What does “TCP port open” mean?
TCP needs a three-way handshake (SYN / SYN-ACK / ACK). This tool sends a SYN to the port you give. SYN-ACK means open: something is listening. RST (connection refused) is closed. No reply until the timer fires is timeout — often a drop rule or filter.
The probe leaves the iptool.tr host, not your browser. The target’s log shows our egress IP. If your home firewall allows SSH only from you, 22 looks closed here. This is not a pentest, banner grab or UDP scan.
Examples
- HTTPS
443 openHandshake accepted — not a CVE.- Custom
host:8443Any 1–65535 or host:port.
How do I check a custom port?
Type any integer 1–65535. The chips cover 8080, 8443, 2222, 2083, 5432 and similar; anything else (9000, 25565, 32400) goes in the box. Paste example.com:8443 or https://panel.example.com:2083 to fill the port from the host field.
For IPv6 use [2001:db8::1]:443. One port per request. Scanning 1–1024 in one go is out of scope and often unauthorised.
Open, closed, timeout
Open: a process accepted the handshake. 443 open means HTTPS is listening, not that the certificate is valid (use SSL checker). 22 open is SSH; weak passwords are invisible here.
Closed: the host answered but nothing listens (RST). Timeout: the packet was dropped. Closed vs filtered matters in security groups; timeout is its own row.
Limits and permission
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8 and similar private ranges are refused (SSRF). You need a public IP or a name with a public A/AAAA.
Use it only on systems you own or may test. Free accounts get one host; Pro asks the same port on 256 addresses in a /24. Rate limits cut abuse.