Table of Contents
Port Scanning Basics (6 port states)
Unlike primitive tools that only report if a port is "open or closed," Ghosstless Security classifies each port in one of 6 precise states to understand security topology.
| State | Network Behavior | Security implications |
|---|---|---|
| open | An application actively accepts TCP connections or UDP packets. | Primary target for vulnerability and service audit. |
| filtered | A firewall or package filter blocks the probes and prevents their arrival at the port. | indicates the presence of perimeter defence or strict iptable / WAF rules. |
| closed | The port responds to the probe (e.g. with an RST package) but no service hears it. | Confirms that the host is activated and accessible through the network. |
| unfiltered | The port is accessible (response to ACK probes) but it isn't known if it's open or closed. | Used mainly to map sets of rules at firewalls. |
| open|filtered | Can't be discerned if the port's open or if a filter's downloading the packages. | Common at UDP, IP protocol, Null, FIN and Xmas scans. |
| closed|filtered | Unsure if port's closed or leaked. | It appears exclusively as an IP ID Idle Scan (-sI) lateral channel scans. |