The title probably says it all. I just want to know the best techniques to avoid having a port scanner detecting open ports on my server. I'm using a Linux distro as my OS (Ubuntu Server).

Please, don't consider the use of external devices (like external firewalls), I wish I could only use what the distro or external packages offer.


5 Answers 5



Portknocking is a method to open ports that the firewall normally keeps closed by executing a series of connection attempts (knocks) to other ports. Upon the valid sequence of port knocks, the required port will open.

Think of portknocking as a special knock on a door for the door to open.

Here is an example from ArchLinux wiki:

$ ssh username@host
(Ctrl+c to exit) ^C 
$ nmap -Pn --host_timeout 201 --max-retries 0 -p 1111 host
$ nmap -Pn --host_timeout 201 --max-retries 0 -p 2222 host
$ ssh user@host
user@host's password:

The user knocks port 1111 followed by 2222 to open up port 22 for SSH.


Portspoof is a program which makes interpreting port scan results very difficult, therefore slowing down being able to identify open ports.

The Portspoof program primary goal is to enhance OS security through a set of new techniques:

  • All TCP ports are always open

Instead of informing an attacker that a particular port is CLOSED or FILTERED state Portspoof will return SYN+ACK for every port connection attempt.

  • As a result it is impractical to use stealth (SYN, ACK, etc.) port scanning against your system, since all ports are always reported as OPEN.

  • Every open TCP port emulates a services

Portspoof has a huge database of dynamic service signatures, that will be used to fool scanners to believe there's a legitimate service running. Scanning software usually tries to determine a service version that is running on an open port. Portspoof will respond to every service probe with a valid service signature, that is dynamically generated based on a service signature regular expression database. As a result an attacker will not be able to determine which port numbers your system is truly using.

Quoted from https://github.com/drk1wi/portspoof

Portspoof makes identifying listening services much more difficult and as the README states, it would take over 8 hours to identify which ports are actually listening. Identifying the real ports is so time consuming that the attackers will likely give up.

This guide shows how you can install Portspoof:

  1. Compile the software, go in the directory where you have unzipped/put the sources and give these commands:

$./configure $ make $ sudo make install


$ g++ -lpthread -Wall -g Configuration.cpp connection.cpp Portspoof.cpp revregex.cpp Utils.cpp Fuzzer.cpp Server.cpp -o portspoof

  1. Configure your firewall rules:

iptables -A PREROUTING -i eth0 -p tcp -m tcp --dport 1:65535 -j REDIRECT --to-ports 4444

iptables-restore < iptables-config (system_files directory)

Run Portspoof with service emulation:

$ portspoof -c portspoof.conf -s portspoof_signatures -D

Run Portspoof in “open port” mode:

$ portspoof -D

  1. Add portspoof to your system’s startup scripts. To do this modify or use the default init.d script that you can found in the ‘system_files’ directory.

Combine Portknocking with Portspoof and you've got yourself a nice defense from port scanners.

  • 2
    Configuring syn proxy with iptables will also show all ports as open. Good thing is that you don't need to install anything. fossies.org/linux/iptables/extensions/libxt_SYNPROXY.man
    – ibrahim
    Nov 20, 2017 at 11:19
  • 1
    Note that port knocking is an efficient way to lock yourself out when you don't have your usual tools around. I've had to fix a server from a japanese Internet cafe and there wasn't anything on it that I could've used to knock an arbitrary port a specific number of times.
    – Tom
    Sep 10, 2020 at 5:25
  • but +1 for Portspoof. That's a nifty solution that your pentesters will hate you for. :-)
    – Tom
    Sep 10, 2020 at 5:27

While there are some tricks you can play, e.g. blocking sources after suspicious connection attempts, all the nmaps of the world already have countermeasures as well (slow scanning, random scanning, etc.).

IMHO you should take a step back and ask yourself what you are afraid of, aka what is your threat model? If an attacker knows which ports are open, does that weaken your security? Because it shouldn't. You don't try to hide your front door, you install a proper lock, right?

  • "Tricks" does not define port knocking and "all the nmaps of the world already have countermeasures as well" is a false claim. Sorry but I vote down this answer. Sep 7, 2020 at 18:04
  • Which nmap-clone does not have something like a slow scanning switch?
    – Tom
    Sep 8, 2020 at 6:10
  • In your answer tou implied that 1) "all the nmaps" have countermeasures for [all] the attacks (not for a single attack) and that 2) there is no port scanning defense (also excluding port knocking which however in some use cases does completely mitigate the risk). Sep 10, 2020 at 3:50
  • port knocking is a reasonably complex but specific defense, and I interpreted the question towards avoidance of scans on open ports - you could argue a port knock port isn't actually open. At least technically it's not - it's closed until you knock. nmap doesn't do "attacks". It's a scanner. If you class a port scan as an attack, my public server is attacked thousands of times a day, and large sites millions of times. I stand by my final words: What's your thread model? Why are you afraid of being scanned?
    – Tom
    Sep 10, 2020 at 5:23

If you want to be able to connect to your server without going to additional pains on the client side - there is no way to protect those ports from being scanned. It's an oxymoron. Port scanning is simply an attempt at connecting and looking at what response comes back.

If you are willing to implement additional measures on the client side, you can use something like port-knocking. Note that this will still leave some ports being open for a scanning attempt, they simply won't be the ones that have any servers running on them.


Another solution is to use Tor hidden services if speed and latency is not a big issue. This effectively makes it impossible to discover the service using port scanning and is fairly easy to do. It also offers some more privacy, such as encryption and anonymity. All you need to access the service is Tor and the ability to connect through Tor (port 9050 default) using SOCKS5. You can use proxychains or torsocks to proxify programs that do not support SOCKS5. You can also set a password for the hidden service.

You can have all your ports as hidden services and then close them from the internet.


By definition, port scanning is the process of connecting to ports and checking the response and any obvious methods of stopping port scanning will result in trouble connected to the server yourself.

There are a number of solutions which are out there which require some more configuration and the easiest one is most likely port knocking.

A few articles on port knocking:

-Digital Ocean


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .