Nmap port states explained: open, closed, filtered, and unfiltered

Six states, each tied to a reply

Nmap does not know what a port “is”. It knows what came back when it sent a probe. Open means an application accepted the probe, for example a SYN-ACK to a SYN. Closed means the host answered but nothing is listening, which for TCP is a RST. Filtered means nothing useful came back, or an ICMP unreachable error did, so something between you and the port is dropping or rejecting traffic.

The other three states are combinations. Unfiltered appears only with an ACK scan and means the port is reachable but Nmap cannot say whether it is open. Open|filtered appears when silence is the expected answer from an open port, as with UDP and some exotic TCP scans. Closed|filtered is rare and comes from the IP ID idle scan.

• open: SYN-ACK (TCP) or a UDP reply
• closed: RST, or ICMP port unreachable for UDP
• filtered: no reply, or ICMP administratively prohibited
• unfiltered: ACK scan got a RST
• open|filtered: silence where an open port might also be silent
• closed|filtered: idle scan could not decide

Closed and filtered tell a firewall story

A closed port is good news from a reachability standpoint: the host is there and answered honestly. A filtered port means a packet filter is involved. If most ports on a host are filtered and a few are open, the host firewall is probably default-deny with a short allow list, which is what you want.

If you see a mix of closed and filtered on the same host, the filter is selective, and the pattern can reveal the rule set. That is useful when you are checking your own firewall: a port you meant to block that shows as closed is reachable by anyone, even though nothing listens there today.

Lab: produce each state on purpose

On a Linux lab VM, start a listener with python3 -m http.server 8000 so port 8000 is open. Leave port 8001 empty so it is closed. Then add a host firewall rule that drops 8002 and another that rejects 8003. Scan those four ports with --reason so Nmap prints why it chose each state.

Expect 8000 open with syn-ack, 8001 closed with reset, 8002 filtered with no-response, and 8003 filtered with an ICMP port-unreachable or admin-prohibited reason, depending on the reject type. Seeing the states line up with rules you wrote is the fastest way to trust what the scanner says about hosts you did not configure.

# on the lab VM
python3 -m http.server 8000 &
sudo iptables -A INPUT -p tcp --dport 8002 -j DROP
sudo iptables -A INPUT -p tcp --dport 8003 -j REJECT

# from the scanner
sudo nmap -p 8000-8003 --reason 192.168.56.101

Reporting states honestly

In a report, “filtered” should read as “no answer from this vantage point”, not “secure”. A port filtered from the internet may be wide open from the office VLAN. Always pair a state with where you scanned from.

Clean up the lab rules afterward with sudo iptables -D and the same arguments, or revert the snapshot. Leftover rules are a common reason later labs behave strangely.