Home/Tools/Port reachability

Port reachability

Open a real TCP connection from the current CHA.LA API node and distinguish a completed handshake, explicit refusal, timeout and route failure.

One port per request. Private, loopback and reserved addresses are rejected; this is not a port scanner.
No port result yetSubmit a public target and port to see real TCP handshake evidence.

An open port is only the first step

This tool attempts a TCP connection from a CHA.LA server probe. Enter a public IP or hostname and a port to distinguish a completed handshake, refusal or timeout.

Two examples, explainedIllustrative · not live results
Handshake completedTCP 443
Example observation
The port accepts a connection
How to interpret it
TCP is reachable in this testCheck TLS and application responses
Connection timed outTCP 443
Example observation
No handshake before the timeout
How to interpret it
Filtering, loss or a path issue is possibleIt does not prove the port is closed

Test scopeOnly the TCP handshake is tested, not authentication, application health or security.

Common questions

Does this test UDP ports?

No. This is a TCP handshake test. A result for TCP port 53, for example, does not establish whether UDP DNS works.

Why can the probe connect when I cannot?

Your device uses a different network path. Check local connectivity, firewalls, proxies and service access rules too.

How is refusal different from a timeout?

Refusal is usually an explicit rejection by the target or an intermediate device. A timeout means the handshake did not finish in time. Check listening services and network policy separately.

Does an open port 443 prove HTTPS works?

No. TLS negotiation, certificate validation and the HTTP request happen later. Use the HTTP/TLS tool to inspect those stages.

What if a hostname has several IPs?

The result applies to the addresses actually tested. Load balancing, IPv4/IPv6 and DNS changes can produce different outcomes across addresses.

Can I test internal or third-party ports?

Test public targets you own or are authorized to assess. A server-side probe is not an internal-network test or permission for unauthorized scanning.

TCP Port Checker - Test Port Connectivity | CHA.LA