What an open port is and how to check one

An open port is a numbered door on a device that is listening for incoming connections, such as a web server on port 443. A port checker tries to connect to a port and tells you whether it is open, closed or filtered. Open ports facing the internet are only safe if you know exactly what is behind them.

What is a port?

A device can run many network services at once. Ports keep them apart. If an IP address is a building's address, a port is the flat number. Ports run from 0 to 65535.

Some numbers are well known by convention:

• 80: web pages without encryption (HTTP).
• 443: web pages with encryption (HTTPS).
• 22: SSH, a secure remote command line.
• 23: Telnet, an old, unencrypted remote command line.
• 53: DNS lookups.
• 3389: Windows Remote Desktop.
• 554: RTSP, often used by network cameras to stream video.

A device only accepts connections on ports where a program is listening.

Open, closed and filtered

When a port checker tries a port, it reports one of three results:

• Open: something answered. A program on the device is listening.
• Closed: the device replied that nothing is listening there.
• Filtered: no reply at all. A firewall is likely blocking or silently dropping the attempt.

From a security point of view, closed and filtered are both fine. Open is fine only if you meant it.

Inside versus outside your network

Where you check from makes a big difference.

From inside your home network, a port checker shows what each device offers to other devices on the same Wi-Fi. A printer might have a web page open, or a computer might share files. These are not reachable from the internet unless your router forwards them.

From outside your network, a port check against your public IP shows what the whole internet can reach. On a typical home connection, the answer should be "nothing", because the router blocks unrequested incoming connections.

If you are unsure which address is which, see what is my IP address, and what can it reveal?

How ports get opened on your router

• Port forwarding: you, or someone, told the router to pass a port through to a device inside, such as a game server or a home camera.
• UPnP: a feature that lets devices ask the router to open ports by themselves. It is convenient for games consoles and some apps, but any device on your network can use it, including a badly made gadget.
• DMZ: a router setting that exposes one device completely. It is rarely a good idea.

How to use a port checker, step by step

1. Decide what you want to know: what a local device offers, or what the internet can see.
2. For a local device, find its local IP address in a device scan.
3. Enter the address and the ports you care about, or a common list.
4. Read the results: open, closed or filtered.
5. For any open port, match it to a service you expect. A printer on 80 or 443 is normal. Telnet on a camera is not.
6. Check your router's port forwarding and UPnP pages for anything you do not recognise.
7. Close what you do not need, then check again.

When should you close a port?

Close or block a port if:

• You do not know what is behind it.
• It runs an old, unencrypted service like Telnet.
• It is a remote access service, such as Remote Desktop, exposed directly to the internet.
• A device opened it through UPnP and you do not use the feature that needed it.

If you need remote access to your home, a VPN into your home network is usually safer than exposing ports one by one. Our home Wi-Fi security steps include reviewing UPnP and port forwarding.

Why port forwarding sometimes fails

Many mobile networks and some home providers use carrier-grade NAT, where many customers share one public address. In that case, port forwarding on your router has no effect, because incoming connections never reach your router. A quick check is to compare the address your router reports as its internet address with the public IP a lookup tool shows. If they differ, you are probably behind carrier-grade NAT. This also matters if you want to use Wake-on-LAN from your phone while away from home.

Is port scanning legal?

Checking your own devices and network is normal and widely done. Scanning networks that you do not own or have permission to test can break rules or laws in some places. Stick to your own equipment.

How CellRadar helps

CellRadar includes a port check tool among its network tools, plus Bonjour, UPnP and NetBIOS discovery for finding what devices on your network announce. The Network Health Report gives a score out of 100 with security findings, which helps you decide what to close first.

Frequently asked questions

Is an open port dangerous?

Not by itself. It is only a risk if the service behind it is weak, outdated or exposed to people who should not reach it.

Should I turn off UPnP on my router?

If you do not use online gaming or apps that need it, turning it off is a sensible precaution. If you do, keep it on and check now and then which ports it has opened.

Why does a port show as filtered?

A firewall is blocking or ignoring the connection attempt, so there is no reply. That is normal and usually a good sign.

Can a port checker on my phone see my router's internet side?

Only if you check your public IP from outside your home network, for example from mobile data. Checking from inside shows the local view.