Port states: what do open, closed and filtered tell you?

States describe what the probe can observe

In Nmap terminology, open indicates an application accepting the relevant connections or data. Closed indicates reachability without a corresponding listener. Filtered means packet filtering prevents a determination of whether the port is open. Read the state together with the probe protocol.

A combined state such as open|filtered preserves uncertainty; do not silently discard “filtered.” A tool’s state is not an immutable host property. Vantage point, time, filtering and method can affect the result.

Further reading: Nmap: Port Scanning Basics

Separate four steps in the evidence chain

Separate network reachability, port state, service identification and verification of a particular resource, configuration or weakness. Each step requires its own response evidence. A later conclusion does not arise automatically from an earlier label.

For example, 443/tcp open supports the presence of a listener in that observation. It has not verified website identity, TLS configuration or application authorization. Record port, protocol, time, vantage and method before comparing runs.

Example: different internal and external views

At 10:00, a synthetic host is observed as 445/tcp open from one test network and filtered from an external test network.

The results are compatible with path-based access controls, but rules and packet evidence are needed to confirm the cause. They do not by themselves indicate a broken tool or prove that the external view has no service.

Conclusion: Keep both vantage points and check the authorized control configuration.