On some networks (primarily corporate ones), the firewall restricts outbound connections to some port number. The allowed ports generally comprise of port 80, 11, 443, etc.

Is there a way I could do a quick port scan to find a which ports are firewalled and which aren't?


Sure, you could try to port scan a target on the other side of the firewall that you know accepts connections on every port (but good luck finding one of those or keeping it online), but the better approach is going to be only testing the ports you're interested in, because it's faster, easier and less likely to get you in trouble for port scanning.

There's no simple trick to getting this information, though (other than checking the firewall configuration), and this is at least partially by design - information on what traffic is and isn't allowed through a firewall isn't readily disclosed, because having that information would help an attacker improve his efforts to penetrate the network.

  • 1
    My favorite tool for such tasks is Netcat: en.wikipedia.org/wiki/Netcat For port checking the -z parameter is helpful. It just checks the port without actually opening it. – Axel Kemper Apr 3 '13 at 10:15

I can't comment unfortunately, but HoplessN00b's comment makes me search for some service with all port opened and it really exists - portquiz.net.

So runing of

netcat -vz portquiz.net 1-9999 2>&1 | grep -v failed

give you list of available ports, you are able to use/connect from restricted network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.