTP (21) — deprecated protocols with known vulnerabilities.
- RDP exposure: Port 3389 open publicly is a ransomware entry point — always tunnel through VPN.
Understanding the results
Each scanned port returns one of three states. Open means a service accepted the TCP connection. Closed means the host reachable but nothing is listening. Filtered means a firewall silently dropped the probe — common on production servers with strict allowlists.
- Port 22 open: SSH is reachable; safe only if key-based auth and IP restrictions are in place.
- Port 443 open, 80 closed: HTTPS-only policy, good practice.
- Port 3306 open externally: MySQL should almost never be internet- facing — bind to localhost or a private network.
- All ports filtered: strong firewall posture, but ensure your app ports are actually reachable from where they need to be.
Common issues and fixes
- SSH (22) open to 0.0.0.0/0: restrict to specific IPs via security group; enable fail2ban and disable password auth.
- Redis (6379) with no auth: Redis defaults to no password — add
requirepassand bind to a private interface immediately. - PostgreSQL (5432) exposed: restrict
pg_hba.confto internal CIDRs and front the DB with a bastion or VPN. - Admin panel on 8080/8443: move behind VPN or protect with IP allowlist and strong auth; default admin interfaces are scanned constantly.
- Unexpected open port: could be a forgotten dev service — audit with
ss -tlnpon the host and kill what you do not recognize.
What to do next
Treat every unexpected open port as a potential intrusion point: close it, move it behind a VPN, or firewall it to known source IPs. Re-scan after changes to confirm exposure is gone.
For continuous monitoring, FlashMon.app tracks changes automatically and alerts you the moment something breaks.
Monitor your ports 24/7
Get instant alerts when unexpected ports open or critical services go down.
Frequently Asked Questions
A port scanner attempts TCP connections to specific ports on a target host to determine whether each port is open (accepting connections), closed (actively refusing connections), or filtered (no response, likely blocked by a firewall). FlashMon's port scanner performs real TCP handshakes from our server with a 3-second timeout per port, giving you an accurate picture of your server's exposed services from an external perspective.
Open means the port is actively accepting TCP connections — a service is listening and reachable. Closed means the port responded with a TCP RST (reset), indicating the host is reachable but no service is running on that port. Filtered means no response was received within the timeout — typically caused by a firewall silently dropping packets. Filtered ports are the most ambiguous: the host may be up but a firewall is blocking the probe.
For a typical web server, only ports 80 (HTTP) and 443 (HTTPS) should be publicly open. Port 22 (SSH) should be restricted to specific IP addresses via firewall rules, not open to the internet. Database ports like 3306 (MySQL), 5432 (PostgreSQL), 6379 (Redis), and 27017 (MongoDB) should never be publicly accessible — they should only be reachable from your application servers on a private network. Exposing database ports publicly is a critical security risk.
Yes. Enter any combination of individual ports (80,443,8080) or ranges (8000-8100) in the ports field, with a maximum of 100 ports per scan. Ranges are specified with a dash (e.g., 3000-3010) and can be combined with individual ports using commas. If you leave the ports field empty, the scanner checks the 19 most common service ports including HTTP, HTTPS, SSH, FTP, SMTP, DNS, and major databases.
Port scanning sends multiple TCP connection attempts to external servers, which consumes network resources and can look like a probe to the target. To prevent abuse and ensure fair use for all users, FlashMon limits port scans to 3 requests per IP per minute. Additionally, private and loopback IP addresses (192.168.x.x, 10.x.x.x, 127.x.x.x) are blocked as scanning internal networks has no legitimate use via an online tool.
A one-time scan shows your current port state, but services can unexpectedly open or close — a misconfiguration might expose a database port, or a firewall rule might accidentally block your web server. FlashMon's continuous monitoring checks your critical ports on a schedule and alerts you immediately when the status changes. Catching an accidentally exposed Redis port within minutes vs. days can be the difference between a minor incident and a major breach.