What is the difference between an OPEN, CLOSED, and FILTERED TCP port?

An OPEN port accepts SYN packets and completes the TCP handshake with SYN-ACK. A CLOSED port actively rejects connections by returning an immediate RST packet. A FILTERED port drops packets silently without responding, indicating a stateful firewall (iptables, cloud security group).

Why does TCP socket ping differ from standard ICMP ping?

ICMP ping measures raw IP echo response, which many firewalls, CDNs (Cloudflare), and cloud hosting providers block. TCP socket ping tests the actual application layer service (e.g. web server on port 443 or SSH on 22), proving real application reachability.

How do cloud security groups affect port accessibility?

Cloud infrastructure providers (AWS EC2, Hetzner, DigitalOcean) enforce security groups outside the guest operating system. Even if a service like Nginx is listening locally, incoming traffic will be blocked unless the inbound firewall rule explicitly permits the port.

RFC 793 TCP Socket Latency Engine

Server Port & Ping Latency Checker

Test whether target TCP ports are open, listening, or blocked by firewalls across remote servers. Measures true TCP socket roundtrip handshake latency in milliseconds with zero ICMP bypass issues.

Target Host, Domain or IP accepts IPv4, IPv6 or FQDN

TCP Port (1 - 65535)

Common Service Ports:

Port 443 is OPEN HTTPS Secure Web

cloudflare.com:443

Port 443 (HTTPS Secure Web) is OPEN on cloudflare.com

TCP Socket Roundtrip

260.07 ms

Handshake Latency

Socket State

SYN-ACK Received (Connection Accepted)

Application Protocol

HTTPS Secure Web (Standard IANA Port)

Diagnostic Action

Check DNS → • WHOIS →

Network Diagnostics & Firewall Engineering Guide

How TCP Socket Ping, Port States & Handshakes Operate

A systems administrator's guide to diagnosing TCP reachability, measuring socket roundtrip latency, understanding firewall packet filtering, and securing standard network service ports.

RFC 793 Protocol

The TCP Three-Way Handshake Mechanics

Unlike connectionless UDP or ICMP echo pings, TCP guarantees reliable, ordered byte streams via a 3-step synchronization handshake before application data transfers:

SYN (Synchronize)

Client sends a TCP segment with the SYN flag set and an Initial Sequence Number (ISN). Informs server of intent to establish connection.

Client → Server

SYN-ACK (Acknowledge)

If the port is listening, the server responds with SYN and ACK flags set, acknowledging the client's sequence number and supplying its own.

Server → Client (Latency Measured)

ACK (Established)

Client acknowledges receipt of the server's SYN. The connection enters the ESTABLISHED state, ready for HTTP/TLS data exchange.

Connection Open

Port Open

Listening & Accepting

An application (e.g. Nginx, OpenSSH, PostgreSQL) is actively bound to the port. SYN packets receive an immediate SYN-ACK response and the socket completes the handshake.

Port Closed

Connection Refused (RST)

The host machine is reachable, but no application process is currently listening on that specific port. The kernel TCP stack responds immediately with a TCP RST (Reset) flag.

Port Filtered

Firewall Dropped (Timeout)

A packet filter or cloud security group (iptables, nftables, AWS Security Groups) silently drops the SYN packet without returning any response, causing connection timeout.

IANA Port Assignment Reference

Standard Network Service Ports & Transport Protocols

Port Number	Service Name	Transport Protocol	Security Recommendations
22	SSH (Secure Shell)	TCP	Disable root password login, enforce Ed25519 SSH keys, fail2ban
80	HTTP (Web Server)	TCP	Redirect 301 permanently to HTTPS port 443; HSTS header
443	HTTPS (TLS Encrypted Web)	TCP / UDP (QUIC)	Enforce TLS 1.3, strong cipher suites, automated Let's Encrypt renewal
3306	MySQL / MariaDB	TCP	Never expose publicly; bind to 127.0.0.1 loopback or private VPC
5432	PostgreSQL Database	TCP	Restrict access via pg_hba.conf, enforce client SSL certificates
6379	Redis In-Memory Cache	TCP	Critical: Never expose without strong requirepass auth and TLS tunnel

Port Diagnostics Knowledge Base

Frequently Asked Questions: Server Ports & Network Latency

Many enterprise firewalls, CDNs (including Cloudflare), and cloud host providers block ICMP echo requests by default to mitigate ping floods and reconnaissance scans. However, they intentionally allow inbound TCP traffic to reach active application ports like 80 or 443. A TCP socket ping tests the actual application listening state.

This discrepancy usually indicates one of three firewall tiers: 1) Cloud provider security group (e.g. AWS Security Group or Hetzner Cloud Firewall) blocking inbound port 22; 2) Host operating system firewall (UFW on Ubuntu or firewalld on CentOS) dropping non-whitelisted IP connections; or 3) The SSH daemon is bound only to the local loopback interface (127.0.0.1) instead of 0.0.0.0.

TCP is connection-oriented, providing a deterministic handshake (SYN → SYN-ACK) to confirm a port is open. UDP is connectionless and stateless; an open UDP port typically sends zero response to an unsolicited probe packet. Determining whether a UDP port is open requires sending protocol-specific payloads (e.g. DNS query for port 53, NTP query for port 123).