External port scanning, explained

What a port scan actually measures

For each port it probes, nmap records a state. Open means something accepted the connection. Closed means the host answered but nothing is bound. Filtered usually means a firewall swallowed the probe. PortSweep reports only open ports so the document stays readable.

Host discovery is skipped

By default nmap pings first and skips hosts that do not answer. Most business networks drop ICMP at the edge, which would produce an empty report — a worse failure than a slightly longer scan. -Pn treats every address as up and continues to port probes.

Top 1,000 ports, not the entire map

A full -p- scan of 65,535 ports on a /24 is thorough and slow. Forgotten RDP, MySQL, Redis, Elasticsearch, and admin UIs almost always sit in nmap’s top-1,000 set. That is the default because the product question is “is anything unexpected exposed,” not “enumerate every ephemeral port.” Coverage can be widened later per account; it is configuration, not a silent change in technique.

Service and version detection

-sV is what makes a bi-annual report useful. Without it you get numbers. With it you get “OpenSSH 9.6” versus “OpenSSH 8.2” six months later, which is the difference between a checklist and a change record.

Timing: T3 on purpose

Faster templates (-T4, -T5) burst probes tightly enough that a customer’s own SOC may ticket the traffic as an attack. PortSweep is scanning their network, at their request. Normal timing is the default so the vendor is not the incident.

Target limits

Input	Rule
IPv4 list	Comma, semicolon, or newline separated public addresses. Maximum 20. Larger lists require a support request.
CIDR	Prefix 20–32, publicly routable only. Example: 203.0.113.0/24. A /19 is rejected.
Combined size	At most 4,096 addresses (one /20).
Hostnames	Not accepted in the website form. IPv4 only.

Read more in CIDR and scan size and authorization.