An adversary uses a combination of techniques to determine the state of the ports on a remote target. Any service or application available for TCP or UDP networking will have a port open for communications over the network.

Although common services have assigned port numbers, services and applications can run on arbitrary ports. Additionally, port scanning is complicated by the potential for any machine to have up to 65535 possible UDP or TCP services. The goal of port scanning is often broader than identifying open ports, but also give the adversary information concerning the firewall configuration.
Depending upon the method of scanning that is used, the process can be stealthy or more obtrusive, the latter being more easily detectable due to the volume of packets involved, anomalous packet traits, or system logging. Typical port scanning activity involves sending probes to a range of ports and observing the responses. There are four port statuses that this type of attack aims to identify: open, closed, filtered, and unfiltered. For strategic purposes it is useful for an adversary to distinguish between an open port that is protected by a filter vs. a closed port that is not protected by a filter. Making these fine grained distinctions is requires certain scan types. Collecting this type of information tells the adversary which ports can be attacked directly, which must be attacked with filter evasion techniques like fragmentation, source port scans, and which ports are unprotected (i.e. not firewalled) but aren't hosting a network service. An adversary often combines various techniques in order to gain a more complete picture of the firewall filtering mechanisms in place for a host.

Low

The adversary requires logical access to the target's network in order to carry out this type of attack.

The adversary requires a network mapping/scanning tool, or must conduct socket programming on the command line. Packet injection tools are also useful for this purpose. Depending upon the method used it may be necessary to sniff the network in order to see the response.

Confidentiality
Other

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

1046
Network Service Scanning

There are four types of port status that this type of attack aims to identify: 1) Open Port: The port is open and a firewall does not block access to the port, 2) Closed Port: The port is closed (i.e. no service resides there) and a firewall does not block access to the port, 3) Filtered Port: A firewall or ACL rule is blocking access to the port in some manner, although the presence of a listening service on the port cannot be verified, and 4) Unfiltered Port: A firewall or ACL rule is not blocking access to the port, although the presence of a listening service on the port cannot be verified.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Prerequisites, Description, Description Summary, References, Related_Weaknesses, Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns, Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Description, Notes

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description