iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To check whether a public port is reachable, run a scan from outside the network against the correct public IP address or hostname. Use a one-port checker for router-forwarding problems, a common-port scanner for a quick exposure check, or an authorized Nmap-based scan when you need broader coverage. An “open” result means an application accepted the connection; “closed” means the host was reachable but nothing was listening; “filtered” or a timeout means filtering prevented a definite answer.
The six services below answer slightly different questions. None can see services that are hidden by NAT, firewalls, routing failures, or a different source network, so treat every result as an observation from that scanner’s location—not as proof of the machine’s complete state.
Choose the scanner that matches your question
| Scanner | Best use | What it checks or accepts | Important limits or extras |
|---|---|---|---|
| HackerTarget Online Nmap Scanner | Broader external assessment | Free scan of ten common TCP ports with Nmap service/version detection | HackerTarget describes paid scans for all 65,535 TCP ports, UDP, custom selections, scheduled scans, reports, IPv6 and API access |
| ViewDNS Port Scanner | Quick common-service check | Ports 21, 22, 23, 25, 80, 110, 139, 143, 445, 1433, 1521, 3306, 3389, 8080 and 8443 | Fixed list; useful when you want to know whether a named service is reachable |
| DNSChecker Online Port Checker | Custom forwarding tests | Domain or IP, user-entered ports, TCP or UDP, and common-port presets | Reports open, closed, or timed-out/blocked outcomes |
| PortChecker.co | One-port router diagnosis | Your current public IP or another IP and a specific port | Explains how blocked ports affect games and applications |
| YouGetSignal Open Port Check Tool | Simple external verification | Port on an IP address or domain | Offers selectable scan region; documents port-forwarding, firewall and server troubleshooting |
| IPVoid TCP Port Scanner | Authorized custom TCP checks | Common or custom ports with IPv4 or IPv6 input | Uses Nmap; its terms restrict scans to addresses you control or are authorized to test |
Before you scan: five checks that prevent misleading results
- Resolve the name. Confirm the hostname points to the intended public address. Check both A (IPv4) and AAAA (IPv6) records if your service supports both. A scanner testing an old address cannot validate today’s forwarding rule.
- Identify the listening service. On the server, verify that the application is bound to the expected interface and port. A service listening only on 127.0.0.1 is not reachable through the router.
- Confirm the protocol. TCP and UDP are different transports. A TCP “open” result says nothing about a UDP service, and many browser-based checkers test TCP only.
- Check the public path. Test from a network outside your LAN, such as a phone hotspot. Many routers do not support reliable hairpin NAT, so testing your public address from inside can fail even when Internet clients succeed.
- Get permission. Scan only systems you own or are explicitly authorized to test. HackerTarget instructs users to have permission, and IPVoid’s terms limit scans to authorized addresses.
1. HackerTarget Online Nmap Scanner: broadest practical starting point
Choose HackerTarget when a single-port answer is not enough. Its free online scan checks ten common TCP ports and includes Nmap service/version detection. HackerTarget advertises paid options for all 65,535 TCP ports, UDP and custom port selections, plus scheduled scans, reports, IPv6 and API access. Those additions make it suitable for recurring perimeter reviews, provided you have authorization and understand the plan’s current limits.
Use it when
- You want an external view of several likely exposed services.
- You need service/version clues rather than only open or closed.
- You are planning scheduled or API-driven monitoring.
2. ViewDNS Port Scanner: a fixed common-port sweep
ViewDNS checks 15 named ports: 21, 22, 23, 25, 80, 110, 139, 143, 445, 1433, 1521, 3306, 3389, 8080 and 8443. It is useful for a fast inventory of familiar FTP, SSH, mail, web, database and remote-desktop ports. Because the list is fixed, a clean result does not rule out a custom application on another port.
#1 Best Overall
- VERSATILE CABLE TESTING: Cable tester for data (RJ45) terminated cables and patch cords, ensuring comprehensive testing capabilities
- LARGE BACKLIT LCD: Backlit LCD display enables easy reading of pin-to-pin wiremap results, even in low-lit areas
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, Split-Pair faults, Cross-over, and Shield, providing thorough fault detection
- INTUITIVE USER INTERFACE: User-friendly interface with three buttons and simple, easy-to-identify test responses, ensuring a smooth testing experience
- MULTIPLE TONE GENERATOR STYLES: Tone on a single wire, wire pair, or all 8 conductor wires using the multiple style tone generator (solid/warble); requires probe Cat. No. VDV500-123 (sold separately)
3. DNSChecker Online Port Checker: flexible forwarding tests
DNSChecker lets you enter a domain or IP, specify ports, choose TCP or UDP, or select common-port presets. That makes it the most convenient choice when your router forwards an unusual port or when you must test UDP explicitly. Record the exact protocol and destination port in your notes; changing either can produce a different result.
4. PortChecker.co: diagnose one rule at a time
Use PortChecker.co when you have one concrete symptom—such as a game server or self-hosted application that friends cannot reach. It can test the visitor’s current public IP or another address. A focused test reduces ambiguity: verify the WAN port, then the internal destination port, and finally the host firewall.
