Ping a Port — TCP Port Check

What a TCP ping actually is

There is no such thing as pinging a port, strictly speaking — ping is ICMP and ICMP has no ports. What this does is attempt one TCP connection and report what came back. In practice that is more useful than ICMP for almost every real question, because a service either accepts connections or it does not, and that is usually what you wanted to know.

The three answers

Open means the three-way handshake completed: something is listening and accepting connections from outside. This is the strongest reachability signal there is. It proves the host is up, the route works, and nothing in between is dropping the traffic.

Closed means the host answered — it actively refused the connection with a TCP reset — but nothing is listening on that port. This is far more informative than it sounds. A refusal proves the machine is up and reachable, so if you were trying to work out whether a host that ignores ping is alive, a closed port has just answered that for you. The service you were looking for is simply not running, or is bound to a different port or a different interface.

Filtered means nothing came back at all: no connection, and no refusal either. That silence is what a firewall configured to drop rather than reject looks like. It is also exactly what a host that is switched off looks like, and TCP on its own cannot tell the two apart. To narrow it down, try a port the host is likely to answer on — 443 is the usual choice — and see whether that comes back closed or open. If it does, the host is up and your port is firewalled.

Ports worth knowing

• 80 and 443 — HTTP and HTTPS. Almost anything on the public internet answers on at least one.
• 22 — SSH. Frequently firewalled to specific source addresses, so filtered here does not mean it is unavailable to you.
• 25, 465, 587 — mail. Many consumer ISPs block outbound 25 entirely.
• 3306, 5432, 6379, 27017 — MySQL, PostgreSQL, Redis and MongoDB. If one of these is open to the public internet, that is a finding in itself and usually not a good one.

One port at a time, on purpose

Pingr does not accept port ranges, port lists, or a “scan common ports” button, and it does not walk sequentially through a host. Those features would make this a port scanner pointed at third parties from a shared address, which is both a good way to lose a server and a bad thing to build. If you need to scan a network you control, run nmap from inside it — you will get better results and nobody will file an abuse report about it.

Testing several different ports on the same host in quick succession will trigger a verification prompt. That is the scanning tripwire doing its job; solve it and carry on.

What this tool will not test

Private addresses, loopback, link-local ranges and cloud metadata endpoints are refused, and a hostname that resolves to any of them is refused too. You cannot use Pingr to probe your own internal network from the outside, or anybody else’s.

For a full picture of a website rather than a single port, Website Ping runs DNS, TCP, TLS and HTTP together and tells you which layer failed.