Free Port Checker

An IP address gets you to the right machine; a port gets you to the right program running on it. Picture the IP as the street address of an apartment building and the port as the specific door number inside — the mail carrier needs both, because a single server is running a web server, a mail server, and an SSH daemon all at the same time, and the port number is the only thing that keeps their traffic from getting mixed up. So the plain-English answer to what is a port in computer networking is: a numbered doorway, from 0 to 65535, that a piece of software sits behind and listens on.

Those numbers are split into ranges by convention. The well known ports, 0 to 1023, are reserved for the classic services everyone agrees on — a web server on 80, SSH on 22. From 1024 to 49151 are the registered ports that vendors claim for their apps, and everything above that is the ephemeral range your own machine borrows at random for the outgoing side of a connection.

There's a second split that matters more for checking: TCP versus UDP. A TCP IP port is connection-based — the two sides shake hands before any data moves, which is why it's reliable and why a port checker can test it at all: it simply tries the handshake and watches what happens. UDP ports are fire-and-forget, no handshake, no acknowledgement, used where speed beats certainty (DNS queries, video, games). That difference is why the tool above tests a TCP port specifically — there's a connection to succeed or fail, so the answer is honest rather than a guess.

You don't need all 65,536 memorised, but a couple of dozen come up constantly, and recognising them turns a raw port number into an instant read on what a machine is exposing. Here are the ones actually worth knowing, grouped by what they do:

"Is the port open" is really two different questions, and confusing them wastes hours. One is what's listening on the machine itself; the other is what the outside world can actually reach. They routinely disagree, because a firewall sits between them.

From on the box, you're asking what's bound locally. On Linux the modern move is 'ss -tuln' (the old habit was netstat), and any guide to how to check port status or to linux list open ports lands there — it shows every service listening, on which port, on which interface. To check open ports on Windows it's 'netstat -ano' in PowerShell, mapping each listening port to a process ID. Useful — but it only tells you what the server offers, not who's allowed to reach it.

From the outside, you're asking the real-world question: with the firewall in the way, can anyone actually connect? That's how to access a port from somewhere else, and the classic tools are telnet, netcat (a netcat check if port is open is just 'nc -vz host port'), and nmap for a full sweep. This is the view that matters for anything public-facing, because it's what your users and your attackers see — and it's exactly what the checker above gives you, from our servers, with nothing to install. A port that's listening locally but shows filtered from outside means the firewall is doing its job; one that's open from outside when you didn't intend it is the problem you want to catch.

Security people talk about attack surface, and open ports are the most literal version of it: every port answering the public internet is another door someone can rattle. The discipline is simple to state and easy to drift from — expose only what has to be exposed (usually just 80 and 443), and keep everything else, especially databases and admin ports, firewalled off. A filtered result from the tool above is a good sign here; it means a firewall is silently swallowing connections rather than letting them through.

The catch is timing. The port you just confirmed is closed can quietly open tomorrow — a deploy that binds a debug service to a public interface, a cloud security-group rule loosened 'just for a minute', a container that publishes a port you forgot about. A one-time check can't see that coming; it only describes this second. That's the gap monitoring closes. Uptura doesn't sell generic port scanning, but it does watch the thing you actually care about staying reachable: it connects to your site on 80/443 around the clock — a real request, not just a ping — tracks its SSL certificate and DNS records alongside, and emails or Slacks you the moment it stops answering. Free during our public beta, so a service falling over is something you hear from us, not from a customer.