Network troubleshooting for beginners: Part 3 — Ports

An IP address identifies a host, and a port identifies a specific service on it. A web server usually accepts connections on port 80 (HTTP) and 443 (HTTPS), SSH on 22, databases and mail on their respective ports. A server may respond to ping, but if the required service is not running or the port is blocked by a firewall, the application won’t be able to reach it.

This section covers how to check a remote server’s port and which ports your machine is listening on.

Checking a port on a remote server

nc (netcat)

nc -zv example.com 443

• -z — just check the connection, without sending data;
• -v — verbose output.

Successful result:

Connection to example.com (93.184.215.14) 443 port [tcp/https] succeeded!

Failure:

nc: connect to example.com port 81 (tcp) failed: Connection refused

The exact text depends on the nc variant on the system (OpenBSD or traditional), but the meaning is the same. To limit the timeout add -w 5 — five seconds. More examples — in the article about netcat.

Windows: Test-NetConnection

In PowerShell, port checking is built-in:

Test-NetConnection example.com -Port 443

In the output, the line TcpTestSucceeded : True means the connection was established.

telnet

The old method that works wherever a telnet client is installed:

telnet example.com 443

The message Connected to … means the port is open; to exit — Ctrl+], then quit. On Windows the telnet client isn’t installed by default, so Test-NetConnection is more convenient there.

How to interpret errors

• Connection refused — the host is reachable, but nothing is accepting connections on that port: the service is not running or is listening on a different port or address.
• Connection timed out — there is no response at all. Most often packets are dropped by a firewall on the server, at the provider, or along the path.
• No route to host — there is no route to the host or it is being rejected by a firewall.

The difference between refused and timeout is the main indicator: in the first case you reach the server, in the second — you do not.

What your machine is listening on

On Linux the main tool is ss:

ss -tulpn

• -t — TCP;
• -u — UDP;
• -l — only listening sockets;
• -n — port numbers instead of service names;
• -p — the process that opened the socket (for other processes you need sudo).

Example line:

tcp  LISTEN 0  4096  0.0.0.0:22   0.0.0.0:*   users:(("sshd",pid=812,fd=3))

Note the address in the Local Address column:

• 0.0.0.0:22 or [::]:22 — the service accepts connections on all interfaces;
• 127.0.0.1:5432 — only from the same machine; you can’t connect from outside, and this is a common reason for the question “the port is open, but I can’t connect”.

On Windows:

netstat -ano

The State column with value LISTENING shows listening ports, the last column is the process ID. The netstat utility on Linux is deprecated and is replaced by ss.

If the service is listening but the port is inaccessible from outside

Steps to check:

1. The service is listening on the correct address (0.0.0.0, not 127.0.0.1) — ss -tlnp.
2. The port is allowed in the server’s firewall. UFW configuration is covered in the article “Securing a Linux Server: Part 1 — The UFW Firewall”.
3. The port is open at the hosting provider (cloud security groups) and forwarded on the router if the server is behind NAT.

Summary

• nc -zv, Test-NetConnection -Port, telnet — check a remote host’s port;
• refused — the service is not listening, timeout — packets are being dropped on the way;
• ss -tulpn and netstat -ano — what your machine is listening on and on which address.

Resources

• ss (man7.org)
• Test-NetConnection (Microsoft Learn)
• nc (OpenBSD)