TCP Port Check
Enter a public host name or IP address and a port. We open a TCP connection to it from Cloudflare’s network three times, show the handshake and how long each took, and read the greeting a service sends, such as an SSH or mail server banner.
You can also paste host:port or a URL. Auto checks the first IPv4 address, or IPv6 when there is none. Private, reserved and internal addresses are never checked. Only check systems you own or have permission to test.
What this checks
- OpenHandshake completedThe host answered SYN with SYN-ACK, so something is listening.
- ClosedRefusedThe connection was actively rejected, by the host or a device in between. Usually nothing listens on the port.
- FilteredNo answerNo connection completed within 5 seconds. Filtering is a common cause; loss, routing or a host that is down look the same.
- BannerGreetingThe first line a service sends on its own, such as SSH or SMTP.
The result is what Cloudflare’s network sees. A firewall that allows only some source addresses, or a network path that differs from yours, can give a different answer from your own computer. Nothing is sent on the connection, and results are not kept as history; IP-based rate-limit counters and operational logs are handled as the Privacy Policy describes. Read how TCP handshakes and port states work or the technical details.