• Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the balance of the port numbers scanned in a statistically random way?

    In other words, for a random IP (i.e. the IP of someone who is not the target of a directed attack) are there ports or ranges of ports that are more or less likely to be scanned?

  • Are there any honeypots that keep track of statistics on port scans of random IPs?

6 Answers 6


Definitely. See http://nmap.org/svn/nmap-services for a listing of ports and the expected chances that they'll be open.

Nmap offers two options that relate to that:

--top-ports <number>: Scan <number> most common ports
--port-ratio <ratio>: Scan ports more common than <ratio>

Other methods include ports < 1024, listed in an /etc/services files, etc. "By default, Nmap scans the most common 1000 ports for each protocol." I consider nmap to be the default tool, but of course there are others that are common enough.

I would guess that high-numbers ports (49152–65535... the unregistered list) are the least likely to be scanned. See also http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

In no case I can imagine besides generating statistics would statistically random scanning be helpful as compared to deterministic ratio scanning, and I have never heard of anything that does that.

For some statistics from the honey pot side, there are papers out there. http://cseweb.ucsd.edu/~clbailey/PortScans.pdf is an example of one.

  • 1
    I hadn't realised the nmap list included chances of the port being open. Very cool!
    – Rory Alsop
    Jul 29, 2011 at 15:48
  • Fyodor of nmap has included the statistics of a very huge scan to build up a frequency list of open ports. This was included some years back. Jul 29, 2011 at 16:41

The way attackers go about portscans is to first target those with known exploits or commonly weak protection.

The list at http://www.iss.net/security_center/advice/Exploits/Ports/default.htm is one typical list.

Sure, you get some scanners who go for the entire port range, but as that is far less effective, this list is going to be a pretty good indication of the most scanned ports.

  • 4
    That makes sense, because if I were writing a port scanner I'd want to find the open ports before the port scan was detected and blocked. So I'd target those most valuable - with the highest likelihood of being open or the juiciest services.
    – user185
    Jul 29, 2011 at 15:46
  • I agree with the theory, do you have any supporting evidence?
    – this.josh
    Jul 29, 2011 at 19:42
  • @rory the link is opening a page at IBM.
    – JPCF
    Feb 14, 2016 at 20:42
  • IBM owned ISS and it is now gone, and replaced. I'll see if there is an equivalent page there now.
    – Rory Alsop
    Feb 14, 2016 at 21:02

In Addition to @RoryAlsop 's answer, the NMAP project maintains a list of ports along with the likelihood that it will be found to be open here,

  • thanks. I presume that list is what's used for nmap's --top-ports option? Jul 29, 2011 at 15:24
  • I believe so, yes Jul 29, 2011 at 15:43
  • Where do they get the data for the probability of a port being open?
    – this.josh
    Jul 29, 2011 at 19:50
  • IIRC they did some large scanning of segments of the Internet to come up with the probabilities Jul 30, 2011 at 10:45

DShield's Port Report may have the information you are looking for. DShield collects firewall logs from volunteers and then provides summarized data from the logs to the community.


are the balance of the port numbers scanned in a statistically random way?

No, if a scan continues past the "well known services" stage, then it's simply scanning the ranges of ports specified by the user. The user may specify "random" port ranges - "Let's check 10,000 - 12,000 and 27,000 - 29,000" - but that's not statistically random, it's a couple of arbitrary blocks chosen by the user.

The sort of scan you are wondering about, a statistically random distribution of individual ports throughout the entire space, is mathematically unlikely to be any better than a brute force scan of all ports, and is likely to be worse in hit rate (although faster, ha ha). To the best of my knowledge and experience, no tool implements a "scan randomly" setting.

  • I thought nmap scanned randomly, but this random order could be turned off with the -r: Scan ports consecutively - don't randomize option? Jul 29, 2011 at 16:01
  • I believe that affects the order in which specified ports are scanned, not the random selection of (un)specified ports. In other words, that'll mean that a scan might go 80, 443, 995 or 443, 80, 995 or (...). That's to keep scans from being (that much more) obvious when the victim looks at their logs.
    – gowenfawr
    Jul 29, 2011 at 17:00

Security is often a cat-and-mouse game. Some clever people are likely to put their own important private service up on a port that is rarely scanned. So some clever scanners going after whatever it is that the clever people are hiding, might be expected to preferentially look at ports that are rarely-scanned by others.

  • +1 - from the data I have seen, although some scans do cover non-standard ports, they are still far outweighed by scans for the usual culprits.
    – Rory Alsop
    Jul 30, 2011 at 8:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .