Free tool
Is that port really answering?
We open a connection to the port, note what comes back, and close it again. Nothing is sent, no banner is read. Three answers are possible — and the third is the one nobody explains.
The distinction nobody explains
One façade, three kinds of window
A lit window and you can see the service. A dark window and you can see the room is empty — which is already information. A shuttered window and you no longer know whether there is a room at all. Put the firewall up and watch what changes: not one window closes.
Click a window to see what the machine replied.
- Reply
- explicit refusal
- Time
- a few milliseconds
A refusal is an answer: the host exists, it is reachable, the network gets to it. Only this port is unserved. When hunting an outage, that is the result that moves you forward — it points at the service.
- Open: the connection is accepted.
- Closed: the machine refuses, explicitly.
- Filtered: nothing comes back.
What silence costs
Eight answers, all immediate. Whether it accepts or refuses, the machine replies: the whole check fits in the blink of an eye.
Example configuration. No real machine is depicted, and the eight ports shown are a subset of the fourteen the tool accepts.
The boundary, stated up front
Can this tool sweep every port on a machine?
No
And this is not a stripped-down version pending something better. A port checker open on 1-65535 from a public form, with no authentication and no trace, is not a diagnostic tool: it is pre-attack reconnaissance, handed to everybody. So we settled on a list of fourteen SERVICE ports — the ones whose failure gets described to you over the phone — and we stick to it.
What it does instead
Fourteen ports, chosen
The web, email, names, remote access and two databases. They cover the real outages across a portfolio of sites, and they do not let anyone map out a machine.
Six per check
The ceiling lives in the engine, not only on screen. It is enough to answer a question; it is not enough to trawl.
No internal addresses
A name that leads to the server's private network is refused before any probe. Without that filter, a public form becomes a relay into the machines of whoever hosts it.
Reading the result
Four possible lines, and what each is worth
A port check does not return yes or no. It returns what the machine replied — or the fact that it replied nothing at all, which is not the same information.
- Open
- The connection was accepted within milliseconds: a service is listening, and it accepts connections from anywhere. The time shown is the time to establish the connection, not the service's own: a port that opens fast can still serve a slow application.
- Closed
- The machine answered to refuse, immediately. That is good news in disguise: the host exists, it is reachable, the network gets all the way to it. Only this port is unserved. When you are hunting down why a service is silent, “closed” points at the service; “filtered” points at the path.
- Filtered
- Nothing came back before the deadline. Some device dropped the packet without replying — the machine's own firewall, hosting-side filtering, a carrier rule. You learn nothing about the service: not that it is running, not that it is stopped. It is the only state that settles nothing.
- Open where it should not be
- A database or an unencrypted file transfer reachable from the whole internet is not a diagnosis, it is a finding. MySQL and PostgreSQL belong on the server's private network; plain file transfer is replaced by its encrypted version. The page flags this below the result.
Where the reading goes wrong
Four ways to misread a port that does not answer
The error is almost never in the measurement. It is in the shortcut taken afterwards, and it is always the same one: mistaking “we received nothing” for “there is nothing”.
Treating “filtered” as “closed”
What causes it: Both look like a failure on screen, and plenty of tools paint them the same color. Yet they point at two different places: a refusal comes from the machine, silence comes from whatever sits between it and you.
What fixes it: Port closed, go after the service: it is not started, or it is not listening on that interface. Port filtered, go after the path: the server's firewall, the hosting security group, a carrier rule.
Concluding a server is down because everything is filtered
What causes it: A properly firewalled machine answers nothing it has not decided to serve. That is the expected outcome, not an outage.
What fixes it: Ask it what it publishes rather than what it withholds: the DNS zone, the https response, the certificate. A server silent on twelve ports and talkative on 443 is simply well configured.
Checking port 25 from home and blaming the server
What causes it: Many consumer internet providers block outbound port 25, so their network cannot be used as a relay for bulk sending. The block is at your end, not theirs.
What fixes it: Use a check that runs from a network which does not filter — this one probes from a server, not from your connection. And to send from a mail client it is port 587 that matters, never 25.
Believing an open port proves the service works
What causes it: Openness says a program accepts connections on that number. It says nothing about what it does next: a web server can accept the connection and return an error on every page.
What fixes it: The port is the first step, not the answer. Once it is open, the question becomes the service itself — the certificate, email authentication, the page's response code.
