Find Every Open Port on Your Network

If you can't list every open port on your network right now from memory, you have blind spots. And blind spots are exactly what attackers exploit — on the internet and on your LAN. Common things people find when they scan their own network for the first time: - Database ports (3306, 5432, 27017) exposed to the entire LAN instead of bound to localhost - Old services they forgot to shut down (test web servers, FTP, Telnet) - IoT devices with open management ports they didn't know about - Docker containers exposing ports to 0.0.0.0 instead of 127.0.0.1 - UPnP opening ports on the router without their knowledge A network scan is the only way to know for sure what's actually listening. Do this regularly — at minimum after any infrastructure change.

nmap (Network Mapper) is the industry standard for network scanning. It's in every distro's default repos:

sudo apt update && sudo apt install nmap -y

Confirm nmap is installed and check the version:

nmap --version | head -2

You should see something like: Nmap version 7.93 ( https://nmap.org ) Platform: x86_64-pc-linux-gnu Any version 7.x or later is fine.

Before scanning, confirm your LAN subnet. This tells nmap which IP range to scan:

ip route | grep -E 'default|192.168|10\.' | head -3

You'll see something like: default via 192.168.1.1 dev eth0 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.50 The /24 network (e.g., 192.168.1.0/24) is your subnet. That's 256 IP addresses (192.168.1.0 through 192.168.1.255). Use this in the scan commands below. If you see 10.x.x.x or 172.16-31.x.x, your network uses a different private range — adjust the commands accordingly.

Start with a ping sweep to find which hosts are alive on your network. This is fast (under 10 seconds for a /24) and gives you a map of active IPs: Replace 192.168.1.0/24 with YOUR subnet from Step 2:

sudo nmap -sn 192.168.1.0/24

You'll get a list of every device that responded, like: Nmap scan report for 192.168.1.1 Host is up (0.0010s latency). MAC Address: AA:BB:CC:DD:EE:FF (Ubiquiti) Nmap scan report for 192.168.1.10 Host is up (0.0020s latency). MAC Address: 11:22:33:44:55:66 (ASUSTek) Count the hosts. Does the number match what you expect? If you see IPs you don't recognize, that's either a device you forgot about or something that shouldn't be there. Note them for deeper scanning. If you see very few results, some devices might not respond to pings. Add -Pn to skip host discovery and scan anyway (slower but catches everything).

Now scan the top 1000 most common ports on every live host. This uses a SYN scan (-sS), which is fast and reliable. sudo is required for SYN scans because they use raw sockets. This typically takes 30-90 seconds for a /24 network:

sudo nmap -sS 192.168.1.0/24

For each host, you'll see a port table: Nmap scan report for 192.168.1.20 PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https 8989/tcp open sunwebadmins The columns mean: - PORT: the port number and protocol (tcp/udp) - STATE: open (accepting connections), closed (reachable but nothing listening), filtered (firewall blocking the probe) - SERVICE: nmap's best guess based on the port number. Note: this is just a guess from a built-in table — 8989 isn't actually "sunwebadmins", it's probably Sonarr. Use -sV for accurate detection. Ports marked "open" are accepting connections from your machine. Every open port is a potential attack surface.

The basic scan only tells you which ports are open. Add -sV to probe each open port and identify the actual software and version running behind it. This is slower but much more informative. Scan a specific host (replace with an IP from your results):

sudo nmap -sS -sV 192.168.1.x

With -sV, the output shows actual software: PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 80/tcp open http nginx 1.24.0 443/tcp open ssl/http nginx 1.24.0 8989/tcp open http Mono httpd Now you can see exact versions. This is useful for checking if anything is running outdated, vulnerable software. Search CVE databases for any version numbers that look old.

The default scan only checks the top 1000 ports. Services hiding on non-standard high ports won't be found. Run a full scan on hosts you want to thoroughly audit. WARNING: This is slow — 2-10 minutes per host. Run it on specific hosts, not the whole subnet:

sudo nmap -sS -p- 192.168.1.x

Save your scan results so you can compare later and spot new or unexpected ports. The -oN flag saves human-readable output, -oX saves XML (useful for tools like Ndiff):

sudo nmap -sS -sV 192.168.1.0/24 -oN ~/nmap-baseline-$(date +%Y%m%d).txt

Verify the baseline was saved:

head -20 ~/nmap-baseline-*.txt

Go through every open port on every host and ask: "Should this be open?" Red flags that need immediate attention: 1. Database ports open to the LAN (3306/MySQL, 5432/PostgreSQL, 6379/Redis, 27017/MongoDB) Fix: Bind to 127.0.0.1 in the service config, or restrict with firewall rules. 2. Management interfaces on default ports (Proxmox 8006, router admin, iDRAC/IPMI) Fix: Put them behind a reverse proxy with auth, or restrict to specific IPs. 3. FTP (21), Telnet (23), or unencrypted HTTP on sensitive services Fix: Disable FTP/Telnet entirely. Move HTTP services behind HTTPS. 4. Ports you don't recognize Fix: SSH into that host and run: sudo ss -tulnp | grep :PORT_NUMBER This shows which process is listening on that port. 5. Docker containers binding to 0.0.0.0 Fix: Change port mappings from "8080:80" to "127.0.0.1:8080:80" in docker-compose.yml to restrict to localhost only. 6. UPnP-opened ports on your router Fix: Disable UPnP on your router. Check with: sudo nmap -sU -p 1900 192.168.1.1

Set up a weekly scan and diff it against your baseline to catch new ports: Create a scan script at /opt/nmap-weekly.sh: #!/bin/bash TODAY=$(date +%Y%m%d) SCAN_DIR="/opt/nmap-scans" mkdir -p "$SCAN_DIR" nmap -sS -sV 192.168.1.0/24 -oX "$SCAN_DIR/scan-$TODAY.xml" -oN "$SCAN_DIR/scan-$TODAY.txt" # Compare with previous scan PREV=$(ls -t "$SCAN_DIR"/scan-*.xml | sed -n '2p') if [ -n "$PREV" ]; then ndiff "$PREV" "$SCAN_DIR/scan-$TODAY.xml" > "$SCAN_DIR/diff-$TODAY.txt" fi Schedule it weekly: sudo chmod +x /opt/nmap-weekly.sh (crontab -l 2>/dev/null; echo '0 2 * * 0 /opt/nmap-weekly.sh') | sudo crontab - Note: ndiff comes with nmap. If it's not available: sudo apt install ndiff

You should only scan networks you own or have explicit permission to scan. Scanning your own homelab is fine. Scanning your employer's network, your neighbor's WiFi, or random internet IPs is illegal in most jurisdictions. This guide is for auditing YOUR infrastructure.