Port Scanner — TCP Port Scanner with Service Detection and Banner Grabbing

TCP port scanner for common service ports. Scan single or multiple hosts against preset port lists (web, database, mail, dns, remote, file, monitoring, all) or custom port lists, with service detection, banner grabbing, and configurable timeouts.

---

What does it do?

Port Scanner performs TCP connection-based port scanning against one or more target hosts. It checks whether specific ports are open, closed, or filtered, and attempts to identify the service running behind each open port through banner grabbing and service signature analysis.

The actor ships with eight curated port presets — web, database, mail, dns, remote, file, monitoring, and all — and also accepts custom port lists for targeted scans. Results include port state, detected service name, any banner data collected, and connection latency.

Batch mode allows scanning up to 5 hosts in a single run with up to 50 ports per host, making it suitable for network reconnaissance, perimeter auditing, and internal infrastructure assessments.

---

Input Parameters

Parameter	Type	Required	Default	Description
host	string	Yes*	—	Single target hostname or IP address (e.g., "example.com", "192.168.1.1"). Required if hosts is not provided.
hosts	array	Yes*	—	Array of target hostnames or IPs for batch scanning (max 5). Required if host is not provided.
portPreset	string	No	"web"	Port selection preset: "web", "database", "mail", "dns", "remote", "file", "monitoring", "all", or "custom".
customPorts	array	No	—	Array of custom port numbers to scan (e.g., [8080, 8443, 9000]). Only used when portPreset is "custom". Overrides preset if provided.
timeoutSecs	number	No	2.0	Connection timeout per port in seconds (clamped to 0.5–10.0). Increase for high-latency targets.

Either use host for a single target or hosts for batch scanning (max 5 hosts).

Port Presets

Preset	Ports	Description
web	80, 443, 8080, 8443	Common web server and reverse proxy ports
database	3306, 5432, 6379, 27017, 1433, 1521, 9042	Database service ports
mail	25, 110, 143, 465, 587, 993, 995	Mail server ports
dns	53	DNS service
remote	22, 23, 3389, 5900, 5901	Remote access ports (SSH, Telnet, RDP, VNC)
file	20, 21, 445, 139, 2049	File sharing ports (FTP, SMB, NFS)
monitoring	161, 162, 389, 636, 5666, 5667	Monitoring and directory service ports
all	21–61616 (100+ common ports)	Broad sweep of widely used service ports across all categories
custom	User-defined	Manually specified list of ports via customPorts

---

Example Input

Single host scan with web ports:

{
  "host": "example.com",
  "portPreset": "web",
  "timeoutSecs": 2.0
}

Database port scan with custom ports:

{
  "host": "staging-db.example.com",
  "portPreset": "custom",
  "customPorts": [3306, 5432, 6379, 27017],
  "timeoutSecs": 3.0
}

Batch mode scanning multiple hosts:

{
  "hosts": [
    "example.com",
    "api.example.com",
    "192.168.1.1"
  ],
  "portPreset": "remote",
  "timeoutSecs": 4.0
}

---

📤 Output Format

The actor pushes flat dataset items directly via Actor.push_data(). Each port scan result is an individual item in the dataset. Summary items are also pushed as separate items flagged with _summary.

Port Result Item (one per port per host)

Field	Type	Description
host	string	The scanned hostname or IP
ip	string	Resolved IP address of the target
port	number	Port number
state	string	Port state: "open", "closed", "filtered", or "error"
service	string	Detected service name (e.g., "HTTP", "SSH", "MySQL") from port-to-service mapping
banner	string	Service banner text captured during connection (if available, up to 200 chars)
elapsed_ms	number	Connection time in milliseconds

Error items (when hostname resolution fails) contain only host and error fields.

Summary Item (one per host, flagged with _summary)

Field	Type	Description
_summary	boolean	Always true to distinguish from port results
host	string	The scanned hostname or IP
ip	string	Resolved IP address
reverse_dns	string	Reverse DNS PTR record (if available)
ports_scanned	number	Total number of ports checked
ports_open	number	Count of open ports found
ports_closed	number	Count of closed ports
ports_filtered	number	Count of filtered (no response) ports
ports_error	number	Count of ports with scan errors
preset	string	The port preset used for this scan
concurrency	number	Concurrent connection limit used
batch	boolean	Whether this was a batch scan (> 1 host)

Example Output

Single host, web preset (example.com):

