TCP Port Scan & IDS Detection Simulator

Target Profile

Scan rate 6 pps

Idle — press Start Scan

Detection

IDS alert level0%

Ports scanned

0 / 64

Open ports found

Hovered Port

Hover a port cube for details

unscanned SYN sent open closed filtered

How it works

This models a TCP SYN scan (nmap's -sS, the classic first step of the reconnaissance phase in penetration testing) against a 64-port sample of a target host:

SYN  →   open port  → SYN-ACK  (port is listening)
SYN  →  closed port →   RST    (port refuses connection)
SYN  →  filtered port →  (nothing, dropped by a firewall)

Each probe is a half-open handshake: the scanner sends a SYN and reads only the reply, never completing the third ACK. An open port answers SYN-ACK, a closed port answers RST, and a filtered port — behind a stateful firewall — simply drops the packet, which the scanner can only detect after a retransmit timeout expires.

The intrusion detection system here uses a simple rate heuristic, the same idea real network IDS/IPS products use: it compares your scan rate r (probes/second) against a quiet baseline r₀ and an alarm ceiling r₁:

alert(t+dt) = alert(t) + k·dt·clamp((r − r₀)/(r₁ − r₀), −1, 1)
r₀ ≈ 5 pps (background noise)   r₁ ≈ 30 pps (loud, easily caught)

Scan faster than r₀ and the alert level climbs toward 100%, at which point the connection gets blocked — this is exactly why real pentesters throttle SYN scans (--scan-delay, -T2) to stay under an IDS's detection threshold, trading speed for stealth. Scan slowly and the alert level decays back toward zero.

SYN probe SYN-ACK reply RST reply

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.