Port Exposure Summary Checker

A port inventory becomes useful when each listener can be tied to an approved purpose, reachable scope, and accountable owner. A bare list of port numbers cannot show whether an exposure is intended, protected, or even reachable from the internet.

Public exposure is the intersection of two facts: a service appears open in the supplied evidence, and its row is marked as internet-facing under the organization’s vocabulary. Firewall exports, cloud security rules, scanner results, and service registers express those facts differently, so normalization is necessary before prioritization.

Port numbers are clues, not proof of the running application. A service can move to a nonstandard port, share a listener, sit behind network address translation, or be blocked farther upstream. Risk therefore comes from the service, controls, exposure path, and business need together.

Prioritization should guide review rather than replace it. Unexpected management and data-service listeners deserve prompt attention, but an approved public service still needs authentication, patching, logging, source restrictions where appropriate, and evidence that direct origin access is not broader than intended.

How to Use This Tool:

Start from one firewall, scanner, or cloud-rule inventory and align the policy fields with the wording used in that source.

1. Paste CSV-style exposure rows or load a text file. A header may use common aliases for host, zone, protocol, port, state, owner, and justification; headerless rows use that positional order.
2. Choose Conservative review when incomplete public-listener evidence should begin at Medium. Choose Standard review when an otherwise unmatched public listener may begin at Low.
3. Edit Internet-facing markers so they match the source vocabulary, such as public, dmz, or 0.0.0.0/0. Remove broad words that could match unrelated host, owner, or note text.
4. Add organization-specific high-risk ports or ranges. These supplement the built-in remote-access, management, and data-service rules.
5. Correct malformed ports, then work through public entries at Medium or higher. Confirm each listener with the authoritative firewall rule, cloud policy, or an approved external scan before remediation.

Interpreting Results:

The review queue contains public-open entries rated Medium, High, or Critical. A higher entry score means a stronger match to the local triage rules, not a measured probability of compromise.

• Critical includes all-port rules and selected direct-exposure services such as Telnet, SMB/NetBIOS, RDP, and an unencrypted Docker API.
• High includes selected remote administration, file transfer, telemetry, console, and data-service listeners, plus local policy matches.
• Medium and Low still require service identity, ownership, ingress scope, and approval checks.
• None means the row was not classified as public open; it does not prove the service is unreachable.

Technical Details:

The analysis is a repository-authored triage model, not an official vulnerability score. It parses each source row, expands supported port fields, identifies open and public evidence, applies the most severe matching rule, and then rolls public entries up by host.

Transformation Core

CSV rows may include a recognized header or use the positional order host, zone, protocol, port, state, owner, and justification. Port values can be numeric, named services, ranges, or multiple semicolon/pipe-separated tokens. A blank port becomes an all-port range from 0 through 65,535.

A row is public when any configured marker appears as a case-insensitive substring of the combined host, zone, owner, and justification text. This flexible match supports varied exports, but it can also create false positives when a short marker appears inside unrelated text.

Rule Core

A public-open entry starts at Medium under conservative review and Low under standard review. The highest matching built-in, local, or management-interface rule then wins.

Any overlap with the local high-risk list raises an entry to at least High. Web ports 80, 443, 8080, and 8443 also rise to High when the row text contains a management indicator such as admin, console, router, firewall, iLO, iDRAC, or BMC.

Formula Core

Entry scores convert severity into a sortable number and add a conservative missing-context penalty. The entry score is capped at 100.

B(v) is 0 for None, 15 for Low, 40 for Medium, 70 for High, and 100 for Critical. c means conservative review, m means either owner or justification is missing on a public-open row, and I contributes 1 when all conditions are true. Host scores are the uncapped sum of their public entry scores, so they rank cleanup workload rather than represent a percentage.

Rows sort by severity, then entry score, host, and listener. Host rollups sort by summed score. Input is limited to 200,000 characters; comments beginning with # and blank lines are ignored.

Limitations and Privacy Notes:

Inventory text and uploaded files are processed in the browser. No host is scanned and no reachability test is performed.

• Marker matches and port-to-service assumptions can be wrong; verify the original rule and the process actually listening.
• A closed or internal label may be stale, and upstream NAT or firewall policy may change the true exposure.
• Only scan systems you own or have explicit permission to test. Keep the external vantage point, target, time, and scope with the evidence.

Worked Examples:

References:

• Internet Exposure Reduction Guidance, Cybersecurity and Infrastructure Security Agency, June 4, 2025.
• Service Name and Transport Protocol Port Number Registry, Internet Assigned Numbers Authority.
• How to review internet-facing host exposure, Simplified Guide.