Short answer: you cannot ping a port. ping uses ICMP, which has no port numbers. To check a port you open a TCP connection to it: run Test-NetConnection HOST -Port 443 in Windows PowerShell, or nc -zv HOST 443 on Linux and macOS. If it succeeds, something listens on that port and no firewall blocks you.
Test-NetConnection 203.0.113.10 -Port 443nc -zv -w 3 203.0.113.10 443Replace 203.0.113.10 with the server’s IP address or host name and 443 with the port. Below: the tools on each system, what every possible answer means, how to measure the latency of a port, and why UDP ports cannot be checked the same way.
What port does ping use?
None. Ping sends ICMP echo requests, and ICMP sits directly on IP as its own protocol (protocol number 1; ICMPv6 for IPv6 is number 58), next to TCP and UDP rather than on top of them. ICMP messages have a type instead of a port: an echo request is type 8 and the reply type 0 (128 and 129 in ICMPv6). Firewalls therefore allow or block ping by ICMP type, never by port number.
That has a practical consequence: ping and ports fail independently. A server can drop every ping and still serve HTTPS on 443, or answer ping while the port you care about is closed. A failed ping does not mean the service is down; the ping command guide lists who usually drops it. The question “is port 443 reachable?” needs a TCP test.
Windows: Test-NetConnection
Test-NetConnection 203.0.113.10 -Port 443
Test-NetConnection example.com -Port 3389 -InformationLevel Quiet # prints only True or False
Test-NetConnection 203.0.113.10 -CommonTCPPort RDP # HTTP, RDP, SMB or WINRM by name
tnc 203.0.113.10 -Port 22 # tnc is the built-in aliasWARNING: Ping to 203.0.113.10 failed with status: TimedOut
ComputerName : 203.0.113.10
RemoteAddress : 203.0.113.10
RemotePort : 443
InterfaceAlias : Ethernet
SourceAddress : 192.168.1.20
TcpTestSucceeded : TrueRead TcpTestSucceeded and nothing else. The cmdlet pings first, and the warning only says ICMP is blocked. A closed or filtered port shows WARNING: TCP connect to (203.0.113.10 : 443) failed and TcpTestSucceeded : False; the cmdlet does not tell a refusal from a timeout, but a timeout takes noticeably longer to come back. In PowerShell 7, Test-Connection 203.0.113.10 -TcpPort 443 does the same and prints just True or False.
From the old command prompt, the Telnet client works too once it is installed (Install-WindowsFeature Telnet-Client on Windows Server, dism /online /Enable-Feature /FeatureName:TelnetClient on Windows 10 and 11): telnet 203.0.113.10 443 opens a blank window when the port is open and prints Could not open connection to the host when it is not.
Linux and macOS: nc
nc -zv -w 3 203.0.113.10 443 # one port
nc -zv -w 3 203.0.113.10 8000-8010 # a range of ports (your own servers only)-z connects and closes again without sending data, -v prints the result, -w 3 gives up after three seconds. Without -w, an unanswered connection waits for the kernel’s own timeout: on Debian 12, tcp_syn_retries is 6 (read from /proc/sys/net/ipv4), which means roughly two minutes before it gives up. On Debian and Ubuntu, nc comes from the netcat-openbsd package; macOS has it built in, and on Rocky and AlmaLinux it is Nmap’s ncat (package nmap-ncat), whose messages are worded differently. With the OpenBSD version the three outcomes read:
Connection to 203.0.113.10 443 port [tcp/https] succeeded!
nc: connect to 203.0.113.10 port 443 (tcp) failed: Connection refused
nc: connect to 203.0.113.10 port 443 (tcp) timed out: Operation now in progressNo nc installed: bash, curl or telnet
A minimal server often has no netcat, but bash can open a TCP connection itself through its /dev/tcp path, and curl can do it with the telnet:// scheme. The bash line ran on a Debian 12 server (bash 5.2) against 1.1.1.1 port 443 for the open case and a closed local port for the refused one; the curl output comes from curl 7.88.1 on the same server:
timeout 3 bash -c '</dev/tcp/203.0.113.10/443' && echo open || echo closedbash: connect: Connection refused
bash: line 1: /dev/tcp/127.0.0.1/1: Connection refused
closedAn open port prints just open. When timeout has to stop the attempt, the exit status is 124, so a script can tell a timeout from a refusal (status 1).
curl -v --connect-timeout 5 telnet://203.0.113.10:443* Trying 127.0.0.1:1...
* connect to 127.0.0.1 port 1 failed: Connection refused
* Failed to connect to 127.0.0.1 port 1 after 0 ms: Couldn't connect to server
* Closing connection 0
curl: (7) Failed to connect to 127.0.0.1 port 1 after 0 ms: Couldn't connect to serverOn success curl prints a line starting with * Connected to 203.0.113.10 and then waits for input, so press Ctrl+C. Its exit status is 7 for a refused connection and 28 for a timeout. In Windows PowerShell type curl.exe, because plain curl is an alias for Invoke-WebRequest there. The classic telnet 203.0.113.10 443 shows Connected to 203.0.113.10. and Escape character is '^]'. when the port is open; Ctrl+] then quit leaves it.
What the result means
| Result | What happened on the wire | What it tells you | Check next |
|---|---|---|---|
| Succeeded / open / True | SYN, SYN-ACK, ACK: the handshake completed | A program listens on the port and every firewall on the way lets your address in | If the app still fails, test the protocol itself (curl -v https://...) |
| Connection refused | The server answered the SYN with a reset (RST) | The host is up and reachable, but nothing listens on that port, or a firewall rule rejects it | Is the service running? Is it bound to 127.0.0.1 only? |
| Timed out | No answer at all | A firewall dropped the packets, the IP is wrong, or the host is down | Host firewall, any firewall in front, the address you used |
| No route to host | An ICMP host-unreachable came back | Often a firewall that rejects with ICMP (firewalld does by default), or the host is gone from its network | Firewall rules on the server, then routing |
| Network is unreachable | Nothing left your machine | Your own system has no route, typically an IPv6 test without IPv6 connectivity | Test with -4, or fix your own connection |
| Name resolution failed | Nothing left your machine | The host name does not resolve | Test the IP directly, then fix DNS |
Refused versus timed out is the most useful distinction. Refused means you reached the machine and only the service is missing. A timeout means something swallowed the packets, and that is almost always a firewall: UFW’s and the Windows Firewall’s default policies both drop silently. Browsers show the same pair as ERR_CONNECTION_REFUSED and ERR_CONNECTION_TIMED_OUT.
Ping a port repeatedly to measure latency
Sometimes the goal is not “open or closed” but a ping-like round-trip time to a service whose network drops ICMP. Timing the TCP handshake gives that number:
curl -sI -o /dev/null -w 'tcp connect: %{time_connect}s\n' https://example.com/tcp connect: 0.007727stime_connect is the time until the TCP handshake completed, here 7.7 milliseconds; on Windows use NUL instead of /dev/null. For a series like ping’s, Microsoft’s Sysinternals tool PsPing takes a port (psping 203.0.113.10:443), and on Linux nping, part of the Nmap project, does the same without root: nping --tcp-connect -p 443 -c 4 203.0.113.10. For where those milliseconds come from, and when they matter more than bandwidth, see bandwidth vs latency.
Why UDP ports cannot be “pinged” reliably
Every test above relies on TCP’s handshake. UDP has none: you send a datagram, and an open UDP port usually says nothing back unless the data makes sense to the program. A closed port may answer with an ICMP “port unreachable”, but a firewall that drops packets also says nothing. So nc -zvu HOST 51820 reporting success only means no error came back, and nmap reports such ports as open|filtered. Test a UDP service with its own client instead: dig @HOST example.com for DNS, the game client for a game server, a completed handshake for WireGuard. The details are in why UDP is harder to check.
Checking a port on your own server
Run the test from outside the server, from your PC or another machine. A test from the server to its own public IP never passes the inbound firewall rules in the same way, so it can call a port open that the internet cannot reach.
The open port checker runs the TCP test from a server in Amsterdam, against the address you browse from or any public IP you enter, which also covers port forwarding on a home router.
If the port is closed and should not be, work from the inside out:
- Does anything listen?
sudo ss -tlnpon Linux,Get-NetTCPConnection -State Listenon Windows. A service bound to127.0.0.1is only reachable from the server itself; the full walkthrough is in how to check open ports on Linux. - Does the host firewall allow it? On Linux with UFW,
sudo ufw allow 443/tcp(see setting up UFW); on Windows Server, an inbound rule as in opening a port in Windows Firewall. - IPv4 and IPv6 separately. A host name with an AAAA record may be tested over IPv6 while the service or the rule only covers IPv4. Use
nc -4andnc -6, or the IP address itself. - Your own network. Office and public Wi-Fi networks often block outgoing ports other than 80 and 443. Repeat the test from a phone hotspot before you change anything on the server.
Frequently asked
Can you ping a specific port?
No. Ping uses ICMP echo requests, and ICMP has no port numbers. To check a specific port, open a TCP connection to it, for example with Test-NetConnection HOST -Port 443 in PowerShell or nc -zv HOST 443 on Linux and macOS.
What port does ping use?
None. Ping uses ICMP, a separate IP protocol (number 1, or 58 for ICMPv6) that identifies messages by type instead of port: an echo request is type 8 and an echo reply type 0. Firewalls allow or block ping by ICMP type.
What is the difference between connection refused and timed out?
Connection refused means the server answered with a reset: the host is reachable, but nothing listens on the port or a firewall rule rejects it. Timed out means no answer came back at all, usually because a firewall dropped the packets, the address is wrong or the host is down.
How do I test a UDP port?
Not reliably with a generic tool, because UDP has no handshake and an open port often stays silent, just like a filtered one. Test with the service's own client instead, such as dig for a DNS server or the game client for a game server.