TCP Port Checker

Server assisted New Internet & Network

Opens one to three TCP connections to the port you choose — HTTPS, SSH, a database or any port from 1 to 65535 — from the Cloudflare edge that runs the Mutqan server, closes each as soon as it is accepted and reports whether the port is open, refused or silently filtered. Hosts served through Cloudflare cannot be tested this way and port 25 is not allowed; the page explains both.

Privacy: The Mutqan server sends the small, fixed test requests described on this page to the host you name, and nothing is stored. Use it only against systems you are authorised to test.

What does it mean when a TCP port is open, closed or filtered?

A TCP connection starts with a three-way handshake (RFC 9293). If the host answers the opening SYN with a SYN-ACK, a program is listening and the port is open; if it answers with a reset, the host is reachable but nothing listens, so the port is closed; if nothing comes back before a timeout, a firewall is dropping the packets or the host is down, which is called filtered. An open port proves reachability, not that the service behind it works.

Security note: Database, cache and remote-desktop ports reachable from the public Internet are a frequent cause of breaches; keep them behind a firewall allow-list or a VPN, and only test hosts you are authorised to test.

How to use TCP Port Checker

  1. Enter the host name or IP address; a pasted URL is reduced to its host, and a port written after the host (example.com:8443) is tested unless you fill in Other port.
  2. Choose the service from the Port list, or type any port number in Other port.
  3. Optionally raise the attempts to 2 or 3 to see whether the result is stable, then press Check port.
  4. Read the port state first, then the attempts table and the explanation underneath.

TCP Port Checker features

  • Tests any TCP port from 1 to 65535, with a list of common services: HTTPS, SSH, mail submission, IMAPS, DNS over TCP and TLS, MySQL, PostgreSQL, Redis, Remote Desktop and more
  • One to three connection attempts, each with its own 5-second deadline and connect time
  • A plain verdict: open, closed (refused), no answer (filtered) or not reachable, with what each means for the host
  • A warning when a database or remote-desktop port is reachable from the public Internet
  • Honest refusals: port 25 and hosts served through Cloudflare are explained instead of being reported as closed
  • Attempts table downloadable as CSV

Inputs and outputs

Inputs

  • Host name or IP address (public targets only).
  • Port: a common service from the list or any number from 1 to 65535 except 25; connection attempts from 1 to 3.

Outputs

  • Result: port state, port and its customary service, fastest connection time and the address tested with its IP version.
  • Connection attempts: the outcome of each attempt (connected, refused, timeout, unreachable) and its time in milliseconds.
  • An explanation of the state and details: host, resolved address, DNS resolution time and where the test ran.

TCP Port Checker example

Is SSH reachable on github.com? (values vary)

Input:

Host: github.com · Port: SSH (22) · Connection attempts: 2

Output:

Port state: Open · Port: 22 (SSH) · Fastest connection: 38 ms · Address tested: 140.82.121.4 (IPv4)
# | Result | Time (ms)
1 | connected | 41
2 | connected | 38
Finding: Port 22 accepted a TCP connection from the Cloudflare edge: something is listening there and no firewall blocked this path. The check does not show which software answers or whether it works correctly.

How to read the TCP Port Checker results

Open: a TCP handshake completed, so the port is reachable from the public Internet. Whether the service behind it works is a separate question.

Closed (refused): the host replied with a reset. The host is up; nothing listens on that port, or a firewall rejects connections actively.

No answer (filtered): nothing came back within 5 seconds. Usually a firewall drops the packets; it can also mean the host is down.

Not reachable: the connection failed and the platform did not say why. A reset, a dropped connection and a refusal it does not name all end up here, so the port may simply be closed; run the check again and compare with a port the host certainly serves.

Mixed attempts (some connected, some failed) point at intermittent reachability: packet loss, a load balancer with an unhealthy member or connection rate limiting.

