Open vs Closed vs Filtered Ports: Understanding States

The Four Diagnostic Port States

When probing a remote TCP port, the network response falls into one of four distinct states:

[1. OPEN]      Client ───(SYN)───▶ Server ───(SYN-ACK)───▶ Active Service Listening
[2. CLOSED]    Client ───(SYN)───▶ Server ───(RST-ACK)───▶ Host Up, No Service Bound
[3. FILTERED]  Client ───(SYN)───▶ [Firewall Drops/Blocks] ▶ No Response Returned
[4. TIMEOUT]   Client ───(SYN)───▶ [Network Packet Loss]   ▶ Timeout Window Expired

Summary of Port States

• OPEN: An active application is listening on the port and accepted the connection with a `SYN-ACK`.
• CLOSED: The target host received the packet but no application is bound to that port; it immediately returned a `RST` (Reset) flag.
• FILTERED: A network firewall, packet filter, or security group blocked the probe. The scanner cannot determine if an application is listening.
• TIMEOUT: The packet was dropped or routing failed before a response could be generated within the timeout limit.

Example: Before and After a Firewall Rule (Illustrative)

Before:  Port 5432 (PostgreSQL)  OPEN      — reachable from any IP
After:   Port 5432 (PostgreSQL)  FILTERED  — security group now scopes access

Nothing about the database itself changed between these two scans — same server, same running service. Only the network-layer rule changed, and that alone flipped the port's diagnosable state from OPEN to FILTERED. This is exactly the before/after check worth running immediately after tightening a security group or firewall rule, rather than assuming the change took effect.

Scan Your Public Ports

Verify your firewall filtering rules and check for inadvertently open ports using our Safe Port Scanner.