Nmap online course

Port scans

SYN scan, connect scan, and what “filtered” actually means.

A SYN scan (-sS, needs root/admin) sends a SYN and reads the reply. A connect scan (-sT) completes the TCP handshake. Open means a service accepted the handshake. Closed means a RST. Filtered means the probe got no useful answer — often a firewall.

nmap -sS -p 22,80,443 172.16.10.10

Do not scan the entire port range on a production network because you are curious. Narrow the ports, slow the timing if asked, and keep the output.