Port Scanner
Check which TCP ports on a public host accept connections, and read what each open port means on that host and what to do about it.
Related tools
- Ping & TraceroutePing a public host for loss and latency, or trace the route to it hop by hop.
- IP IntelligenceLook up an IP address's network, ASN, reverse DNS, registry allocation and abuse contact, or show your own.
- TLS CheckerInspect a site's TLS certificate, expiry, issuer and negotiated protocol, with a renewal calendar you can download and a full report.
- Blacklist CheckerCheck whether an IP address or a domain's mail server is listed on DNS blocklists.
About this tool
Port Scanner opens a real TCP connection from the XGM server to each port you list - up to 200 per check, with a 1.5 second timeout per port - and classifies each one as open (the handshake completed), closed (the host actively refused it) or filtered (no answer at all). On the first 40 open ports it then reads what the service announces: the greeting SSH, SMTP, FTP, POP3, IMAP and MySQL send on their own, or the status line and Server header returned to a single HEAD / request on HTTP and HTTPS ports. Each open port then gets an explanation rather than a line in a table: whether it is expected on a host like this one (80 and 443 on a web server read as normal and are left alone), what the exposure means in one sentence, and what to do about it - bind it to 127.0.0.1, put it behind a VPN or an allowlist, or nothing at all. Databases (3306, 5432, 6379, 9200, 11211, 27017), management ports (22, 3389, 5900, 623), container and cluster APIs (2375, 6443, 10250) and admin interfaces are each named for what they are, a name guessed from the port number is written as a guess, and a version is repeated only when the banner actually carried one. It does not log in, send credentials, fuzz, exploit or test for vulnerabilities - a version in a banner is a prompt to check the vendor's advisories, never a claim that the version is affected by anything - and it only speaks TCP, so UDP services such as DNS, NTP and SNMP are invisible to it.
XGM opens a TCP connection to each port you list from its server (1.5 s timeout, up to 200 ports). On open ports it reads the greeting that SSH, SMTP, FTP, POP3, IMAP and MySQL servers send on their own, and sends a single HEAD / request to HTTP and HTTPS ports to read the status line and Server header. It does not log in, send other data or probe for vulnerabilities. The service name comes from that banner, otherwise it is a guess from the port number, and a guess is written as one. Each open port is then explained rather than only listed: whether it is expected on a host like this one, what the exposure means and what to do about it - which is decided from the port, the banner and the reverse DNS below, and from nothing else. A version is repeated only when the banner carried one; the scan does not test whether that version has known issues. The header names the scanned address: its PTR record comes from public DNS and its ASN and network owner from ipwho.is, which therefore sees the address you scanned.
How to use it
- Open the Port Scanner tool.
- Enter the public domain, hostname or IP address you want to check.
- Run the check; XGM queries it from its server and lists the findings.
- Copy the output only after checking it looks correct.
- Use related XGM tools if you need a broader diagnostic view.
FAQ
What is the difference between closed and filtered?
Closed means the host answered the connection attempt with a refusal (a TCP RST), so the address is reachable and nothing is listening on that port. Filtered means no answer arrived within 1.5 seconds, which normally means a firewall silently drops the packets rather than rejecting them. A busy or distant host can also time out, so re-run a single suspicious port before concluding that it is firewalled.
Will this scan appear in the target's logs?
Yes. These are full TCP connections, not stealth SYN probes, so each open port sees a completed handshake from the XGM server's address, and HTTP and HTTPS ports additionally log one HEAD / request with the User-Agent XGM-PortScanner. Intrusion detection systems and fail2ban-style tools may treat that as a scan. Only check hosts you are responsible for, and expect to see the XGM server in your own logs afterwards.
Why does a service say “guess from the port number”?
When a port sends nothing recognisable, the name comes from a lookup table built from nmap's 100 most frequently open TCP ports plus common databases and admin APIs - so 3306 is labelled MySQL because that is what usually listens there, not because anything proved it. A label without that note was read from the banner the service actually returned. Ports outside the table are shown as “unknown service”.
Port 22 is open and the result says that is fine. Is SSH not a risk?
SSH on a public server is ordinary: it is how the server is administered, so the finding names the exposure instead of raising an alarm. What it does say is that the port sees automated login attempts continuously, so it should use key authentication with password and root login turned off, and be restricted to a VPN or an address allowlist where that is practical. The ports that are worth a warning are the ones a visitor never needs: databases, remote desktop, management controllers, container APIs and admin interfaces.
A port is open here but closed from my own machine. Which is right?
Both. The check runs from the XGM server, so it sees your host through whatever firewall rules, geo-blocks and allowlists apply to that address, while your machine may be on a permitted network or, from inside, be reaching a service bound only to a private interface. The result answers one question: what accepts connections from an arbitrary address on the internet.
How many ports can I check at once, and why did some open ports have no banner?
A single check takes at most 200 ports; lists longer than 20 count against a stricter rate limit, so presets such as Top 100 can be run less often than a handful of ports. Banners are read for the first 40 open ports only, to keep the check short - if more were open, the result says so and you can scan the remainder in a second run.
Read the full Port Scanner guide