SYNTHETIC scan model. This card is not observed output. The model omits the SERVICE column. Taught command. nmap -sT -p 8000 127.0.0.1 Options, introduced before that line: -sT names a TCP connect scan. -p 8000 names one port. 127.0.0.1 names this machine's loopback address. Model while the owned page server is described as running PORT STATE 8000/tcp open Documented meaning used here: open means an application is accepting TCP connections on that port, as Nmap sees it. The SERVICE column is omitted. Without version detection, Nmap fills that column from nmap-services. This card does not use nmap-services for port 8000. Model if nothing is listening. This card omits the service name. PORT STATE 8000/tcp closed Documented meaning: closed means the port is accessible and no application is listening. filtered would mean the probes did not show whether the port was open. This model does not use filtered. Check: while the server is described as running, the model row is 8000/tcp open.