A TCP port check answers a narrower question than whether a server is up: it determines whether this exact port, on this exact host, is accepting connections right now. This distinction is significant because a server can be fully healthy while one specific port is closed, filtered, or blocked somewhere along the network path.
How a Port Check Works
Checking a port means attempting a full TCP connection — the standard three-way SYN, SYN-ACK, ACK handshake — against the specified host and port, and observing the result. This differs from a raw, half-open SYN scan (the method used by port-scanning tools such as nmap), which never completes the handshake. A full connection attempt is slower per port but returns an unambiguous result. There are three possible outcomes:
- Open — the handshake completes. A service is actively listening on that port and accepting connections.
- Closed — the host responds but explicitly refuses the connection (a TCP RST). The host is reachable; no service is listening on that port.
- Filtered / timed out — no response is received within the timeout window. This typically indicates a firewall silently dropping the packets rather than actively refusing them — a deliberate and common security posture, not necessarily an indication of a problem.
Why Open, Closed, and Filtered Matter
The result determines the appropriate next step. A closed port confirms that the host is reachable and the network path functions correctly — the service on that port is simply not running, so the next step is to start it or verify the port number. A filtered port provides little information about the service itself; it indicates that a firewall, security group, or NAT rule is positioned between the client and the host, which is where the investigation should focus rather than the application.
This is also why a port check from an external vantage point, such as a server rather than a local machine, is significant: a port can be open on a local network and still be unreachable from the outside world, because a router or cloud security group blocks inbound traffic before it reaches the host.
Common Ports
- 22 — SSH, used for remote server administration.
- 25 — SMTP, used for mail transfer between servers (not the port used by an email client to send mail, which is typically 587).
- 80 / 443 — HTTP and HTTPS, standard web traffic.
- 3306 — MySQL. Should almost never be open to the public internet.
- 5432 — PostgreSQL. The same caution applies.
- 6379 — Redis. Frequently exposed unintentionally, and a genuine security risk when it is.
- 27017 — MongoDB. One of the most commonly misconfigured databases found open to the public internet.
As a general rule, web ports (80/443) and SSH (22) are intended to be reachable from the internet. Database ports (3306, 5432, 6379, 27017, and similar) generally should not be. If a check shows one of these ports open to the public, verify that this is intentional and that the service is properly authenticated before assuming it is safe.
Practical Uses
- Confirming that a newly deployed service is reachable before investigating the application itself.
- Verifying that a firewall rule or cloud security group change took effect, checked from outside the local network, where it actually matters.
- Confirming that a database or admin port intended to be restricted is not unintentionally exposed to the public internet.
- Ruling out network-level causes before debugging a connection timeout in an application.
If a port returns closed or filtered unexpectedly, it is often useful to first confirm that the host itself is reachable with a ping test — this distinguishes a specific firewall rule from a broader connectivity problem.
Frequently Asked Questions
What's the difference between closed and filtered?
Closed means the host actively responded and refused the connection (a TCP RST) — the host is reachable, but nothing is listening on that port. Filtered means no response came back at all within the timeout, which usually means a firewall is silently dropping the packets rather than rejecting them outright.
Why does a port show open locally but closed or filtered here?
Because this check runs from an external server, not your own machine. A port can be open on a local network and still be unreachable from the outside world if a router or cloud security group is blocking inbound traffic before it ever reaches the host — that gap is exactly what an external check is for.
Should database ports like 3306 or 27017 ever show open to the public?
Generally no. Ports like 3306 (MySQL), 5432 (PostgreSQL), 6379 (Redis), and 27017 (MongoDB) are meant to be reached from application servers on a private network, not directly from the public internet. If one of these shows open here, verify that's intentional and that the service is properly authenticated.
Why does this check take a moment instead of returning instantly?
A full TCP three-way handshake (SYN, SYN-ACK, ACK) is attempted, not a faster half-open scan. That gives an unambiguous open/closed/filtered result at the cost of being slightly slower than a raw SYN probe.
The port is closed — does that mean the server is down?
No — closed actually confirms the opposite: the host responded, so it's reachable. It just means no service is currently listening on that specific port. Start the service or double-check the port number. If you want to confirm the host itself is up first, run a ping test.
Use the port checker to test any host and port.