What Is Port Scanning?
In computer networking, a “port” is an abstract concept used to identify the network access point of a specific process or service running on a computer. Each port has a unique number ranging from 0 to 65535, and this number tells the computer which application should receive the incoming data.
You can think of a computer as a large building, with ports being the room numbers on the doors inside the building. Common “room numbers” include: HTTP web services typically use port 80, secure HTTPS web services use port 443, and the email service SMTP uses port 25. When a data packet arrives at a computer, the system accurately “delivers” it to the corresponding service or application based on the port number.
What Is Port Scanning?
Port scanning is the process of sending specific data packets to various ports on a target machine, then determining which ports are open or closed based on the responses returned. It is like someone knocking on the doors of a building one by one and judging which rooms are occupied and which are empty based on whether anyone answers.
Port scanning itself is a neutral technology—network administrators use it to check for system security vulnerabilities, penetration testers use it to assess a system’s defensive capabilities, and attackers may use it to look for entry points for intrusion.
How Can Websites Perform Port Scanning in a Browser?
You may find it strange: how can an ordinary web page scan the ports on your computer? This relies on certain mechanisms in how browsers work.
Time-Based Scanning Method
The earliest browser-based port scanning techniques relied on “timing attacks”. When a web page initiates a request to a certain port via XMLHttpRequest or fetch:
If the port is closed, the browser immediately receives a “connection refused” response, and the request fails quickly
If the port is open, the browser waits for the server to respond, which takes longer
By measuring the response time of the request, a website can infer which ports are open. However, this method is greatly affected by network fluctuations and has limited accuracy.
iframe-Based Scanning Method
Later, researchers discovered a more reliable technique, mainly targeting the Chrome browser. When Chrome attempts to connect to a closed port, the browser changes the page address to chrome-error://chromewebdata/. By taking advantage of this behavior:
The website creates a hidden iframe and loads the target address (such as http://127.0.0.1:8080)
If the port is closed, the iframe’s onload event is triggered twice (because the URL has changed)
If the port is open, the onload event is triggered only once
By counting how many times the onload event is triggered, the website can accurately determine whether the port is open.
WebSocket-Based Scanning Method
Some tools also use WebSocket connections to detect port status—a successful connection means the port is open, while a failed connection means the port is closed.
Why Do Websites Scan Your Ports?
1. Anti-Fraud and Bot Detection
Many large websites (including some government service websites and e-commerce platforms) use port scanning to detect whether a user is a real person. For example, certain anti-bot systems attempt to connect to 127.0.0.1:8888—the default proxy port for security testing tools such as Burp Suite. If this port is found to be open, the system may suspect that the visitor is a security researcher or an automated script, thereby triggering additional verification.
2. User Fingerprint Tracking
Research shows that the results of browser-based port scanning are unique enough to be used as a means of tracking users. By detecting locally open ports, websites can infer what software a user is running—for example, open ports 80 or 443 may indicate that the user is running a web server, while an open port 25 may indicate that a mail server is running. The combination of software installed by different users varies widely, forming a unique “software fingerprint”.
Even more concerning, studies have shown that even scanning for just one second can generate a highly unique port fingerprint. When port scanning results are combined with other fingerprinting techniques (such as Canvas fingerprinting, WebGL fingerprinting, etc.), tracking capabilities are further enhanced.
3. Detecting Intranet Devices
Most browsers allow public websites to send requests to private IP addresses (such as 127.0.0.1 or 192.168.x.x) by default. This means that a malicious website can not only scan the local ports on your computer, but also scan the ports of intranet devices such as your home router, smart TV, and network camera, looking for potentially vulnerable devices to attack.
How to Protect Against Browser-Based Port Scanning?
1. Use Browser Extensions
uBlock Origin: In the “Privacy” section of the settings, enable the “Block external intrusion into LAN” option
NoScript: Provides an option to block LAN access
Some dedicated protection plugins can also prevent websites from scanning local ports
2. Use Browsers with Built-In Protection
Some browsers already have built-in port scanning protection. For example, certain browsers actively block known malicious scanning scripts and restrict public websites’ access to local resources. Browsers such as Chrome are also gradually implementing the “Private Network Access” specification, which requires websites to obtain user permission before accessing local resources.
3. Use an Anti-Detect Browser
For users with higher privacy requirements, anti-detect browsers provide a more comprehensive protection solution. These tools can simulate different port states, preventing websites from obtaining real port scanning results and thereby effectively protecting the privacy of your device fingerprint.
Conclusion
Port scanning is a technology that can be used for legitimate security audits, but can also be abused to invade privacy. Understanding how it works and its potential risks is the first step toward protecting your network security. As an old saying in the security field goes: “Only when you know which of your ‘doors’ are open do you know which ones to close.”