The whole list
The fourteen ports this tool accepts
It is closed, and here it is in full: there is nothing to guess about what the tool can do. Each line says what the port is for, and what its silence usually means.
| Port | Service | What it is for | What no answer usually means |
|---|---|---|---|
| 21 | FTP | File transfer, unencrypted. | Rarely an outage: it is served less and less, in favor of its encrypted replacement. |
| 22 | SSH | Remote shell and encrypted transfer. | Often filtered on purpose, or moved to another number, or restricted to a few addresses. |
| 25 | SMTP | Mail delivery between servers. | When filtered, it is nearly always the network doing the checking that blocks it, not the server. |
| 53 | DNS | Domain name resolution. | A name server silent over TCP may still answer over UDP: this tool probes TCP only. |
| 80 | HTTP | Website without encryption. | Closed while 443 answers: the site only serves https, and there is no redirect from http. |
| 110 | POP3 | Mail retrieval, unencrypted. | Often switched off deliberately: the unencrypted versions are being abandoned. |
| 143 | IMAP | Mail access, unencrypted. | Same story: the encrypted version, on 993, has replaced it. |
| 443 | HTTPS | Encrypted website. | A silent 443 means the whole site is unreachable. It is the gravest line in this table. |
| 465 | SMTPS | Encrypted mail sending, the older door. | Closed while 587 is not: the host picked the modern door, and that is fine. |
| 587 | SMTP | Mail sending from a mail client. | Closed or filtered, nobody can send mail from their client any more. |
| 993 | IMAPS | Encrypted mail access. | Silent, the mailbox stops loading in the mail client even though the website works. |
| 995 | POP3S | Encrypted mail retrieval. | Same effect as 993, on setups that download mail instead of reading it in place. |
| 3306 | MySQL | MySQL database. | Closed or filtered is the right result. It is open that should worry you. |
| 5432 | PostgreSQL | PostgreSQL database. | Likewise: a database reachable from the whole internet has no good reason to be. |
The last two lines are on the list so that you can check they do NOT answer. It is the only case where the expected result is a refusal.
Frequently asked
What people ask us about ports
What is the difference between a closed port and a filtered port?
A closed port answers. The machine returns an explicit refusal within milliseconds: nobody is listening here. A filtered port does not answer at all — a firewall drops the packet in silence, and the tool waits four seconds before giving up. Closed points at the service, filtered points at the path: these are not two ways of saying no, they are two different diagnoses.
Can I scan every port on a server with this tool?
No, and that is not a temporary limit. Fourteen service ports, six per check, no field where you type a number. A public form able to sweep all 65,535 ports of a machine is a reconnaissance tool: it serves an attacker's preparation as readily as a diagnosis. To audit a machine you are responsible for, do it from an administration workstation, with the owner's written agreement.
Why can my clients no longer send their email?
Look at 587 first, then 465. That is where sending from a mail client goes through, and a change of host, a newly added firewall or a change of network on the client's side is enough to cut it. Port 25 is not the right place for that question: between servers it handles delivery, and many consumer providers block it outbound.
Is an open port dangerous?
It depends entirely on what sits behind it. Port 443 open means a site that works. Port 3306 open means a database anyone can try to reach. The question is never how many ports are open, it is whether that particular one had a reason to be.
Why is the check slow on some machines?
Because silence is measured by waiting. An open or closed port replies at once; a filtered port sends nothing, and you have to run out the full timeout — four seconds — before you can write “filtered”. A well firewalled machine is therefore slow to check, which is rather a good sign.
Does the check run from my computer?
No: from our servers. That is what makes the result useful, because your own network filters things you are not aware of — outbound port 25 at many consumer providers, port 22 on a good number of corporate networks. What you read here is what the internet sees, not what your desk sees.
The three answers
Silence is not a refusal.
A closed port answers you. A filtered port does not — and it is the only one of the three answers you can conclude nothing from.
- openthe connection is accepted
- closedthe machine refuses, and says so
- filterednothing comes back, nobody knows why
When nothing answers
A silent port, in order
Four moves, from the cheapest to the most expensive. The first three need nothing from anybody.
Check the name still points where it should
Before blaming a firewall, check which address the name leads to today. A record changed the day before, a hosting migration, a forgotten alias: the probe then questions a machine that is no longer yours, and everything looks filtered.Compare against a port you know is served
Check 443 at the same time as the port worrying you. If it answers, the machine is reachable and the network gets to it: the problem is the service, or a rule aimed only at it. If nothing answers, the problem is further upstream.Tell a refusal from a silence
Closed, go and look at the service on the machine: is it started, is it listening on the public interface or only locally. Filtered, go and look at the path: the machine's firewall, the hosting security group, a carrier rule.Ask which network the test came from
A client telling you “it does not work from here” is testing from their network, and their network filters. Outbound port 25 is blocked by many consumer providers. The check on this page starts from our servers: that is what the internet sees.
After the check
A port closes on a Tuesday, not on the day you look
This page tells you what answers right now. It will not tell you that 587 stopped answering while you were busy with something else.
What this check gives you
A snapshot, taken the second you click. It is enough to settle the question in front of you — is the client's mail still going out, is the site answering over https — and it is worth nothing the next day. That is true of every one-off check, and it is worth knowing.
What DomainVigil does next
The same probes, continuously, on the domains you manage for your clients — uptime, certificate, domain expiry, email authentication, reputation. You are told when something changes, instead of on the day the client notices before you do.