How to read a port scan report

1. Confirm the target and window

Match the network string and the start/finish timestamps to the schedule you configured. If the window is short and host count is zero, the range may be dark from the internet, or the scanner may still be in flight.

2. Totals before details

Hosts scanned versus open-port count tells you whether you are looking at a quiet /24 or a noisy one. Sudden jumps versus the last report are the highest-signal diffs.

3. Open means reachable from us

The scan node is outside your LAN. Open is “the internet could complete a handshake to this port,” not “this is bound on a private NIC.” That is the point of an external exposure report.

4. Service and version

Prefer product + version over port number alone. “443/nginx 1.24” is actionable for patching. “443/tcp open” is only a reminder that HTTPS exists.

5. Ticket the surprises

RDP (3389), SMB (445), databases (3306, 5432, 1433, 27017, 6379), Elasticsearch (9200), unauthenticated HTTP admin UIs, and Telnet (23) on public addresses are the usual incidents. Expected HTTPS and SSH on known boxes can wait.

Continue with open ports that matter.