Which ports are open on my network? How to check, and which ones to close
What an open port is, how to see which ones your router, printer, NAS and PCs expose, which ones are risky on a home or small-office network — and how to close them.
What an open port actually is
Every device on a network can offer services: a web page to configure it, file sharing, remote desktop, printing. Each service listens on a numbered port — web on 80 and 443, file sharing on 445, remote desktop on 3389. A port is open when something on the device answers there.
An open port is not a problem in itself. Your printer has to answer on its printing port, and your router has to answer on 53 to resolve names for everyone. The problem is a port that is open when nobody needs it, or one that offers an old, unencrypted or easily guessed way in. Most network break-ins in homes and small offices start exactly there: a forgotten service, still on its factory settings.
Inside or outside: two different questions
There are two places to look from, and they answer different questions.
- From inside your network you see everything each device offers to the other devices around it: the printer’s web page, the NAS’s file shares, the PC’s remote desktop. This is what a guest’s phone, or a compromised smart plug, could reach.
- From the internet you only see what your router lets through — normally nothing at all, unless someone set up port forwarding or turned on UPnP, which lets devices open ports on the router by themselves.
Both matter. Start from the inside, because that is where most of the surprises are, then check the router itself.
How to check from inside
A port scanner knocks on a range of ports on a device and records which ones answer. Three choices decide how long it takes and what it finds:
- The target. Start with the router (the gateway, usually
192.168.1.1or192.168.0.1), then the devices you care about most: the NAS, the PCs, the cameras. - Which ports. The few dozen common ports cover almost every service you will meet at home or in an office, and take seconds. The full well-known range, 1–1024, is more thorough. A custom list is for when you are looking for something specific.
- TCP and UDP. Most services use TCP, but some important ones use UDP — DNS, NTP, SNMP, NetBIOS — and many scanners skip them. A UDP port only counts as open if the device actually replies, so a good scanner sends a real request for each protocol rather than guessing.
Which ports are worth worrying about
On a home or small-office network, these deserve a second look:
| Port | Service | Why it matters |
|---|---|---|
| 21, 23 | FTP, Telnet | Old protocols that send passwords in clear text. Rarely needed today. |
| 80 | Web, unencrypted | Fine for a printer’s status page; worse for a login page on the router. |
| 445, 139 | Windows file sharing (SMB) | The classic way malware spreads from one PC to the next. Limit it to the machines that really share files. |
| 3389 | Remote Desktop | Constantly attacked when it is reachable from the internet. Inside, keep it to PCs that need it. |
| 5900 | VNC | Remote control, often with a weak or no password. |
| 1900, 5000 | UPnP | Lets devices open ports on the router on their own. |
| 161 | SNMP | Useful for monitoring, but with the default community public anyone on the network can read the device. |
| 554, 8000, 8080 | Cameras and admin pages | Cheap cameras and gadgets often ship with default passwords. |
What you are looking for is a mismatch: a service on a device that has no reason to offer it, or a service you did not know was there.
How to close what you don’t need
- Turn the service off on the device itself. A port closes when nothing listens on it: disable Telnet on the router, file sharing on a PC that shares nothing, the web interface of a camera you only use through its app.
- Remove port forwarding in the router you no longer use, and turn off UPnP unless a game console or app really needs it.
- Change default passwords on everything that keeps an admin page or a remote access open — router, NAS, cameras, printers.
- Update the firmware: many old services are fixed or removed in newer versions.
- Move gadgets to the guest network, if your router has one, so a camera or a smart plug cannot reach your PCs at all.
Then scan again. The list should be shorter, and every line on it should be something you can explain.
Doing it with NetBlade on iPhone
NetBlade for iPhone and iPad does the checking from your pocket, without an account:
- the Ports tab scans any device: type an address or tap Use gateway for the router, then pick Common, 1–1024 or Custom;
- every open port comes with its service, a short description and a risk level, TCP and UDP side by side, with real UDP probes for DNS, NTP, TFTP, mDNS, NetBIOS and SNMP;
- Search CVE next to a port opens the National Vulnerability Database for that service;
- on the LAN tab, each device’s details turn its open ports into a security score out of 100, with a piece of advice for every finding;
- you can share the result from the top bar.
Port scanning and the security score are free. Scan your router and your most important devices once, close what you do not recognise, and keep the network saved: the next time you open the app, its history shows what changed.