What is Network Scanner? How Network Scanning Works

A network scanner is a tool that discovers the devices on a network and the services they run. It sends packets to a range of addresses, reads the replies, and builds a map of what is live, what ports are open, and what software is listening.

Nmap, the best-known port scanner, is the reference tool in this category. Security teams and network administrators use it to answer three questions: which hosts are alive, which ports are open, and which services sit behind those ports. Many scanners add operating system detection on top.

The purpose depends on the direction of the scan. Pointed inward, a network scanner inventories the devices on a local network. Pointed at the perimeter, it shows what the organization exposes to the internet, which is the same view an attacker builds first.

What a Network Scanner Detects

A scan turns an unknown network into an inventory. These are the things it surfaces.

• Live hosts. The active devices on a network found by their IP addresses.
• Open ports. The communication channels accepting connections, each one a possible way in.
• Running services. The software behind each open port, often down to the exact version.
• Operating systems. The OS of each host, identified from how it responds to probes.
• Network devices. Routers, switches, printers, and other hardware attached to the network.
• Known vulnerabilities. Weaknesses in the detected services, when the scanner runs vulnerability scripts.

How Network Scanning Works

A network scan runs in three stages. Each one narrows the picture further.

The first stage is host discovery. The scanner finds which devices are alive, usually by sending a ping, a small packet that asks for a reply. On a local network, it can send ARP requests instead, and when a firewall blocks pings, it sends TCP packets to common ports to force a response.

The second stage is port scanning. The scanner sends probe packets to the ports on each live host and reads what comes back. The responses reveal which ports are open, which are closed, and which sit behind a firewall.

The third stage is fingerprinting. The scanner examines the exact replies from each open port and compares them against a database of known signatures. This identifies the service, its version, and often the operating system. That detail turns a list of open ports into a map of real software to defend, because a known version can be matched against known vulnerabilities.

Understanding Port States

A port is a numbered channel that a device uses to talk to the network. Scanners sort ports into states that describe what the scan found, and the Nmap port-state model defines them. Three states carry most of the meaning.

• Open. A service is actively listening and accepting connections. Finding open ports is usually the point of a scan, since each one is a potential entry point.
• Closed. The port is reachable, but nothing is listening. It confirms the host is alive, and it could open later if a service starts.
• Filtered. A firewall or filter blocks the probe, so the scanner cannot tell whether the port is open. These ports slow a scan down and reveal that something is guarding them.

Three combined states cover the uncertain cases. Unfiltered means a port is reachable but its open or closed status is unclear, while open-filtered and closed-filtered mean the scanner could not separate the two possibilities, usually because a filter dropped the reply.

Types of Network Scans

Scanners offer several scan types, and each trades speed, stealth, and accuracy differently. The table compares the main ones.

Experienced operators combine scan types rather than relying on one. A SYN scan for speed, a UDP scan for the services it would otherwise miss, and version detection to confirm what is really there.

Network Scanner vs Vulnerability Scanner

The two tools are often confused, and they do different jobs. A network scanner maps what exists: the hosts, ports, and services on a network. It answers the question of what is running and where.

A vulnerability scanner takes the next step. It checks the discovered services against a database of known flaws and reports which ones are exploitable. It answers the question of what is weak.

The line between them blurs in practice. Nmap's scripting engine adds basic vulnerability checks, and many vulnerability scanners start with a network scan to find their targets. A complete security program uses both a network scanner and a network vulnerability scanner: one to see the network, the other to judge its risk.

Common Network Scanning Tools

A handful of tools cover most network scanning work, from a single host to the entire internet.

• Nmap. The standard network scanner, deeply scriptable, used across security and IT for decades.
• Zenmap. The official graphical version of Nmap, which makes scans and network maps easier to run and read.
• Masscan. Built for speed, capable of scanning the entire internet's address space at high packet rates.
• Angry IP Scanner. A lightweight, cross-platform tool for fast host and port discovery on local networks.

Is Network Scanning Legal?

Scanning a network that an organization owns or manages is legal. Scanning a network without written permission from its owner can break the law, including the US Computer Fraud and Abuse Act and similar statutes elsewhere.

Authorization is the dividing line. Penetration testers work under a signed scope agreement that names the systems they are allowed to scan. This matters because attackers constantly scan for the same weaknesses: CISA lists internet-exposed open ports and misconfigured services among the most common ways they gain initial access.

Even authorized scans are coordinated. Aggressive scanning can slow a network or trip intrusion alarms, so teams agree on timing and intensity before they begin.

Running Network Scans Effectively

A few practices keep network scanning useful and safe.

1. Get authorization first. Confirm written permission and a defined scope before scanning any network that the organization does not own.
2. Inventory the full address range. Include the forgotten segments and subnets, since the unlisted device is the one left exposed.
3. Scan the perimeter and the internal network. The internet-facing view and the internal view reveal different risks, and both matter.
4. Schedule around load. Run heavy scans at times that avoid disrupting operations, and rescan whenever the network changes.
5. Turn open ports into risk checks. Feed discovered services into external vulnerability scanning to learn which exposures are actually dangerous.
6. Close needless exposure. Shut down or firewall unnecessary exposed services, especially risky ones like RDP and Telnet, so they leave the attack surface.

Watch the Ports Attackers Reach with CloudSEK BeVigil

Attackers scan the internet without pause, looking for one open port that leads somewhere. Every internet-facing service an organization runs is a door they find and try, and the forgotten ones are the doors that nobody guards.

CloudSEK BeVigil maps that exposure from the outside. Its network scanning finds an organization's internet-facing hosts, open ports, and running services the way an attacker sees them, then flags the risky ones: exposed remote access like RDP and SMB, open databases, admin panels, and outdated software carrying known CVEs.

This covers the perimeter, not the internal LAN that tools like Nmap scan from inside. What BeVigil adds is the outside view, folded into a wider external attack surface picture, so an exposed port is seen next to the domains, applications, and cloud assets around it. The service a team forgot it left public is the one this surfaces first.

Frequently Asked Questions

What does a network scanner do?

A network scanner discovers the devices on a network, the open ports on each device, and the services running behind those ports. It builds an inventory that security and IT teams use to defend the network.

What is the difference between port scanning and network scanning?

Network scanning is the broader task of discovering hosts, ports, and services across a network. Port scanning is one part of it, focused on finding which ports are open on a given host.

Is Nmap a network scanner?

Yes. Nmap, short for Network Mapper, is the most widely used network scanner. It discovers hosts and services by sending packets and analyzing the responses, and it adds service and operating system detection.

What is a SYN scan?

A SYN scan starts a connection to a port but never completes it, which is why it is called half-open. It is fast and less likely to be logged, though it needs elevated privileges to run.

Can a network scanner detect all devices on a network?

Not always. Firewalls, host settings, and devices configured to ignore probes can hide from a scan. Combining scan types and techniques improves coverage, but no single scan guarantees every device appears.

Is it legal to scan a network?

Scanning a network an organization owns is legal. Scanning a network it does not own, without written authorization, can violate laws like the US Computer Fraud and Abuse Act, so permission and a defined scope come first.