Port Checker

Check whether a TCP port accepts connections on a public host, from outside your own network. One port, a range, or the twenty ports worth checking first.

Overview

The check is a TCP connect from the server, not from your browser. That is the useful part: it tells you what the rest of the internet sees, which is the question you are actually asking when a firewall rule does not seem to work.

Only TCP is checked. A closed result means the connection was refused or timed out; the two are not distinguished, because from outside they usually are not distinguishable in any useful way.

Web interface

Three tabs. Single Port takes a host and one port, with a timeout of 3 to 30 seconds. Port Range takes a start and end port, capped at 100 ports per scan. Common Ports checks a fixed set of twenty without asking you to name them:

21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 110 POP3, 143 IMAP, 443 HTTPS, 993 IMAPS, 995 POP3S, 1433 MSSQL, 3306 MySQL, 3389 RDP, 5432 PostgreSQL, 5900 VNC, 6379 Redis, 8080 HTTP-Alt, 8443 HTTPS-Alt and 27017 MongoDB.

API

The first returns JSON, the second plain text: the single word Open or Closed, which is what you want in a shell conditional.

$ curl -s "https://api.troubleshooting.tools/v1/lookup/port/json/example.com/443" | jq .

# Plain text, for a shell conditional
$ test "$(curl -s https://api.troubleshooting.tools/v1/lookup/port/example.com/443)" = Open && echo reachable

# A range, and the common set
$ curl -s "https://api.troubleshooting.tools/v1/lookup/port/json/example.com/80-90?timeout=2"
$ curl -s "https://api.troubleshooting.tools/v1/lookup/port/json/example.com/common"

{
  "host": "example.com",
  "resolved_ip": "93.184.215.14",
  "port": 443,
  "is_open": true,
  "response_time": 24.7,
  "service": "HTTPS",
  "status": "open"
}

A range or common-port scan returns open_ports and closed_ports arrays plus open_count, closed_count, total_ports and scan_duration. Entries in open_ports carry port, service and response_time.

POST interface

The web page uses a JSON POST endpoint that exposes two things the GET routes do not: checking one port across many hosts, and a longer timeout for single checks. It is available if you need it.

{ "action": "check_single_port",    "host": "example.com", "port": 443, "timeout": 5 }
{ "action": "check_port_range",     "host": "example.com", "start_port": 80, "end_port": 90, "timeout": 3 }
{ "action": "check_common_ports",   "host": "example.com", "timeout": 3 }
{ "action": "check_multiple_hosts", "hosts": ["a.example", "b.example"], "port": 443, "timeout": 5 }

Responses are wrapped: {"success": true, "data": {...}, "timestamp": ...}, or {"success": false, "error": "..."} with HTTP 400. Single checks accept a timeout up to 30 seconds here; ranges and multi-host checks stay capped at 10. At most 50 hosts per multi-host request.

Errors

A closed port is a successful result, not an error: HTTP 200 with is_open: false.

Limits

At most 100 ports per range scan, and a scan is abandoned after 60 seconds of wall-clock time regardless of how many ports remain. A truncated scan reports what it managed to check and adds a warning field, so a short result is not necessarily a complete one.

The edge allows 50 requests per second per IP, burst 100, HTTP 429 over the limit. Scanning wide ranges by chaining requests will hit that quickly; the range form exists so you do not have to.

Privacy

Checked hosts and ports appear in server logs for operational purposes and are not sold or shared. The target host sees a connection from this service, not from you. That is the entire point, but worth knowing before you check a host that alerts on connections.