Network exposure
The network exposure section shows every listening port on the machine and its exposure level.
Exposure table
Each row in the table represents a listening port:
| Column | Meaning |
|---|---|
| Port | TCP port number |
| Service | Well-known service name (SSH, HTTP, PostgreSQL, ...) |
| Process | The process bound to this port |
| Bind scope | localhost, LAN, or WAN |
| Exposure | WAN (internet-exposed) or LAN (internal only) |
| Firewall | Whether a firewall rule blocks or allows traffic |
| WAN probe | Whether the port is actually reachable from the internet |
WAN probe
When the machine has a public IP, Ghostpsy runs an external probe to check which ports are actually reachable from the internet. This is more reliable than firewall rule analysis alone — it tells you what an attacker would see.
| Probe result | Meaning |
|---|---|
| Open | Port is reachable from the internet |
| Closed | Port is blocked by firewall or not responding |
| N/A | No public IP or probe not available |
Firewall posture badge
The badge at the top summarizes the overall network posture:
- No internet-exposed listeners — all ports are localhost or LAN only
- All probed ports closed or filtered — firewall is blocking internet access
- N ports reachable from public IP — some ports are exposed to the internet
- No public IP — machine has no public-facing interface