Topic: What is a port scan?

[Amker]

 In order to understand what a port scan is, we first need to explain what a port is. Ports are connection portals to a computer. Each TCP/IP communication needs to originate from a port on one computer and go to a port on another computer to establish a connection. There are over 65,000 ports available to a TCP/IP stack on a computer. Certain services use a standard port to establish a connection, and other programs may pick up the first port your operating system assigns to them.

For example, if you run a web server on your computer, the www service uses port 80 and listens on it for connection, and in turn, when people enter your web address in their browsers, their browsers go to your address and try to establish a connection to port 80 of your computer to grab the information you provide.

But here's the important part: If you are not running a service such as www on your port 80, your computer sends a message to their browser, informing them that your port 80 is closed, at which point the browser will not be able to connect and gives up.

A port scan is very similar to what your browser does. It's an attempt to reach a certain port in order to determine whether the port accepts a connection. The ports may differ, but the process is the same. Port scanners simply determine if the port is listening for connection. In order for hackers to actually establish a connection and run commands on your computer, they need additional tools. What's important to know is that unless you are running a service on a port and your computer is listening for a connection to that port, it would be virtually impossible to connect to that port, and the response to the port scan will always be a closed response. This means a single scan of a port or ports by itself can do no harm to you whatsoever even if you don't have a firewall.

However, there are certain ports on your computer that will be listening for connection by default. It is possible for you to close some of them, such as port 139, which is used by file and print sharing, without a firewall, but some can't be closed, such as port 135 (the Endpoint Mapper), unless you have a firewall.

You can find a comprehensive explanation of ports that are assigned to certain services here and on a lot of other sites on the Internet.

http://advice.networkice.com/Advice/Exploits/Ports/default.htm