Port scanning your own connection: what the results mean

The short version

A port scan knocks on the "doors" of your internet connection to see which ones answer. Doing it to your own connection is a safe, useful health check: it shows what the outside world can reach. Most home connections should have almost nothing open, and that's exactly what you want. This guide explains what open, closed, and stealth mean, and how to shut anything that shouldn't be exposed.

What's actually happening

Imagine your internet connection as a building with thousands of numbered doors (called ports). Each door is a possible way in for a specific kind of traffic. A port scanner walks down the hallway and tries each handle, noting which open, which are locked, and which don't even seem to exist.

You'll see three kinds of answers:

• Open — the door answered and something is listening behind it. This is the one to pay attention to.
• Closed — the door politely said "nothing here." Safe.
• Stealth (or filtered) — the scanner got total silence, as if the door isn't there at all. Also safe, and often considered ideal because your connection doesn't even advertise itself.

Important: a scan from a website tests your router (your public address), not your individual computer tucked behind it. That's usually the right thing to test.

Why it matters to you

• An unexpectedly open port can be a way in for attackers, a forgotten setting, or malware "phoning home."
• Old port-forwarding rules, remote-access features, or a hacked smart device can quietly leave doors open.
• Checking takes a minute and tells you if your front door is hanging open.

How to fix open ports

If the scan found open ports you didn't expect, here's how to close them.

1. Check your router's port forwarding

1. Open your router settings (usually by typing an address like 192.168.1.1 into a browser, or using your router's app) and sign in.
2. Find Port Forwarding (sometimes under "Advanced," "NAT," or "Gaming"). Delete any rule you don't recognize or no longer use. Old rules for a game, camera, or server are the usual culprits.

2. Turn off remote management

1. In the router settings, look for Remote Management or "Access router from internet" and turn it off unless you truly need it. This is a common unnecessary open door.
2. Also disable UPnP if you don't need it, it lets devices open ports by themselves, sometimes without your knowledge.

3. Make sure your computer's firewall is on

• Windows: open Settings, then Privacy & security, then Windows Security, then Firewall & network protection. All three network types should say "on."
• Mac: open System Settings, then Network, then Firewall, and switch it on.

4. Update and check your devices

• Install your router's firmware updates (in its settings), and update your computer and phone.
• A smart device (camera, doorbell) can open ports on its own. If you suspect one, update it or take it off your network.

How to check it worked

Run the scan again. You want to see all ports reported as closed or stealth, with nothing unexpected open. If a port you intentionally use is open (say for a game server you run), that's fine, as long as you know why it's there.

If your result was already good

If everything came back closed or stealth, your connection is in great shape and you don't need to change anything. That's the normal, healthy result for a home network, and it means your router's firewall is doing its job. Just keep your router's firmware updated, leave remote management and UPnP off unless you need them, and re-scan once in a while or after you add a new smart device, since those can open doors on their own.

Want to go further?

The Advanced version covers scanning with nmap (TCP SYN vs. connect, UDP, service and OS detection), the difference between closed and filtered, why you must scan your public IP from outside to see what the internet sees, and how to safely scan your own LAN.

Summary

Port scanning enumerates reachable TCP/UDP services. For a self-audit you care about two vantage points: external (what the internet sees at your public IP, i.e., your router's WAN) and internal (what's listening on your LAN hosts). Results map to states, open, closed, filtered(stealth), unfiltered, open|filtered, that reflect firewall behavior. The healthy external result for a home line is essentially all closed/filtered. The reference tool is nmap (7.95 as of 2025).

What's actually happening

• Ports and states. A TCP SYN to an open port yields SYN-ACK (open); a RST means closed; silence or an ICMP admin-prohibited means filtered. UDP is inferential: a response means open, an ICMP port-unreachable means closed, silence means open|filtered.
• "Stealth" vs. "closed." GRC-style "stealth" = packets silently dropped (DROP), so the port doesn't even acknowledge existence; "closed" = actively rejected (REJECT/RST), which confirms a live host at the IP. Both are secure; drop reveals slightly less. Don't over-index on the red "FAILED" that some consumer testers show for merely-closed ports.
• Vantage point matters. A web-based scanner tests your public IP (router WAN). Behind NAT, your individual PC isn't directly reachable unless a forward/UPnP mapping exists. To see "what the internet sees," you must scan from outside your network.

