YanoSecA service must accept network traffic before another program can use it. Nmap sends probes and classifies the responses. A port state describes what Nmap can infer from a particular location and scan method; it is not a permanent property visible equally from everywhere.
TCP connect scanning asks the operating system to establish a TCP connection. The option -sT selects that method; -p 8000 limits the port list to 8000, and 127.0.0.1 selects this machine’s loopback address. A hyphen introduces an option, and the separate number after -p is its argument. This lesson reads a synthetic model instead of issuing a probe.
Before you begin
- Recommended first
- The rule for every tool from here on, curl, and one HTTP request from Python, Snapshots, and how to undo a bad experiment, Web recon
- Estimated time
- 16 min reading, 12 min activity. Setup and optional practice may take longer.
- Where you work
- Use the printed examples in any desktop or mobile browser, with paper or a text editor. No installation, account, proxy, certificate or scan is required. Ubuntu is sufficient for later practice; optional setup time is outside these estimates.
- Without a lab
- All evidence needed for the activity appears on this page. Copy it into notes if downloads are unavailable. Read the labeled model and predict each result; a paper trace practises the reasoning while tool operation waits for a lab. Reading needs no JavaScript. Answer checking needs JavaScript and a secure context; saving progress also needs usable browser storage.
After this lesson you can:
- Name the target, the port, and the scan type in the owned scope.
- State what the synthetic row 8000/tcp open records.
- Say what that row still does not establish about the service.
01Example
Worked authored model uses a closed listener to practise interpretation. It is separate from the fixed open-row question.
Command under discussion: nmap -sT -p 8000 127.0.0.1
Model row after the owned listener stops: 8000/tcp closed
Interpretation: the TCP port is reachable, but no application is listening.
Limit: this is a synthetic row, not a new Nmap result.02Six states, one row
Open means an application is accepting connections for this TCP model. Closed means the port is accessible with no application listening. Filtered means packet filtering prevents Nmap determining whether the port is open. Nmap also has unfiltered, open|filtered and closed|filtered states for other uncertainty and scan conditions; the vertical bar means alternatives remain unresolved.
The SERVICE column can contain a probable name taken from a port-number table. Such a label is not a measured product or version. Version detection (-sV) sends additional probes and is outside this scope, along with operating-system detection and scripts. The printed model omits SERVICE entirely.
The original 2026-10-12 activity record describes Nmap 7.94SVN against this loopback port, with open while an owned Python server ran and closed after it stopped. That is historical, separate evidence. These authored rows remain models and do not claim a new scan or a reproduced installation.
Read a TCP scan model and explain what a port state establishes about reachability.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
| Field | Stopped owned listener | Owned listener accepting |
|---|---|---|
| Synthetic row | 8000/tcp closed | 8000/tcp open |
| Narrow meaning | Reachable TCP port; no application listening | An application accepts connections |
| Evidence status | Synthetic; not a new Nmap result | Synthetic; acceptance does not establish unsafe behavior |
The modeled closed/open distinction concerns listener acceptance on the stated port.
The modeled closed/open distinction concerns listener acceptance on the stated port.
Follow the explanation
- The modeled closed/open distinction concerns listener acceptance on the stated port.
- The command under discussion is nmap -sT -p 8000 127.0.0.1. No request is made.
Read every state and value
1. The modeled closed/open distinction concerns listener acceptance on the stated port.
- Selected Comparison
- states
- Highlighted Field
- Synthetic row · Narrow meaning
2. The command under discussion is nmap -sT -p 8000 127.0.0.1. No request is made.
- Selected Comparison
- limits
- Highlighted Field
- Evidence status
03Read the model row
Use only the printed scope and models. The optional later command is not necessary for this activity.
Owned scope for the one-port model. This file is not a scan transcript.
Target: 127.0.0.1
Port: 8000
Transport: TCP
Scan type: connect scan, written as -sT
Allowed: that one probe, or reading this model in its place
Excluded: any other address, any other port, version detection (-sV), OS detection, and Nmap scripts
Stop: after the one probe, or after you have read the model row
A listening port records reachability under those conditions.
The row does not name a product, a version, or a weakness.
SYNTHETIC scan model. This card is not observed output.
The model omits the SERVICE column.
Taught command.
nmap -sT -p 8000 127.0.0.1
Options, introduced before that line:
-sT names a TCP connect scan.
-p 8000 names one port.
127.0.0.1 names this machine's loopback address.
Model while the owned page server is described as running
PORT STATE
8000/tcp open
Documented meaning used here: open means an application is accepting TCP connections on that port, as Nmap sees it.
The SERVICE column is omitted. Without version detection, Nmap fills that column from nmap-services. This card does not use nmap-services for port 8000.
Model if nothing is listening. This card omits the service name.
PORT STATE
8000/tcp closed
Documented meaning: closed means the port is accessible and no application is listening.
filtered would mean the probes did not show whether the port was open. This model does not use filtered.
Check: while the server is described as running, the model row is 8000/tcp open.
SYNTHETIC field row. This card is not the 2026-10-12 loopback transcript.
PORT STATE
8000/tcp open
Interpret the state from this synthetic row.
- Copy the scope as target 127.0.0.1, TCP port 8000, connect scan, no version detection or scripts.
- Compare two authored states: while the listener is present, 8000/tcp open; after it stops, 8000/tcp closed. Explain which application-state change the model describes.
- For a fresh guided prediction, suppose a filter blocks the probe before it can determine the port state. Write filtered and explain why that observation would not settle whether a listener exists.
- Stop after the three-state comparison. Leave the independent field row for its own question; do not scan another host or widen the options.
04Optional challenge
For about ten optional minutes, write two explanations for a different observer seeing filtered while a local observer sees open. The rubric is that observation location and filtering conditions can differ; neither explanation should claim a discovered weakness.
05Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
Scan case A: hypothetical one-port commandOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Grant: one scoped TCP connect scan of owned 127.0.0.1 port 8000.
Command under review: nmap -sT -p 8000 127.0.0.1
-sT means TCP connect; -p chooses ports.
Excluded: other ports, other hosts and version detection (-sV). No command is run.
Scan case B: independent synthetic rowsOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Case M: 8000/tcp open
Case N: 8000/tcp closed
Case P: 8000/tcp filtered
SERVICE and VERSION columns are absent. Each is a separate authored scenario, not a changing observed host.
06Explain your evidence
Optional written self-check: explain one decision using the supplied case. No tool run is required.
Check your explanation: quote the target, selected port, scan type and model provenance; interpret state narrowly; identify missing product evidence and stop at the printed boundary.
07Common mistakes
If you confuse closed and filtered, ask whether the evidence establishes reachability and absence of a listener, or leaves open versus closed unresolved.
If a port label looks like a product name, separate a registry guess from an actual version-detection response. The latter is not supplied here.
If the scope allows one TCP connect probe, adding -sV, -A or scripts adds actions. Read scope before copying a longer command from elsewhere.
References
- Nmap: Port scanning basics
Official definitions of scan states, connect scans or service-name/version-detection limits.
- Nmap: TCP connect scan (-sT)
Official definitions of scan states, connect scans or service-name/version-detection limits.
- Nmap reference guide
Official definitions of scan states, connect scans or service-name/version-detection limits.
- Nmap: Service and version detection
Official definitions of scan states, connect scans or service-name/version-detection limits.