Packet Eagle: Port Scan & Subdomain Discovery for Asset Inventory

Port Scanning and Subdomain Discovery

You have a host or a domain name and want to know what it exposes to the outside? Each approach has its own use: port scanning actively probes which ports a host has open and what services run on them; subdomain discovery reads only public data, never interacts with the target, and still digs out the subdomains under a domain.

1. Port Scanning: Which Ports a Host Has Open and What Services Run on Them

Enter a hostname or IP and it quickly scans out its open TCP ports, showing progress and "N open found" in real time. Each open port has three columns:

• Port number.
• Service name: first guessed from the port, then corrected against the captured Banner — so even if SSH, redis, mysql and the like run on non-standard ports, they are still recognized.
• Banner: the captured service greeting; for HTTP ports, the status line and Server header.

Scan range has three choices: common ports (the default, a curated set of high-frequency ports), all ports (1–65535), or custom (e.g. 80,443,8000-8100). Banner grabbing can be toggled — with it off, the service name is still derived from the port, but no greeting is captured and no correction is made from it. The open-port list can be sorted by port number. Works out of the box, no extra drivers or privileges required.

Non-standard ports are still recognized: run SSH, redis, mysql and the like on an obscure port and an ordinary scanner that only "guesses the service from the port number" gets it wrong — here the captured Banner is used for correction, so the real service is identified no matter which port it runs on.

2. Subdomain Discovery: Passively Map Out a Domain's Subdomains

Enter a domain name and it aggregates several public intelligence sources queried in parallel, listing the subdomains under it. Sources are shown in two categories (each with a hit count): certificate transparency logs and passive DNS. Results are automatically deduplicated and sorted, with real-time filtering and one-click copy all. If a source is temporarily unavailable or rate-limited, it won't drag down the whole run — the remaining sources still return results, each annotated with its hit count.

Reads only public data, never interacts with the target: throughout, it only queries public datasets and sends no requests to the target domain or its servers. This is the fundamental difference from "active scanning".

3. Active vs. Passive: How They Work Together

	Port scanning	Subdomain discovery
Target	A host / IP	A domain name
Method	Actively probe the target's ports	Passively query public intelligence
Interacts with target	Yes (connects directly to its ports)	No (reads only public data)
What you get	Open ports + services + Banners	A list of externally exposed subdomains

First use subdomain discovery to read public data and spread out a domain's asset surface, then use port scanning on the hosts you pick out to verify which services are open — passive mapping of the surface, active verification of the points; run the pair and your external exposure becomes clear.

4. When to Use It

• To map out the service surface a device / server exposes: which ports are open, roughly what runs on them, and what the Banner says.
• To have a domain name and want to inventory the subdomains it exposes using public data alone.
• For asset inventory and sorting out external exposure: passively mine subdomains + actively verify ports, the two complementing each other.