TCP port checker
Test TCP port availability for any host, single or batch.
About this tool
A port check is the simplest "is the service actually listening" question you can ask the public internet. Our port checker opens a real TCP connection from our Frankfurt server to the host and ports you specify, with a 3-second timeout per port. If the handshake completes, the port is open; if the host actively refuses, the port is closed; if there is silence, the port is filtered — usually a firewall dropping the SYN packet without reply.
You can probe up to 100 ports per run — a single port (80), a comma-separated list (80,443,22), or a small range (20-25). Each result shows the port number, our verdict, the time the dial took, and a service-name guess based on IANA-style assignments (22 → ssh, 5432 → postgresql, etc.). The verdict updates row by row as we dial — no need to wait for the slowest port to learn about the fast ones.
What you can do with it
- Verify a deploy without SSH-ing in. If your service should be on port 5432 and the checker says
filtered, the listener never bound or the firewall is in the way — different fixes, but the port check tells you which. - Audit external exposure. Run the popular-ports preset against your server. Anything
openthat you do not recognise is your homework.closedandfilteredare both fine for the public internet. - Diagnose "the firewall must be wrong" arguments.
filteredon every port from us — but reachable from your laptop — is concrete evidence the host's firewall has a source-IP allowlist, not a port problem.
Reading the result
"Open" is unambiguous: a TCP listener accepted us. "Closed" means the host is alive and the kernel sentRST; the port is not in use. "Filtered" is the interesting case: a firewall dropped our packet without reply, the route is broken, or the listener is overloaded. The dial-time column helps disambiguate — open and closed answer in single-digit milliseconds; filtered always sits at the full 3-second timeout. Many UDP-based services (DNS on 53, SNMP on 161) accept TCP too, but if they do not, expect filtered — that is normal, not a bug.
Frequently asked questions
What is the difference between "closed" and "filtered"?
RST — the host is reachable, no listener is on that port. Filtered means we got nothing back within 3 seconds — usually a firewall dropping our SYN, occasionally an overloaded host. Both are common; only "open" guarantees a real service is listening.
Why is everything "filtered" from your server but works for me?
Can I scan private IPs or my own LAN?
nmap or a similar local tool. Public services should only probe the public internet.
How many ports can I check in one run?
1-100 counts as 100; lists are deduplicated before counting. Inputs above the limit return a 422 — split your scan into batches. We picked 100 because the worst case (every port filtered) takes 100 × 3 s = 5 minutes; allowing more would tie up the worker beyond reasonable response time.
Why is the "service" name a guess?
22 → ssh, 443 → https) so the result is readable for the common case, but if someone is running PostgreSQL on port 80 it will still say "http". To learn what is really speaking on a port, our Server Check tool grabs the actual banner from the handshake.