 nmap, nessus) support both.A service scan is preferable to referring to a port list, as it can identify services running on non-standard ports, which is common in practice.Service scanners work by sending some probe data to the port, and monitoring the response.