Nmap reports a port as open when an application accepts connections, closed when the port answers but nothing listens, and filtered when a packet filter stops its probes. A UDP port that never replies is open|filtered, because Nmap cannot tell which. By default Nmap first checks whether hosts are up and scans only the 1,000 most common ports, so a firewall or an unusual port can hide a service.
The port states
The Nmap reference guide lists six states. Open: an application is accepting connections or datagrams on the port. Closed: the port is reachable and responds to probes, but no application listens on it. Filtered: packet filtering stops the probes, so Nmap cannot tell whether the port is open.
Unfiltered: the port is reachable but Nmap cannot tell open from closed; only the ACK scan uses this state. Open|filtered: Nmap cannot tell open from filtered, which happens with scan types where open ports give no response. Closed|filtered: Nmap cannot tell closed from filtered.
Filters that drop probes silently are far more common than ones that send an ICMP error. Nmap then has to retry several times, which slows the scan.
Why UDP scans are ambiguous
A UDP scan sends a UDP packet to each port. An ICMP port unreachable (type 3, code 3) marks the port closed. Other ICMP unreachable codes mark it filtered. A UDP reply proves it open.
If no response comes back after retransmissions, the port is open|filtered: it may be open with a silent service, or a filter may be dropping the probe. Version detection (-sV) can help tell them apart.
Host discovery and port ranges
By default Nmap does host discovery first and port scans only the hosts it finds up. With -sn, the default discovery probes are an ICMP echo request, a TCP SYN to port 443, a TCP ACK to port 80 and an ICMP timestamp request. On a local Ethernet network, a privileged user's scan uses ARP instead.
If a firewall drops all of those probes, every host looks down and is never scanned. -Pn skips host discovery and runs the requested scan against every target address.
By default Nmap scans the most common 1,000 ports for each protocol. A service on an unusual high port is never probed. -p sets the ports, and -p- scans 1 through 65535.
Where the exam catches people
Believing closed means a firewall blocked the port: closed means the host answered and nothing is listening; a blocked probe is filtered.
Believing silence from a UDP port means it is closed: a closed UDP port normally sends ICMP port unreachable; silence is open|filtered.
Believing a default Nmap scan checks every port: it scans the 1,000 most common ports per protocol unless -p says otherwise.
Believing hosts reported down are offline: a firewall can drop the discovery probes; -Pn scans them anyway.