What does tcpwrapped mean in Nmap?

It means the TCP connection was accepted, but the other side closed it before sending any data, so Nmap could not identify a service. Something answered the connection, but it may be a firewall, load balancer or access control rather than a real program.

Is a tcpwrapped port open?

Technically the port accepted a connection, but that doesn't prove a usable service is behind it. On cloud platforms and CDNs, many or all ports can show as tcpwrapped because the edge accepts connections and drops anything it doesn't route.

Should I worry about tcpwrapped ports?

Usually not. Check your firewall or cloud rules for that port. If you don't expect anything there and the rule allows it from anywhere, close the rule. If a service is behind it and only allows certain addresses, that's working as intended.

Info Nmap result · tcpwrapped

What "tcpwrapped" means in a scan, and when to worry

By Stephane Meus, CEH, PenTest+ · Updated 17 October 2026 · 4 minute read

Short answer: "tcpwrapped" means something accepted the connection on that port, then closed it straight away without saying anything. Nmap couldn't identify a program. Most of the time it's a firewall, load balancer or cloud edge answering, not a service you need to fix.

What to do: check your firewall or cloud rules for that port. Close it if you don't expect anything there; otherwise leave it.

What Nmap is telling you

When Nmap checks a port, it first completes the TCP "handshake", then waits for the service to introduce itself or tries a few protocols to make it talk. With tcpwrapped, the handshake succeeded but the other side hung up before any data was exchanged. So the port isn't closed, but there's no evidence of a usable service behind it either.

The name comes from TCP Wrappers, an old Unix access-control tool that accepted connections and then dropped the ones from addresses not on its allow list. The same pattern now comes from many other places.

Common causes

Cloud platforms, CDNs and load balancers. Their edge accepts connections on many ports and resets anything it doesn't route. A scan that shows dozens or hundreds of tcpwrapped ports is almost always this.
Firewalls and intrusion prevention that complete the handshake and then cut off a source that looks like a scanner.
Access control on the service, such as an SSH or database server that only accepts certain IP addresses and drops everyone else. That's protection working as intended.
A service that expects a specific client and closes the connection when it sees anything else.

How it looks in your report your-server

22 Open port 22 (tcpwrapped) Nmap could not confirm anything is running Info

Many tcpwrapped ports are grouped into one row

FreshScanSentry rates tcpwrapped ports as Info and groups them when there are several, so they don't drown out real findings. When most ports answer like this, it also notes that other results may describe your provider's edge rather than your own server.

How to find out what's behind it

Check your rules first. Look at the firewall, router port forwarding, or cloud security group for that port. Is it allowed from anywhere? Do you know what it's for?
Try a deeper version scan from outside your network:
```
nmap -sV --version-intensity 9 -p 22 your-server
```
If a service now answers, it was probably shy rather than wrapped.
Scan from an allowed address. If the service only accepts your office IP, a scan from there will show what's really running.
Look on the server itself. On Linux, sudo ss -tlnp lists what's listening on each port. On Windows, netstat -ano.

Only scan systems you own or have written permission to test.

When to act

You don't recognise the port and your rules allow it from anywhere: remove the rule. Fewer open doors is always better.
Every port shows tcpwrapped: you're scanning a cloud or CDN edge. Nothing to fix there; scan your server's direct address if you have one.
It's a service you run with an allow list: leave it. That's the result you want outsiders to see.

Common questions

Is tcpwrapped a vulnerability?

No. It's an inconclusive result, which is why it's rated Info.

Why does my site show hundreds of open ports?

Your host's edge is accepting connections on all of them. They aren't real services. FreshScanSentry detects this and limits the detailed checks to the most common ports.

Can I make the port look closed instead?

Yes: have the firewall drop or reject the traffic instead of accepting it, or remove the rule entirely. Then the port shows as filtered or closed.

Sources: Nmap version detection technique · Nmap reference guide: service and version detection · Nmap port scanning basics