5. YouGetSignal Open Port Check Tool: test from a selectable region
YouGetSignal checks a port on an IP address or domain and provides a region selector. A second region can help distinguish a local routing problem from a service that is blocked only for some source networks. It is documented for port forwarding, firewall troubleshooting and server-application problems.
Rank #2
- VERSATILE CABLE TESTING: Cable tester tests voice (RJ11/12), data (RJ45), and video (coax F-connector) terminated cables, providing clear results for comprehensive testing on unenergized Ethernet cables (not designed to test PoE)
- EXTENDED CABLE LENGTH MEASUREMENT: Measure cable length up to 2000 feet (610 m), allowing for precise cable length determination
- COMPREHENSIVE FAULT DETECTION: Test for Open, Short, Miswire, or Split-Pair faults, ensuring thorough fault detection and identification
- BACKLIT LCD DISPLAY: Backlit LCD screen displays cable length, wiremap, cable ID, and test results, ensuring easy readability in various lighting conditions
- EFFICIENT CABLE TRACING: Trace cables, wire pairs, and individual conductor wires using the multiple style tone generator (requires analog probe Cat. No. VDV500-123, sold separately), simplifying cable tracing tasks
6. IPVoid TCP Port Scanner: authorized IPv4/IPv6 TCP checks
IPVoid accepts common or custom TCP ports and IPv4 or IPv6 input and states that it uses Nmap. Its authorization restriction is explicit: scan only IP addresses under your control or for which you have permission. Use it for a defined TCP test, not as evidence that UDP is safe or reachable.
What “open,” “closed,” and “filtered” really mean
Open
Nmap defines open as an application actively accepting connections. Confirm that the exposed service is intentional, patched and protected by strong authentication. An open port is an exposure, not automatically a vulnerability.
Closed
Closed means the scanner reached the host, but no application was listening on that port. If you expected an open service, check the process, bind address, destination port in the forwarding rule and host firewall.
Rank #3
- Multifunctional NOYAFA NF-8508 Network Cable Tester: There are nine features to meet your needs. Continuity Testing, Cable Scan, Port Flash, Length Measurement, POE Power Supply Test, QC testing, Optical Power Meter, VFL and NVC function.It is perfectly suited for various engineering cabling projects, network troubleshooting, network equipment maintenance and testing scenarios. Its precise cable scanning and fault localization capabilities help you effortlessly pinpoint the root cause of issues.
- 7 WAVELENGTHS OPTICAL POWER METER: NF-8508 network cable tester can measure 7 standard wavelengths, 850/1300/1310/1490/1550/1625/1650, power detecting range(dBm): -70 ~ +10. Its power detection range spans from -70 dBm to +10 dBm, supporting FC/SC/ST connectors. It enables precise fiber optic power measurement, helping users efficiently assess fiber signal strength and ensure healthy fiber link operation. It effortlessly detects attenuation issues within fibers, thereby safeguarding fiber network stability.
- High Efficiency Visual Fault Locator: Easy identification of fiber breakpoints, poor connections, bending or cracking. Excellent for finding the right fiber to splice or quickly finding a break. Emmiting Energy: standard wavelenth: 650nm. Fast flashing, slow flashing, high precison.The built-in self-calibration ensures stable long-term performance, and Class IIIa laser (output<5mW) ensures safe daily operation.
- PORT FLASHING:The indicator light on the connection port in the NF-8508 device flashes to help accurately locate the cable. Displays port information, including operating speed, duplex mode, and negotiation settings. Port lights flash on the same screen to show the port's operating speed, making it easy to pinpoint lines and ports.
- PoE Testing and Cable Length Test: PoE testing can check cable mapping polarity and voltage of PoE network switches, withstand 60VDC. Automatically detects and switches between 10M/100M/1000M modes, Includes cable tracking, short circuit test, interruption of circuit test and etc The RJ45 cable tester can quickly measure the length of the cable with a range of 200m. Not only network cables, but also phone lines and BNC cables.
Filtered or timed out
Filtered means packet filtering prevented the scanner from determining whether the port is open. A timeout or “blocked” result is similarly inconclusive: firewalls may silently drop probes, upstream providers may filter traffic, or the scanner’s source region may be denied. Do not treat it as proof that no service exists.
Other Nmap states
Nmap also reports unfiltered, open|filtered and closed|filtered. These combined states reflect ambiguity in the response, protocol behavior or filtering. Repeat with the correct protocol and, when authorized, validate from another external vantage point.
A repeatable external-testing workflow
- Resolve the hostname and write down the public IPv4/IPv6 address returned.
- Start with one port for forwarding, a common-port list for a quick exposure check, or a custom/full scan for an authorized assessment.
- Run the test from outside the target LAN and note scanner region, protocol and timestamp.
- For an unexpected open port, identify the service, restrict it with firewall rules and authentication, patch it, or close it if unnecessary.
- Change one configuration item at a time, then repeat the external test. Keep the old and new results so you can see whether the change affected the public path.
Troubleshooting: symptom, cause and fix
“It is open inside, but closed outside.”
