Hosts, Services, Ports & TCP

What is it?

A host is a machine with an IP. A service is a program listening for connections. A port is the numbered door (0–65535) a service listens on. Nmap probes ports to learn which services a host exposes, mostly over TCP's connection handshake.

Why it matters

Confusing these leads to wrong conclusions: 'the host is up' is not 'the service is running', and 'port 80 open' is not 'the web app is safe'. Precise vocabulary is precise analysis.

Where you see it

In scan output: a host line, then per-port rows like '22/tcp open ssh' and '443/tcp open https' — port number, protocol, state, service.

What normal looks like

Well-known services on their expected ports (443 https, 22 ssh internally), a small set of open ports per host.

What suspicious looks like

A service on an unexpected port (ssh on 2222, http on 8081), or far more open ports than a role needs — either a misconfig or a backdoor.

How analysts investigate

Read each row as (port, protocol, state, service), keep host-up separate from service-listening, and question any service on a non-standard port.

Common beginner mistakes

Assuming a live host means a running service — a host can be up with no ports open.
Assuming the service equals the port number — services can run on any port.

Doors, and who answers them

  host 10.20.4.10  (one IP)
   ├─ 22/tcp   open   ssh       ← a service listening on a port
   ├─ 80/tcp   open   http
   ├─ 443/tcp  open   https
   └─ 3306/tcp closed             ← nothing listening here
  TCP handshake: SYN → SYN/ACK (open) | RST (closed) | no reply (filtered)

A host exposes services on numbered ports; the TCP handshake reveals each port's state.

Quick check

A host replies to a ping but Nmap shows 0 open ports. What does that mean?

A quick self-check — it doesn't affect your XP or progress.