{"host":"example.com","port":80,"state":"open","service":"HTTP","banner":"HTTP/1.1 200 OK\\r\\nServer: ECS/...","elapsed_ms":45.2,"ip":"93.184.216.34"}
{"host":"example.com","port":443,"state":"open","service":"HTTPS","banner":"","elapsed_ms":52.8,"ip":"93.184.216.34"}
{"host":"example.com","port":8080,"state":"closed","service":"HTTP-Alt","banner":"","elapsed_ms":2001.3,"ip":"93.184.216.34"}
{"host":"example.com","port":8443,"state":"closed","service":"HTTPS-Alt","banner":"","elapsed_ms":2001.5,"ip":"93.184.216.34"}
{"_summary":true,"host":"example.com","ip":"93.184.216.34","reverse_dns":"","ports_scanned":4,"ports_open":2,"ports_closed":2,"ports_filtered":0,"ports_error":0,"preset":"web","concurrency":4,"batch":false}

Batch mode (2 hosts, remote preset):

{"host":"server1.example.com","port":22,"state":"open","service":"SSH","banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6","elapsed_ms":12.1,"ip":"10.0.0.1"}
{"host":"server1.example.com","port":3389,"state":"closed","service":"RDP","banner":"","elapsed_ms":2000.8,"ip":"10.0.0.1"}
{"host":"server2.example.com","port":22,"state":"filtered","service":"SSH","banner":"","elapsed_ms":3001.5,"ip":"10.0.0.2"}
{"_summary":true,"host":"server1.example.com","ip":"10.0.0.1","reverse_dns":"","ports_scanned":5,"ports_open":1,"ports_closed":4,"ports_filtered":0,"ports_error":0,"preset":"remote","concurrency":5,"batch":true}
{"_summary":true,"host":"server2.example.com","ip":"10.0.0.2","reverse_dns":"","ports_scanned":5,"ports_open":0,"ports_closed":0,"ports_filtered":5,"ports_error":0,"preset":"remote","concurrency":5,"batch":true}

---

Use Cases

Perimeter security audit

Scan your organisation's public-facing IP ranges to confirm that only authorised services are exposed. Flag any unexpected open ports — especially SSH, RDP, or database ports — that could indicate misconfigured firewall rules or shadow IT deployments.

Pre-engagement reconnaissance

Before a penetration test or bug bounty hunt, scan the full target domain set to understand the attack surface. Identify which services are running and their versions from banners, then cross-reference with known vulnerabilities.

Cloud infrastructure validation

After provisioning new cloud instances (AWS EC2, GCP Compute Engine, Azure VMs), run a port scan to verify that security group rules and firewall policies are restricting access as intended. Catch overly permissive ingress rules before they reach production.

Docker and Kubernetes audit

Scan internal cluster IPs and NodePort ranges to detect unauthorised services or accidentally exposed control plane components. Combined with service detection, identify containers running outdated or vulnerable software.

Internal network segmentation testing

Verify that network segmentation controls are working by scanning across VLAN boundaries. Confirm that only permitted cross-segment ports (e.g., specific API ports, database replication ports) are reachable from different network zones.

---

FAQ

Q: Is this a SYN scan or a full TCP connect scan?

The actor uses TCP connect scanning, completing the full three-way handshake. This means it works without raw socket privileges and is compatible with all hosting environments, but may be logged by target systems.

Q: Will I get rate-limited or blocked by targets?

Port scanning can trigger intrusion detection systems (IDS) and firewall rate limits. The actor respects per-port timeouts and uses semaphore-based concurrency control but does not perform stealth techniques. For production targets, ensure you have authorisation to scan.

Q: How accurate is service detection?

Service detection is based on a static port-to-service mapping table. Services that send banners on connection (SSH, SMTP, HTTP, FTP, POP3, IMAP) are identified with the banner text captured. Services that don't send banners show only the mapped service name from the known-ports table.

Q: Does the actor support IPv6?

Yes. The actor uses getaddrinfo with AF_UNSPEC to resolve hostnames, supporting both IPv4 and IPv6 targets. The socket is created with the appropriate address family based on resolution results.

Q: What does a "filtered" port state mean?

A "filtered" state indicates the port did not respond within the timeout period and no TCP RST was received, suggesting a firewall or packet filter is blocking the probe. This does not necessarily mean the port is closed — it may be open but filtered by a firewall that drops packets silently.

Q: What limits does the actor enforce?

Maximum 5 hosts per run, maximum 50 ports per host, timeout clamped to 0.5–10.0 seconds, and a concurrency limit of 20 simultaneous connections.

Q: How is data output structured?

Each port scan result is a flat JSON dataset item pushed individually via Actor.push_data(). A summary item (with _summary: true) is appended per host after all its ports are scanned. This is the standard Apify dataset format — no nested host objects.