Port Checker

Check whether a TCP port accepts connections on a public host, from outside your own network. One port, a range, or the twenty ports worth checking first.

Overview

The check is a TCP connect from the server, not from your browser. That is the useful part: it tells you what the rest of the internet sees, which is the question you are actually asking when a firewall rule does not seem to work.

Only TCP is checked. A closed result means the connection was refused or timed out; the two are not distinguished, because from outside they usually are not distinguishable in any useful way.

Web interface

Three tabs. Single Port takes a host and one port, with a timeout of 3 to 30 seconds. Port Range takes a start and end port, capped at 100 ports per scan. Common Ports checks a fixed set of twenty without asking you to name them:

21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 110 POP3, 143 IMAP, 443 HTTPS, 993 IMAPS, 995 POP3S, 1433 MSSQL, 3306 MySQL, 3389 RDP, 5432 PostgreSQL, 5900 VNC, 6379 Redis, 8080 HTTP-Alt, 8443 HTTPS-Alt and 27017 MongoDB.

API

The first returns JSON, the second plain text: the single word Open or Closed, which is what you want in a shell conditional.

$ curl -s "https://api.troubleshooting.tools/v1/lookup/port/json/example.com/443" | jq .

# Plain text, for a shell conditional
$ test "$(curl -s https://api.troubleshooting.tools/v1/lookup/port/example.com/443)" = Open && echo reachable

# A range, and the common set
$ curl -s "https://api.troubleshooting.tools/v1/lookup/port/json/example.com/80-90?timeout=2"
$ curl -s "https://api.troubleshooting.tools/v1/lookup/port/json/example.com/common"

{
  "host": "example.com",
  "resolved_ip": "93.184.215.14",
  "port": 443,
  "is_open": true,
  "response_time": 24.7,
  "service": "HTTPS",
  "status": "open"
}

A range or common-port scan returns open_ports and closed_ports arrays plus open_count, closed_count, total_ports and scan_duration. Entries in open_ports carry port, service and response_time.

POST interface

The web page uses a JSON POST endpoint that exposes two things the GET routes do not: checking one port across many hosts, and a longer timeout for single checks. It is available if you need it.

{ "action": "check_single_port",    "host": "example.com", "port": 443, "timeout": 5 }
{ "action": "check_port_range",     "host": "example.com", "start_port": 80, "end_port": 90, "timeout": 3 }
{ "action": "check_common_ports",   "host": "example.com", "timeout": 3 }
{ "action": "check_multiple_hosts", "hosts": ["a.example", "b.example"], "port": 443, "timeout": 5 }

Responses are wrapped: {"success": true, "data": {...}, "timestamp": ...}, or {"success": false, "error": "..."} with HTTP 400. Single checks accept a timeout up to 30 seconds here; ranges and multi-host checks stay capped at 10. At most 50 hosts per multi-host request.

Errors

A closed port is a successful result, not an error: HTTP 200 with is_open: false.

Limits

At most 100 ports per range scan, and a scan is abandoned after 20 seconds of wall-clock time regardless of how many ports remain. A truncated scan reports what it managed to check and adds a warning field, so a short result is not necessarily a complete one. The common-ports and multiple-hosts forms are stopped the same way; neither had a limit before.

The longest a single check waits is 5 seconds, and 2 inside a scan. A larger timeout is accepted and reduced to those rather than refused. Ninety five per cent of the checks in our logs that found a port open were answered within 447 ms, so a longer wait buys a more confident "filtered" and nothing else.

Two checks at a time per address, three across the whole site, and 240 ports per address in ten minutes. Ports, not requests: a single check costs one and a scan costs ten, because a hundred ports is not one request worth of work. Over your share the answer is 429 with Retry-After; with every slot busy it is 503. Above that the edge allows 10 requests per second per IP on this endpoint, HTTP 429 over the limit.

Monitoring your own host through this is a fair use of it and the numbers leave room for it: one check a minute against twenty endpoints stays inside them.

Privacy

Checked hosts and ports appear in server logs for operational purposes and are not sold or shared. The target host sees a connection from this service, not from you. That is the entire point, but worth knowing before you check a host that alerts on connections.