- Cause: wrong public IP, missing port-forward rule, host firewall block, or service bound only to localhost.
- Fix: verify DNS, WAN and LAN ports, bind address, router rule order and the host firewall; retest from a hotspot.
“It times out or says filtered.”
- Cause: silent firewall drops, ISP filtering, upstream security groups, or a scanner region that cannot route to the target.
- Fix: repeat from another region, check cloud/network ACLs and ISP policy, and compare TCP with UDP where applicable. A timeout is not evidence that the service is absent.
“The scan finds the wrong machine.”
- Cause: stale DNS, carrier-grade NAT, multiple routers, or an IPv4/IPv6 mismatch.
- Fix: compare the scanner’s target address with the router’s current WAN address and publish the correct DNS record. Test IPv4 and IPv6 separately.
“The port is open, but the application still fails.”
- Cause: application-layer authentication, TLS/SNI requirements, an incorrect internal port, or a service that accepts a TCP handshake but rejects the protocol.
- Fix: test the application with its real client, inspect server logs and verify the protocol, hostname and credentials.
“The result changes between scanners.”
Scanners may use different source regions, retry counts, timeouts, probe methods and protocol coverage. Compare like with like—same address, port, protocol and approximate time—then validate with a second external vantage point.
Rank #4
- Automatically runs all tests and checks for continuity, open, shorted and crossed wire pairs. Visible LED status display.
- Cable state testing (2-wire): Line DC detecting, anode and cathode determination,Ringing signal detecting open, short and cross circuit testing
- Cable Type: RJ11 Telephone cable and RJ45 LAN cable
- Connectors: Ethernet Cat 5, Ethernet Cat 5e, Ethernet Cat 6, Ethernet Cat 7, RJ11 6P and RJ45 8P
- Power Source: DC9V Battery Required (not included)
Performance, reliability and cost considerations
- Scope: a single-port check returns quickly and creates little traffic; a 1,000-port or larger sweep takes longer and is more noticeable. Nmap’s default scan covers the 1,000 most common TCP ports, while HackerTarget advertises all 65,535 TCP ports in paid scanning.
- Protocol: TCP results are generally easier to interpret than UDP, which often lacks a response even when an application is listening. Use a tool that explicitly supports UDP for UDP services.
- Vantage point: region selection and IPv4/IPv6 can change reachability. A result is not a universal accuracy ranking; no independent study establishes one service as universally most accurate.
- Operational safety: schedule broad scans only with authorization, rate limits and a maintenance contact. Keep timestamps and configuration so an apparent change is reproducible.
Or skip the browser setup
ScreenshotNeo is a website screenshot API, not a port scanner, but it can capture a hosted status page, scan report or monitoring dashboard in one request when you need a shareable visual record. Before the capture it accepts cookie/consent banners and removes more than 60 known consent platforms, newsletter popups and chat widgets; each cleanup step can be disabled. Bot checks/CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing status. Its MCP server provides take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for all options. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
Free tools Windows power users keep installed
One-click scans. No signup required.
Further reading
For a deeper explanation of discovery, service detection and scan interpretation, look for the current listing of the official Nmap Network Scanning guide using the search phrase “Nmap Network Scanning book.” Verify the edition and seller details before buying.
Frequently Asked Questions
Can an online port scanner test a private 192.168.x.x address?
No. A public scanner cannot route directly to a private LAN address. Test the router’s public address from outside the network, with forwarding configured to the internal host.
Best Value
- Multi-Function Network Cable Tester: Supports RJ45 (CAT5, CAT5e, CAT6, CAT6A, CAT7) and RJ11 telephone cables. Quickly detects continuity, short circuits, open wires, miswiring, and cable shielding status, ensuring your LAN or phone lines are correctly wired and ready to use.
- Fast/Slow Mode with LED Indicators: Switch between fast and slow scan speeds to identify wiring issues more precisely. LED lights on both master and remote units show wire order, making it easy to spot errors like open pairs or misaligned pins at a glance.
- Split-Type Design for Long-Distance Testing: Master and remote units can be detached and used separately, allowing you to test both ends of a long cable run, ideal for wall-mounted ports, long runs, or structured cabling. Perfect for home, office, or professional IT setups.
- Compact, Lightweight & Durable: Ergonomically designed with sturdy ABS housing, this pocket-sized tester is ideal for on-the-go network engineers, DIYers, and electricians. It’s your go-to toolkit for cable maintenance, upgrades, or new installations.
- Safe & Easy to Use: Simple one-button operation makes testing quick and hassle-free. LED indicators clearly show wiring status, while the G light instantly identifies shielded (FTP/STP) or unshielded (UTP) cables. Supports safe testing of telephone lines with typical voltages under 48-72V, ideal for both home and professional use.
Why can a port be open but still unsafe to expose?
“Open” only means an application accepts connections. Security depends on the application’s patch level, authentication, encryption, configuration and network restrictions.
Should I scan TCP and UDP separately?
Yes. They are different protocols, and a TCP result does not describe a UDP service. Choose a scanner that explicitly offers UDP when that is what your application uses.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
