My objective is to do a port scanner in windows and find the ports which are open. Suppose, I run an application which opens up a port 8000. Now I create a new inbound rule to block all incoming packets on port 8000. So now is the port technically open?

My requirement: Find all the ports which are open? That is, find the ports which are allowed by firewall and are open.

The ports which are blocked by firewall are anyway going to be shown as "open" on netstat but I do not want that information since it has already been taken care of.

Any ideas on how to proceed with it?

  • Run nmap against the host from a different machine. Nov 19, 2018 at 18:02
  • @postoronnim Any idea of how to do it by not depending on other machines and do it from my machine itself?
    – Oxia
    Nov 20, 2018 at 8:06
  • If you blocked the port is cannot be open.
    – Overmind
    Nov 20, 2018 at 11:10
  • @Overmind in netstat it will still be shown as "listening"
    – Oxia
    Nov 20, 2018 at 13:04
  • That is not relevant. Your application is listening for nothing since nothing gets through to it or from it on that port.
    – Overmind
    Nov 21, 2018 at 6:33

1 Answer 1


To explain things in a simple manner: ports can have 3 general states:

Blocked - (by firewall or any equipment between source and destination) - nothing gets through in either direction. Everything is denied.

Normal - (default state in most cases) - you can request connection towards anywhere and they will work, but incoming connections towards you are not permitted. A connection will work if you (the source) initializes it. If someone from outside initializes it, it will not work.

Open (sometimes called forwarded such in the case of NAT) - all connections can go through both ways. Anything incoming via such port will be allowed.

If an application is active and listens to a port, it will only be able to receive incoming connections if the port state is Open, it will be able to initialize connections if Open or Normal and will not be able to do anything if Blocked.

  • I got it! One last question: Consider I block RDS ports but when I use netstat, the ports will still be shown as "LISTENING" right? Technically it doesn't allow any connection, so the port is not vulnerable? According to my requirement, I need to do port scan and show which ports are vulnerable.
    – Oxia
    Nov 21, 2018 at 9:44
  • Yes, it will show as 'Listening' because RDS service does continue to listen to it. The vulnerability of the port in such a case is determined by how your network is setup. A firewall may block it towards internet or other sub-networks, but it could work between your internal network computers. If you block it by the firewall setting of the server itself, then no, it's not a vulnerability.
    – Overmind
    Nov 21, 2018 at 11:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .