Guide

Open ports that matter

Not every open port is an incident. These are the ones that dominate real external misconfigurations.

Port	Typical service	Why it shows up in tickets
22	SSH	Expected on admin jump hosts; unexpected on app servers or printers.
23	Telnet	Almost never acceptable on the public internet.
80 / 443	HTTP / HTTPS	Expected for web; still check for leftover staging vhosts.
445	SMB	Should not be public. Worm bait.
3389	RDP	Common accidental exposure after a “temporary” firewall hole.
3306 / 5432 / 1433	MySQL / Postgres / MSSQL	Databases belong behind app tiers, not on 0.0.0.0/0.
6379 / 27017 / 9200	Redis / Mongo / Elasticsearch	Often deployed with weak bind defaults.
8080 / 8443 / 9000	Alt HTTP / admin	Forgotten control planes and Java consoles.

PortSweep’s top-1,000 default is chosen because this list — and the rest of nmap’s common-port table — is where these services live. A listener on an obscure high port can still exist; it is just not the usual way a /24 gets burned.

Pair this with how to read a report.