Run a scan#

Set the target, the port list, the probe technique and the timing template, then watch results stream in while the scan is still working.

A port scan answers two questions in sequence. Which addresses in this range have something alive on them, and which ports on those addresses accept a connection? Every control in the configuration bar decides how thoroughly, how quickly, and how quietly the scanner asks.

Enter a target in the field and select Scan. A target can be a single address, a CIDR range such as 192.168.1.0/24, a hostname, or several of those separated by commas. You can also press Enter in the field to start the scan.

The Port Scanner configuration bar with the target field, timing, service detection, port preset and scan technique controls, above the expanded Host Discovery and Evasion panels

Select the port list#

The preset dropdown on the right sets the port list.

  • Top 100: the default. It covers the hundred ports that carry almost all common services.
  • Fast (100): scans the same hundred ports.
  • All (1-65535): scans every port. It takes a very long time across a range.
  • Range: takes a start and an end.
  • Custom: takes a comma-separated list such as 22,80,443,8080.

Top 100 is the right choice for a first pass.

Warning The Custom field accepts comma-separated numbers only. Ranges such as 80-90 are not understood, and anything that is not a valid port number is dropped silently with no error. If every entry in your list is invalid the scan runs with the previous port selection instead. Check the list you typed before reading the results.

Select the scan technique#

The technique dropdown decides what the scanner sends. TCP Connect is the default. It completes an ordinary connection, exactly as any client does. It needs no special privileges and it is reliable. It is also the most visible: the connection reaches the application, and the application tends to log it.

The alternatives, including SYN, NULL, FIN, Xmas, ACK, and Window scans, along with UDP, SCTP, and IP protocol scans, send packets the scanner builds itself. They reveal more and disturb the target less, but they need raw socket access.

If your installation does not have that access, the button reads Scan (Admin) with a padlock, and the text Requires elevated privileges appears beside it. Only TCP Connect and UDP scanning are available in that state. The scanner does not prompt for a password. A helper installed alongside the application grants raw socket access.

Set the timing template#

Timing runs from T0 - Paranoid to T5 - Insane, with T3 - Normal as the default.

The lower templates do more than slow the scan down: they change the shape of the traffic. T0 sends one probe at a time with long gaps. That takes hours across a range, but it is difficult to distinguish from ordinary traffic. T3 and above send hundreds of probes in parallel, which is fast and obvious. Rate-limiting devices between you and the target can also drop probes under the aggressive templates, so a faster scan is not always a more complete one.

Switch on service detection#

Four controls decide how much the scanner reports beyond the state of a port:

  • Service Detection: on by default. An open port tells you that something is listening. Service detection probes the port to find out what listens there, and usually which version.
  • Intensity: sets how many probes service detection sends, from 0 - Lightest to 9 - Most complete. Default 7 (recommended). Higher values identify more obscure services at the cost of time and noise.
  • OS Detection: off by default. It guesses the operating system from how the host's network stack behaves, and reports a confidence percentage alongside the guess. Treat the result as a hint.
  • Verbose: off by default. It streams the scan engine's own log lines in a panel, each with a timestamp, level, and component. The panel also carries a Copy All button. Use it when a scan returns results you did not expect.

While the scan runs#

The configuration controls lock, the Scan button becomes Stop, and both configuration panels collapse to give the results more room. Progress shows the current phase, the number of hosts completed against the total, a percentage, and an estimate of time remaining. Results stream in as the scanner finds them rather than at the end.

When you stop a scan, the scanner keeps what it found. Partial results stay on screen and remain interactive.

If the scan cannot start at all, a notification explains why and offers Retry. The usual causes are a malformed target or a port specification the scanner rejected.

Where to go next#

Two panels below the configuration bar hold the lower-level controls: Host discovery decides how the scanner works out which hosts are alive, and Evasion shapes the packets it sends. When results arrive, see reading the results.