Port Check Command Generator

Q: Port is down — how do I tell service-not-running vs firewall-blocked?

Read the failure mode: connection refused usually means the service is not listening or the port is closed; timeout / no response usually means a firewall drop or a routing issue. Check the nc -vz wording, then confirm locally with ss -tlnp whether the service is actually listening.

Q: Should I use ss, nc or nmap?

Use ss -tlnp locally (is it listening?), nc -vz across hosts (lightweight, default timeout), and nmap -p when you want the port state or scripting. They complement each other; the tool emits all three.

Q: What does nc -vz print when a port is reachable?

nc -vz host port prints succeeded! with exit code 0 on success; on failure it prints refused / timed out with a non-zero exit code. In scripts, judge by the exit code rather than the wording.

Q: A firewall rule is blocking the port — how to locate it fast?

First confirm the process is listening with ss -tlnp, then check the allow rules with iptables -L -n / firewall-cmd --list-all, finally tcpdump -n port 80 to see whether SYN packets are dropped — that separates local rules from upstream policy.

Honest note: a browser cannot scan a remote port for you (that needs server-side privileges or a public API). This tool generates the correct check command + troubleshooting path — copy it and run it on your own machine to get the real result. No fake "click-to-scan" promise here.

Generate check commands

Enter a target host and port; the tool emits three complementary commands, each with "when to use / how to read".

Target host Ports (comma-separated)

Which command when

Command	Purpose	Where to run
`ss -tlnp \\| grep :80`	Is 80 listening locally?	On the target host
`nc -vz host 80`	Cross-host TCP reachability (default timeout)	From your machine
`nmap -p 80 host`	Port state open / closed / filtered	From your machine

Self-check first: ss -tlnp shows whether the service process is up. Not listening → service problem, stop there.
Cross-host reachability: nc -vz is light and fast; for scripted exit codes use nc -vz -w 3 host port; echo $? (0 = reachable).
Port state: nmap -p 80 host tells open (reachable) / closed (nothing listening or port closed) / filtered (firewall drop).

Troubleshooting path

connection refused → no service listening on that port, or the port is closed. Confirm the process with ss -tlnp on the target.

timeout / no response → likely a firewall drop or routing issue. Check whether nmap reports filtered, then tcpdump -n port 80 to see whether SYN packets are being dropped.

succeeded / open → the port is reachable; the problem is higher up (app-layer rejection, TLS, permissions).

TCP/IP state machine & troubleshooting — TIME_WAIT / RST / SYN half-open in one table
Nginx reverse proxy 502/504 troubleshooting — the port-reachable-but-app-layer-error case

Port Check Command Generator

Generate check commands

Which command when

Troubleshooting path

Related tutorials