How to Check Open Ports: 5 Free Tools & Commands (Windows, Mac, Linux)

1. The Anatomy of Network Ports: Transport Layer Endpoints

In the OSI model and TCP/IP protocol suite, IP addresses deliver packets to a specific host machine, but they do not identify which process or daemon should receive that payload. Network ports provide a 16-bit unsigned integer abstraction (ranging from 0 to 65535) that multiplexes multiple network services on a single IP interface.

The Internet Assigned Numbers Authority (IANA) categorizes port numbers into three distinct operational ranges:

1. Well-Known Ports (0 – 1023): Reserved for privileged operating system services and core protocols such as SSH (22), HTTP (80), HTTPS (443), and DNS (53).

2. Registered Ports (1024 – 49151): Assigned by IANA to specific vendor applications, databases, and microservices (e.g., MySQL 3306, PostgreSQL 5432, Redis 6379).

3. Dynamic / Ephemeral Ports (49152 – 65535): Allocated temporarily by the client operating system kernel to handle outbound socket connections.

2. How TCP Port Probing Works: Three Handshake States

Transmission Control Protocol (TCP) is connection-oriented and requires a synchronized handshake before data transmission. When an online port scanner or local utility audits a port, it observes three possible response behaviors:

1. OPEN (SYN-ACK Received): The diagnostic client sends a TCP SYN packet. If a software daemon is actively listening on that socket, the server kernel responds with a SYN-ACK packet. The port is operational and accepting inbound sessions.

2. CLOSED (RST Received): If no application process is bound to that port number, the destination server's operating system kernel immediately generates a TCP packet with the RST (Reset) and ACK flags asserted. This proves the host is online and reachable, but the specific port is inactive.

3. FILTERED / TIMEOUT (Packet Dropped): If an intermediary network firewall (such as AWS Security Group, Cloudflare, or Linux iptables) intercepts the SYN packet and silently drops it, the client receives no reply whatsoever. The client waits until its connection timeout threshold expires, classifying the port as Filtered.

[Client Scanner] -------- SYN (Port 443) --------> [Web Server] (Nginx Listening)
[Client Scanner] <------ SYN-ACK (Seq=0, Ack=1) --- [Web Server] (Port is OPEN)

[Client Scanner] -------- SYN (Port 25) ----------> [Target Host] (No SMTP Server)
[Client Scanner] <------ RST-ACK (Connection Reset) [Target Host] (Port is CLOSED)

[Client Scanner] -------- SYN (Port 22) ----------> [Cloud Firewall] (Drop Rule)
[Client Scanner] ........ (Timeout: No Packet) ..... (Port is FILTERED)

3. Directory of Critical Well-Known Ports & Security Risks

Understanding default service ports is essential for security auditing and cloud architecture. Below is a structured reference table of commonly audited network ports:

4. Practical CLI Port Testing Commands (Linux, macOS, Windows)

Network administrators frequently test port availability using built-in terminal utilities without installing heavy scanning software:

# Test TCP port connectivity with Netcat (nc)
nc -zvw 3 93.184.216.34 443

# Check if a specific port is listening on the local Linux server
ss -tulpn | grep :443

# Identify which process is holding a port open (macOS / Linux)
lsof -i :8080

# PowerShell (Windows): Test remote TCP connectivity without Telnet
Test-NetConnection -ComputerName example.com -Port 443

# Quick test using cURL with connection timeout
curl -v --connect-timeout 5 https://example.com:443

5. Troubleshooting Inaccessible Ports on Cloud Servers

If a port reports as CLOSED or FILTERED when you expect it to be OPEN, audit the following three common points of failure:

1. Service Binding Address: Ensure your backend daemon (Node.js, Docker, Nginx, Go) is bound to '0.0.0.0' (all network interfaces), not '127.0.0.1' (localhost only). If bound to localhost, external clients cannot connect.

2. Host Firewall (UFW / iptables): On Ubuntu/Debian, verify local firewall rules by running 'sudo ufw status'. If UFW is active, run 'sudo ufw allow 443/tcp' to open the port.

3. Cloud Provider Security Groups: In AWS EC2, DigitalOcean, or Azure, verify that inbound security group rules explicitly allow ingress traffic from '0.0.0.0/0' to the desired destination port.