Network diagnostics
Free port checking and network troubleshooting
Test a TCP port on your current IP, then follow the checks for your result.
We check this IP’s port
from outside your network.
- Shared requests used
- —
- Checks remaining
- —
- TCP connection timeout
- 3 s
Request allowance resets in —
Checking the allowance for this IP.
Loading usage…
How usage is counted
The default is 30 network-tool requests per public IP per hour. An administrator may temporarily change or waive it; the current allowance is shown above. Accepted requests count even if they fail.
The allowance resets one hour after the first request. Remaining checks are the smaller of the request allowance and target protection allowance. Shared server limits may also require a short wait.
The timeout is the wait for a TCP connection. Total response time, including server processing and network communication, may be longer.
Common ports
No sign-in · Your IP only · Ports 1–65535
Next check Try the actual service URL. For websites, continue with the HTTP/certificate tools and the OPEN case below.
Diagnosis for this result
A TCP connection from PPORT to this IP and port succeeded. This does not verify HTTP/HTTPS responses, login or security.
Possible causes
Another program, router or proxy may accept the connection. Application failure can involve the protocol, TLS or backend.
Check in this order
- Use the OS commands below to inspect LISTEN, the binding address and PID. No output means checking the application, port and viewing permissions first.
- Connect using the correct protocol and domain; inspect HTTP status, certificates, proxy and application logs.
Related guides and tools
Next check Start with the internal port, LISTEN address and PID on the service host.
Diagnosis for this result
The TCP connection attempt was refused. This test cannot identify which device or point in the path refused it.
Possible causes
There may be no listener, forwarding may use the wrong internal port, or a device on the path may explicitly reject connections.
Check in this order
- On the service host, check that the application is running and identify its internal TCP port.
- Use the OS commands below to inspect LISTEN, the binding address and PID. No output means checking the application, port and viewing permissions first.
- From another LAN device, connect to the private server IP and internal port. If that fails, check binding, the host firewall and the LAN path first.
- Inspect the active firewall profile, allowed port, source scope and block logs. Do not switch off the entire firewall.
- Check that the router maps the external TCP port to the current internal server IP and port.
- Record one verified change, time, IP and port, then repeat the external test once within your allowance. Do not run automatic retries.
Related guides and tools
Next check Narrow it down: application → LISTEN → LAN → firewall → forwarding → upstream NAT → external retest.
Diagnosis for this result
The connection did not complete within the displayed TCP timeout. This does not identify a particular firewall or router as the cause.
Possible causes
Packet drops, an offline host, incorrect routing/forwarding, NAT or a temporary connection problem are all possible.
Check in this order
- On the service host, check that the application is running and identify its internal TCP port.
- Use the OS commands below to inspect LISTEN, the binding address and PID. No output means checking the application, port and viewing permissions first.
- From another LAN device, connect to the private server IP and internal port. If that fails, check binding, the host firewall and the LAN path first.
- Inspect the active firewall profile, allowed port, source scope and block logs. Do not switch off the entire firewall.
- Check that the router maps the external TCP port to the current internal server IP and port.
- Compare the router WAN IP with the displayed public IP; check upstream routers and provider NAT. Treat IPv4 and IPv6 separately.
- Record one verified change, time, IP and port, then repeat the external test once within your allowance. Do not run automatic retries.
Related guides and tools
Next check Check the target IP, IP version and internet connection, then compare local connectivity and the upstream path.
Diagnosis for this result
The connection attempt returned a host or network unreachable error. It does not locate the failing segment.
Possible causes
Routing on either side, connection failure, an address change or an intermediate device response may be involved. This is not proof of CGNAT.
Check in this order
- Check the displayed target IP, internet connection and VPN. If the error persists after a later retry, send the time and result to the operator, without passwords or tokens.
- Use the OS commands below to inspect LISTEN, the binding address and PID. No output means checking the application, port and viewing permissions first.
- From another LAN device, connect to the private server IP and internal port. If that fails, check binding, the host firewall and the LAN path first.
- Compare the router WAN IP with the displayed public IP; check upstream routers and provider NAT. Treat IPv4 and IPv6 separately.
- Record one verified change, time, IP and port, then repeat the external test once within your allowance. Do not run automatic retries.
Related guides and tools
Next check The result is inconclusive. Check local listening, then retry once later.
Diagnosis for this result
An unclassified connection error prevented a determination of open or closed.
Possible causes
A temporary issue in the PPORT runtime or network may be involved. Do not use this result as evidence of a blocked port.
Check in this order
- Check the displayed target IP, internet connection and VPN. If the error persists after a later retry, send the time and result to the operator, without passwords or tokens.
- Use the OS commands below to inspect LISTEN, the binding address and PID. No output means checking the application, port and viewing permissions first.
- Record one verified change, time, IP and port, then repeat the external test once within your allowance. Do not run automatic retries.
Related guides and tools
If the result is CLOSED or TIMEOUT, first check that the program is listening on the device that runs the service. Commands for each operating system and how to read their output are on the port check help page.
Further reading
More tools for your next step
From DNS records to data conversion, find the tool you need next.
How we handle your input
Subnet calculations and text conversion or generation run in your browser. Port, DNS, WHOIS, TLS, and HTTP lookups run on the PPORT server, using the port number or lookup address needed for the request.
Lookup addresses are used to operate the service and prevent abuse. See our Privacy policy.