However, scanning up to port 65536 is not uncommon. Port scanning works because when a service is running, a port responds differently than when it is inactive. Otherwise, legitimate connections would have trouble working. For example, if you tried to telnet to a server, you'd expect a denial if the server didn't support telnet and a login prompt if it did. Though most port-scanning techniques operate at a lower level than a telnet request, the concept is the same.
Port scanning takes advantage of the necessary elements of communications protocols.
If you only wanted to create a list of active IP addresses, a ping sweep might do the job. On the other hand, you stand a much better chance of getting through a firewall if you send an ACK ping to port 80, which provides access to Web servers. We're using port 80 to get through the firewall and sending the ACK ping merely to find hosts. That is why it is called an ACK ping. If port 80 is blocked on all but Web servers, though, the results will be limited.