Why it matters

Exposed services are attack surface: an open management port (SSH 22, RDP 3389, Telnet 23), a router admin UI reachable from WAN, an IoT device that punched a UPnP hole, or a stale port-forward can all be probed and exploited by automated scanners constantly sweeping the IPv4 space. A self-scan finds these before an adversary does and confirms your firewall posture after changes.

How to scan, per method

External (what the internet sees)

1. Use this site's scanner or GRC ShieldsUP for a quick, no-install check of common ports against your public IP.
2. For a thorough external view, run nmap from a host outside your network (a VPS/cloud shell) against your public IP: nmap -Pn -p- <public-ip>. Scanning your own address is fine; scanning others' without permission may be unlawful.

nmap essentials (install from nmap.org; Npcap on Windows)

1. SYN scan (fast, needs admin/root): sudo nmap -sS -p- <target> for all 65535 TCP ports.
2. Connect scan (no privileges): nmap -sT <target>.
3. UDP (slow; top ports): sudo nmap -sU --top-ports 100 <target>.
4. Service/version + OS: sudo nmap -sV -O -sC <target> (-sC runs default NSE scripts).
5. Skip host discovery when a host drops pings: -Pn.
6. Timing: -T4 for a responsive LAN; slower on flaky links.
7. Read states in output: open, closed, filtered, open|filtered (common for UDP).

Internal (what's listening on your own machines)

1. Scan the LAN: nmap -sn 192.168.1.0/24 to list live hosts, then nmap -sS -sV 192.168.1.0/24 for services.
2. Check what a single host is listening on locally:
   • Windows: netstat -ano | findstr LISTENING (map PID in Task Manager), or PowerShell Get-NetTCPConnection -State Listen.
   • macOS/Linux: sudo lsof -iTCP -sTCP:LISTEN -n -P or ss -tulpen.

Lock it down

1. Router: remove unknown port-forwards; disable WAN remote management; disable UPnP (or restrict it); disable legacy services (Telnet, WAN-side UPnP/SNMP). Set WAN input policy to DROP for stealth if desired.
2. Host firewalls: Windows Defender Firewall on for all profiles (Set-NetFirewallProfile -All -Enabled True); macOS Application Firewall on (System Settings, Network, Firewall) with stealth mode; Linux ufw/nftables default-deny inbound.
3. Patch router firmware and IoT devices; isolate untrusted IoT on a guest/VLAN.

How to verify

Re-scan externally and confirm no unexpected open ports remain (closed/filtered everywhere you didn't intend). Confirm your router admin UI is unreachable from WAN. For intended services, verify only the exact expected port is open and nothing else (nmap -p <port> -sV to confirm the service and version). Internally, re-run the listener check to ensure you killed any process you didn't want bound to a public interface. Note IPv6: NAT doesn't hide v6 hosts, so also audit your IPv6 firewall if your ISP assigns global addresses.

If your result was already good

All-closed/filtered externally with no surprise services is the correct baseline, nothing to change. Maintain it: keep router firmware and device OSes patched, leave WAN remote management and UPnP off unless genuinely needed, and re-audit after adding any device that might open ports (consoles, cameras, NAS). Periodically re-scan from outside, since ISP changes, a new IPv6 prefix, or a misbehaving IoT device can quietly re-open surface.

Want to go further?

Pair external scanning with the DNS and WHOIS/RDAP guides to understand your public footprint end to end. Explore nmap's NSE for safe, authorized checks (e.g., --script vuln against your own hosts), segment IoT onto a separate VLAN/SSID, and consider egress filtering so a compromised device can't freely phone out. Always scope scanning to systems you own or are authorized to test.