Port States: open, closed, filtered

What is it?

Nmap classifies each probed port: open (a service accepted the connection), closed (the host answered but nothing is listening), filtered (no answer — a firewall likely dropped the probe). The state is an inference from how the host replied.

Why it matters

The three states drive different actions. 'filtered' vs 'closed' is the single most misread distinction: one means a firewall stands in front, the other means the port is simply unused.

Where you see it

Per-port rows: '443/tcp open', '3306/tcp closed', '23/tcp filtered' — and a bulk 'filtered' across many ports usually means a firewall.

What normal looks like

A few open ports for the host's role, the rest closed or filtered — a small, purposeful surface.

What suspicious looks like

An open port with no business reason (a remote-admin service reachable from the user VLAN), or many open ports where a hardened host should show few.

How analysts investigate

Read the state, not just the port; treat filtered as 'a firewall is here', closed as 'unused', and open as 'reachable service — is it supposed to be?'.

Common beginner mistakes

Treating filtered as closed — filtered means something is actively blocking, which is itself information.
Alarming at every open port instead of comparing to the host's expected role.

The state is the story

  probe → reply → state
    SYN/ACK   → open      (service accepted)
    RST       → closed    (host answered; nothing listening)
    (silence) → filtered  (firewall dropped it — a wall is here)
  filtered ≠ closed: filtered is a firewall telling you something

open/closed/filtered are inferences from the reply; filtered signals a firewall, not an unused port.

Quick check

Nmap reports 23/tcp filtered on a server. What is the best reading?

A quick self-check — it doesn't affect your XP or progress.