Technical reference
TCP Port Check technical details
This reference documents how the TCP Port Check works: what it connects to, how it labels a result, what it refuses to check and the limits it keeps to.
What a check does
- Reads the target. A host name, an IPv4 address or an IPv6 address, plus a port from 1 to 65535. host:port, [IPv6]:port and URLs are accepted too; a URL without a port uses its scheme’s default, such as 443 for https.
- Looks up the name over DNS-over-HTTPS (A and AAAA records) and times the lookup. In Auto mode the first IPv4 address is used, or IPv6 when there is no IPv4 address. You can pick IPv4 or IPv6 instead. Only one address is checked.
- Connects three times to that address from a Cloudflare Worker, using the Workers TCP sockets API, and records how long each connection took to open. Each attempt waits at most 5 seconds. After a timeout the check stops, because a filtered port would only time out again.
- Waits for a greeting on the first successful connection, for up to 1.5 seconds and 512 bytes, unless the port is a web port (such as 80, 443, 8080 or 8443) where the client always speaks first.
- Closes the connection. Nothing is ever sent to the service: no request, no login, no probe.
How results are labelled
| Result | When |
|---|---|
| Open | At least one of the three attempts completed the handshake. |
| Closed | The connection was refused or reset before the timeout. |
| Filtered | No answer within 5 seconds. |
| Unreachable | The network reported no route to the address. |
| Failed | The connection ended with an error that doesn’t clearly mean refused, dropped or unroutable. No port state is claimed. |
| Not checked | The address is private or reserved, it is on Cloudflare’s own network, or the port is 25. See the limits below. |
The handshake diagram on the results page is drawn from that outcome. The checker can’t see individual packets, so the SYN, SYN-ACK and ACK arrows show what a successful connection, a refusal or a timeout means at the TCP level, as described in TCP handshakes and port states.
Every attempt that doesn’t connect also shows its error details: the error text exactly as the Worker’s socket reported it (one line, up to 300 characters), or the timeout that was reached. Use it to see why a port was labelled the way it was.
Connect time is measured from the moment the Worker asks for the connection until it opens. It is roughly one round trip between the Cloudflare data center running the check and the host, plus the host’s own delay. It is not the latency from your network. The data center is shown by its code, such as EWR or LHR.
What can’t be checked
- Private and reserved addresses: RFC 1918 ranges, loopback, link-local, carrier-grade NAT, multicast, documentation ranges, unique local IPv6 and IPv4 addresses carried inside IPv6. Internal names such as .local or .corp and single-label names are refused too.
- Names that point anywhere private. If any A or AAAA record of a name is private or reserved, nothing is connected. The connection then goes to the checked IP address, not the name, so a second DNS lookup can’t swap in a different address.
- Cloudflare’s own addresses. Workers sockets can’t connect back into Cloudflare’s network, so a host behind Cloudflare’s proxy is reported as not checked. The result says whether Cloudflare’s proxy accepts that port at all; it only passes a fixed set of HTTP and HTTPS ports.
- Port 25. Cloudflare doesn’t allow outbound connections to port 25. Mail submission ports 587 and 465 can be checked.
- UDP. Only TCP is tested. UDP services, such as DNS on port 53 or QUIC on 443, often don’t answer a probe they don’t understand, so a reliable UDP check needs a protocol-specific request.
Limits and privacy
| Limit | Value |
|---|---|
| Hosts and ports per check | One host, one port |
| Connection attempts | 3 (fewer after a timeout) |
| Timeout per attempt | 5 seconds |
| Greeting | Up to 1.5 seconds and 512 bytes; first three lines shown, up to 200 characters |
| Checks per visitor | 30 an hour, 200 a day |
Checks run only from the TCP Port Check page. Nothing about a check is stored: the result exists only in your browser, and the link to a check simply runs it again. Greetings are shown as plain text, with unprintable bytes replaced by dots.
Only check systems you own or have permission to test. A single connection is what any visitor to a public service makes, but repeated checks of someone else’s systems can still be unwelcome.
Why results can differ from your own test
The check runs from Cloudflare’s network, not from your computer. A firewall that allows only your office’s addresses, a provider that filters some ports for home connections, or a route that differs between networks can each make a port open from one place and filtered from another. Compare with Test-NetConnection host -Port N in PowerShell or nc -vz host N from your own network.