In the world of Linux server administration and cybersecurity, open ports are the equivalent of unlocked doors on a house. If a web server is running on Port 80, that door must remain open so visitors can view the website. However, if a developer accidentally leaves a database port (like 3306) open to the public internet, hackers will find it and exploit it.
To secure a server, you must know exactly which doors are open. The absolute best tool for this job is Nmap (Network Mapper). It is an open-source security scanner that sends specially crafted packets to a target IP address and analyzes the responses to map the entire network.
Step 1: Install Nmap
Nmap is a third-party security tool, meaning it is not usually installed by default on standard Linux distributions (like Ubuntu or CentOS).
- On Debian/Ubuntu-based systems: Type
sudo apt install nmap - On RHEL/CentOS/Fedora systems: Type
sudo dnf install nmap(oryumon older systems).
Warning: Only use Nmap to scan servers or networks that you personally own, or have explicit, written permission to scan. Scanning third-party infrastructure without authorization can trigger automated security alarms and may be illegal in your jurisdiction.
Method 1: The Basic Port Scan (The Quick Check)
If you just set up a new web server and want to do a rapid health check to see what ports are exposed, you can run a default scan. This will check the 1,000 most common ports (like HTTP, SSH, and FTP).
- Open your terminal.
- Type
nmapfollowed by the target IP address or domain name:
nmap 192.168.1.50
- Press Enter.
Nmap will take a few seconds and then spit out a table. You are looking for ports marked as “open.” If you see a port marked as “filtered,” it means a firewall (like ufw or iptables) intercepted Nmap’s probe, which is exactly what a firewall is supposed to do.
Method 2: Scan Every Single Port (The Exhaustive Scan)
A standard server actually has 65,535 possible ports. A clever hacker might hide a malicious backdoor on a high, obscure port (like Port 4444) precisely because the default Nmap scan only checks the top 1,000. To do a true security audit, you must scan them all.
To do this, use the -p- (port all) flag.
nmap -p- 192.168.1.50
Because this forces Nmap to send 65,000 individual probes, this scan will take significantly longer. If you want to watch it work in real-time, press the Spacebar while the scan is running to see a percentage completion status.
Method 3: Identify Operating Systems and Software Versions
Finding an open port is only half the battle. If Nmap tells you Port 22 (SSH) is open, you need to know what version of SSH is running. If it is an ancient, unpatched version, the server is highly vulnerable.
You can use the “Aggressive” flag (-A). This combines OS detection, version detection, script scanning, and traceroute into a single, massive probe.
- You must use
sudofor this scan because it requires raw socket access to analyze the packets deeply. Type:
sudo nmap -A 192.168.1.50- Press Enter.
The resulting report will be massive. Instead of just saying “Port 80 is open,” Nmap will interrogate the port and tell you exactly what is running behind it (e.g., “Apache httpd 2.4.41 (Ubuntu)”). This allows you to cross-reference the software version against known vulnerability databases.
Method 4: The Stealth Scan (SYN Scan)
When you attempt to connect to a port (a TCP connection), your computer performs a “Three-Way Handshake” (SYN, SYN-ACK, ACK). If you complete this handshake, the target server will log your IP address in its access logs.
If you are a penetration tester performing a red-team exercise, you want to probe the ports quietly without generating massive log files. You can use the Stealth SYN scan (-sS).
sudo nmap -sS 192.168.1.50Instead of completing the handshake, Nmap sends the first packet (SYN), waits for the server to reply (SYN-ACK) which proves the door is open, and then immediately drops the connection before the final step. Because the connection was never technically completed, many older server logging systems will not record the interaction.