When to use TCP Port Checker

  • Confirming that a firewall or cloud security-group change opened, or closed, the port you meant to.
  • Checking that a database, Redis or Remote Desktop port is not exposed to the public Internet.
  • Verifying that a mail server accepts submissions on 587 or 465 before configuring a client.
  • Telling a closed port from a filtered one when a service cannot be reached from outside.

Troubleshooting

  • "This host is served through Cloudflare": the name resolves to Cloudflare addresses, which the platform does not let a Worker connect to. Use the Ping Test in TCP connect mode, which runs from Globalping probes, or test from your own machine.
  • Port 25 is refused before any test: the platform forbids outbound SMTP. Test 587 or 465, or test 25 from a server you control.
  • "has no A or AAAA record": the name does not resolve. Check its DNS records first.
  • A rate-limit message: the check can run 20 times per minute per visitor; wait a moment and run it again.

Frequently asked questions about TCP Port Checker

Why can this tool not test sites that use Cloudflare?

The check runs on Cloudflare Workers, and the platform does not let a Worker open raw TCP connections to Cloudflare’s own address ranges. A host whose name resolves into those ranges, which covers a large share of websites, gets a clear "served through Cloudflare" message instead of a result. Use the Ping Test in TCP connect mode, which runs from Globalping probes, for those hosts.

Why is port 25 not allowed?

Cloudflare Workers may not open outbound connections to port 25, the SMTP port mail servers use between each other, which keeps the platform from being used to send spam. Test the submission ports 587 (STARTTLS) or 465 (implicit TLS), or check port 25 from a server you control.

What is the difference between closed and filtered?

Closed (refused) means the host answered with a TCP reset: it is reachable, but nothing listens on that port. Filtered means no answer arrived within 5 seconds: a firewall dropped the connection attempt silently, or the host is down.

Does an open port mean my service works?

No. Open only means the TCP handshake completed. The check sends no data, so it cannot tell whether the web server, database or mail server behind the port answers correctly; use a protocol-level check, such as the API Health Checker for HTTP, for that.

Is this a port scanner?

No. Each run tests one port of one host with at most three connection attempts, and one visitor can run it 20 times per minute. Only test hosts you own or are allowed to test.

Will the result match what I see from my office network?

Not necessarily. The connection comes from the Cloudflare edge that served your request, usually the one nearest to you, over the public Internet. A firewall that only admits certain source addresses, or a service reachable only inside a VPN, looks different from your own network.

Technical notes

The check performs the TCP three-way handshake of RFC 9293: SYN out, SYN-ACK back means a listener accepted the connection; a RST back means the port is closed; silence until the deadline means the packets were dropped. The socket is closed immediately and no application data is sent.

The Mutqan server resolves the name through DNS over HTTPS first and connects only if every address is public. Cloudflare Workers block outbound sockets to Cloudflare’s own IP ranges and to port 25, so those cases are answered with an explanation (503 PLATFORM_LIMIT, or a refusal before any connection) rather than a false "closed".

Port numbers and the services usually behind them are registered by IANA (RFC 6335); a listener can run any software on any port, so the service name shown is the customary one, not a detection.

Limitations and methodology

Measured from the Cloudflare edge that served your request (usually the one nearest to you), not from your computer or your office network; firewalls that allow only certain source addresses give a different answer there.

Only TCP is tested. UDP services such as classic DNS on 53/udp or QUIC cannot be checked with a plain connection.

Hosts whose addresses are in Cloudflare’s ranges and port 25 cannot be tested at all, by platform rule.

One port per run and at most three attempts: this is a reachability check, not a scan.

The platform that opens the connection does not always say why one failed. A refusal it does not name is reported as Not reachable, so a closed port can appear as Not reachable instead of Closed (refused).

Security and privacy

The host and port are sent to the Mutqan server, which opens the connection from the Cloudflare edge and stores nothing. The target sees a connection from a Cloudflare address, not from you.

Only test hosts you own or are authorised to test.

References