---
{
  "title": "Port states",
  "summary": "Open, closed, and filtered describe observations, not permanent truth.",
  "topic": "offensive",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    6
  ],
  "aliases": [],
  "sources": [
    {
      "title": "Nmap reference guide",
      "url": "https://nmap.org/book/man.html"
    },
    {
      "title": "Nmap: Port Scanning Basics and States",
      "url": "https://nmap.org/book/man-port-scanning-basics.html"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Nmap distinguishes several port states, including open, closed, filtered, unfiltered, open-or-filtered, and closed-or-filtered. The available distinction depends on the probe and response. Open indicates an accepting application for that protocol; closed indicates reachability without a listening application in the observed response; filtered indicates that filtering or another obstacle prevented a decisive determination. Ambiguous results require careful wording.

## In practice

A UDP probe receives no decisive response, so the tool reports an ambiguous state rather than confidently claiming an open service.

## A common misunderstanding

States are not intrinsic permanent labels. The same port can appear differently from another network or with another method.

## Check your understanding

Why retain the scan method?

**Think it through:** It explains which responses were expected and how the tool inferred the displayed state.

## State names encode uncertainty

A fictional learner compares TCP and UDP observations from a lab server. A decisive response can support one state, while no response may leave several explanations. Labels such as open-or-filtered preserve that uncertainty. Rewriting them as simply open in a report overstates what the probe established.

The state belongs to an observation under a method and path. A firewall change, a stopped service, or a different source network can produce a different result later. Keep the timestamp, protocol, source context, and scan method beside the state so it remains interpretable.

Closed and filtered are operationally different. A closed observation can indicate that the target responded without an accepting application for that probe. A filtered observation means the tool could not make the same determination through the path. Neither label independently explains the complete security posture of the host.

## Build an interpretation table

For a classroom exercise, create synthetic output with open, closed, filtered, and an ambiguous state. For each row, write what is observed, what can reasonably be inferred, and what remains unknown. Add the intended service configuration as a separate evidence source rather than silently replacing the scan result with it.

Then compare two vantage points for the same fictional port. Explain how both observations can fit one network design. This practice helps analysts report uncertainty accurately and choose a suitable authorized follow-up. The objective is not to memorize labels in isolation, but to understand that a scanner translates probe responses into bounded claims about reachability and service behavior. Retain the original output so reviewers can compare your interpretation with the tool's exact wording.

## Keep exploring

- [[port-scanning]]
- [[nmap]]
- [[firewalls]]