The Exploit HQ

Nmap for Beginners · lesson 3 · 2026-08-16 · updated 2026-10-12

Nmap for Absolute Beginners: Open, Closed & Filtered Ports

Before you start

Welcome back to The Exploit HQ. This is part three of our beginner Nmap series, and just like before, you need zero experience to follow along.

In part one, we found the open doors on a computer. In part two, we learned what software was running behind them.

Today we answer a simple but important question. When Nmap looks at a door, what are the different things it can tell us about it?

Because a door is not just open or invisible. Nmap sorts every door into one of a few clear states, and understanding those states is a big step forward.

Let’s bring back one word from part one. A port is just a numbered door on a computer, where programs send and receive information.

When Nmap scans, it checks each of these doors and then reports back a state for each one. Think of the state as that door’s status.

There are three states you will meet most often. Open, closed, and filtered. We will look at each one in plain language.

As always, we begin at the very start. Open the terminal window.

Remember, the terminal is simply a place where you type commands instead of clicking buttons.

When you see the prompt, the short line that ends in a dollar sign, the computer is ready for you to type.

Let’s run a scan that shows us two of these states side by side. We will check four specific doors on our practice computer.

Type: nmap, space, dash p, space, 22 comma 23 comma 80 comma 443, space, and then scanme dot nmap dot org.

Quick reminder. Dash p means ports. The numbers are the four doors we want to check. And scanme dot nmap dot org is the practice server the makers of Nmap let us scan. Press Enter.

nmap -p 22,23,80,443 scanme.nmap.org

Here is our result. Notice the middle column. It is called STATE, and it tells us the status of each door.

Look at door 22. Its state is open. Open is the one we care about most. It means a program is actively listening there, ready to accept a connection. Picture a door that is open, with someone inside ready to answer.

Door 80 is also open. Same idea. A web program is listening and ready to respond.

Now look at door 23, and door 443. Their state is different. It says closed.

Closed does not mean the computer is missing. It means the computer answered us, but no program is listening on that particular door. Picture a door that is shut. The house is clearly there, someone is home, but that specific door has nobody behind it.

So already you can see the difference. Open means something is there and listening. Closed means the computer replied, but that door has nothing running behind it.

You might wonder what happens when we do not pick specific doors. Let’s run a normal scan and see.

Type: nmap, space, scanme dot nmap dot org, and press Enter. This checks the most common doors automatically. Give it a few seconds.

nmap scanme.nmap.org

Notice the tidy summary near the top. It says Not shown, then a number, then the words closed tcp ports.

Nmap checked hundreds of doors, found that almost all of them were closed, and instead of listing every single one, it politely summarized them in that one line.

Then, below, it lists only the interesting doors, the ones that are open. This is Nmap keeping your results clean and easy to read.

That leaves the third state, and it is the most important one for the real world. It is called filtered.

Filtered appears when something is deliberately blocking the way. Usually, that something is a firewall.

A firewall is like a security guard for a computer. It can silently stop your knock from ever reaching the door.

When that happens, Nmap sends its question, but gets no answer at all. Not a yes, not a no. Just silence.

Because Nmap cannot tell whether the door is open or closed, it uses the honest label, filtered. It means: I was blocked, so I could not find out.

Picture a locked outer gate in front of the house. You cannot even walk up to knock on the door. That is filtered.

One honest note. Our practice server, scanme, is friendly and has no firewall blocking these doors, so today we mainly see open and closed.

On a real, protected computer, you would see the word filtered in that STATE column, and now you know exactly what it means. A firewall is standing in the way.

This idea of firewalls leads us perfectly into one very useful flag. It is written dash, capital P, then a lowercase n.

To understand it, you need to know one thing Nmap does before it scans.

By default, Nmap first sends a quick, are you there, message to the computer. A little knock to check it is switched on, before spending time scanning its doors.

Usually that is helpful. But sometimes a firewall blocks even that first knock.

When that happens, Nmap can wrongly decide the computer is offline, and it will skip the scan entirely, even though the computer is really there.

That is where dash, capital P, n comes in. It tells Nmap: skip the are you there check, and just go ahead and scan anyway.

Let’s try it on our practice server. Type: nmap, space, dash capital P n, space, dash p, space, 22 comma 80, space, scanme dot nmap dot org. Press Enter.

nmap -Pn -p 22,80 scanme.nmap.org

The result looks familiar. Doors 22 and 80 are open, just as before.

On our friendly server, the outcome is the same, because nothing was blocking that first knock anyway.

But remember the real value. On a computer whose firewall ignores that first knock, dash capital P n is what lets you scan it at all, instead of being wrongly told it is offline.

Before we recap, the golden rule from every episode still stands, and it always will.

Only scan computers you own, or that you have clear, explicit permission to test. We use scanme dot nmap dot org because the makers of Nmap set it up for everyone to practice on safely.

Let’s go over what you learned today.

You learned that Nmap gives every door a state, and the three you will meet most are open, closed, and filtered.

Open means a program is listening. Closed means the computer answered, but nothing is on that door. And filtered means a firewall blocked the way, so Nmap could not tell.

You also learned the dash capital P n flag, which skips Nmap’s first, are you there, check, so you can still scan a computer that a firewall makes look offline.

Take your time with this one, and replay any part you like. There is no rush, and these ideas get easier every time you see them.

In the next tutorial, we will scan more than one computer at once. How to check a whole range of addresses, including your own home network, safely.

Thanks for learning with The Exploit HQ. Practice on scanme dot nmap dot org, and I will see you in part four.