8

Is port scanning legal ? In which countries ?

my option :

I think port scanning is like a short-walk( or a long-walk) in the neighbourhood, just curious about neighbours are up to.

I think that port scanning must be legal. Sometimes you could find an interesting website or ftp etc. ( what if there was not google,yahoo,duckduck ? to search the web )

and it is up to the administrator to use passwords to protect something that does not want to see anyone else.

  • Talk to your lawyer! Also some ISPs forbid it in their overreaching service terms. – ewanm89 Oct 5 '12 at 14:23
  • @ewanm89 WOW really ? have you in mind any ISP ? – Stelios Joseph Karras Oct 5 '12 at 14:25
  • British Telecom: You must not run "port scanning" software which accesses remote machines or networks, except with the explicit prior permission of the administrator or owner of such remote machines or networks. This includes using applications capable of scanning the ports of other Internet users. Click here for a port scanning FAQ. If you intend to run a port scanning application, you must provide BT with a copy of the written consent received from the target of the scan authorising the activity. This must be supplied to BT prior to the application being run. – ewanm89 Oct 5 '12 at 14:38
  • Comcast: Unauthorized port scanning is strictly prohibited; – ewanm89 Oct 5 '12 at 14:38
  • 1
    interesting discussion: nmap.org/book/legal-issues.html – Andy Smith Oct 5 '12 at 15:38
8

Port scanning is more akin to taking a walk around the neighbourhood and trying every handle of a door and every window to see if it's open, to see if the neighbours have left anything available for future investigation or exploitation/theft.

The walk you describe would be more of a ping sweep - just see if the host is up (or house exists).

Regarding legality, intent plays a big part, and whether you have permission of the target (white-hat vs black-hat). Consult a lawyer.

  • well at your point of view maybe. but from my point of view is something like this : hello good neighbour what are you up today ? neighbour : well go away I do not talk about . ( or if he wants to share ) neighbour: well I have an apache running my new site . – Stelios Joseph Karras Oct 5 '12 at 17:25
  • from your point of view: I have no curtains to my windows and let the people see what happens in my home is this illegal? – Stelios Joseph Karras Oct 5 '12 at 17:35
3

In short: It is probably prohibited by law (assuming most countries have a law similar to the Dutch), and probably also by your ISP. However I don't think anyone will win a court against you if you don't do anything besides portscanning and don't overload the service. Very strictly speaking, typing a random domain in your address bar would be portscanning as well.


As mentioned in the comments on your question, it is usually prohibited by the ISP. This can be your ISP at home, but it can also be in the terms of a VPS hosting provider.

Besides this, I can only comment on Dutch laws really. It mentions the following as "computer fraud": Intentionally and unlawfully entering an automated work, or part of an automated work. Entering is defined as either:

  • Breaking security;
  • Using a technical procedure;
  • Using false signals or a false key, or
  • Using a false identity.

Clearly you are not breaking security by sending a packet to test whether a port is open or using a false identity, but a technical procedure is a very broad term. Also false signals can mean a lot, probably including sending packets, especially when you can't prove their purpose besides testing whether a port is open for potential abuse. This would fall in the category of unlawfully entering an automated work, given that you have no permission from the target.

Still though, I don't think anyone would win a court against you for portscanning as long as you don't overload the server. Breaking the security is only done after an open port is found.

Disclaimer: IANAL

Source (Dutch): http://wetten.overheid.nl/BWBR0028570/Tweedeboek/TitelV/Artikel144a/geldigheidsdatum_30-06-2012

  • this is exactly what I am talking about.you just see if the port is open and you see the content. if it is open it is not really my fault. – Stelios Joseph Karras Oct 5 '12 at 17:32
  • @jkarr "Not really your fault", true, but neither is it your fault if someone leaves their front door open. Still, you are still trespassing when walking inside, regardless of whether you steal or even touch anything. – Luc Oct 5 '12 at 17:47
  • @Luc Why compare it to something that is less similar, when you can compare it to something that is more similar, like opening stackexchange.com . I surely did not have a written authorization to access the content of stackexchange.com , and there is no possible way that everyone is informed that the content is intended for public use. I think this is a way fairer comparison than with a home. – Andrei Feb 7 at 21:30
  • @Andrei I don't think that is a fair comparison. Opening a known website like stackexchange.com is more like opening a book in a public place than accessing random ports is. If I open a random port (one of 65 thousand possible ports, on an IP address among millions of others) and if I don't advertise it, then someone has to actively go looking for it to find it. That's more like looking for weaknesses than it is to open a known website. That said, I still think portscanning is pretty innocuous and a judge won't jail you for it, but I can see why it could be considered illegal or bad. – Luc Feb 8 at 8:06
  • just because you know it, it doesn't mean it's known to everyone. Let me make the example easier. Let's say I have a blog, that I'm not advertising whatsoever. Sooner or later, at least some people, will read my blog because google will scrap it without asking me anything. Can I sue google and the 2 chinese who visited my blog by mistake? I say no. I'm only considering the principle, not the practice of what would happen in a court. If servers are books (your words), then the internet is a public library, what's not locked, you should be allowed to read. – Andrei Feb 8 at 10:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.