Skip to main content

Port Testing & Diagnostics

Your JD names these tools explicitly:

Perform port testing using tools such as netstat, telnet, Test-NetConnection, nmap, and PowerShell scripts.

This is the page that answers that requirement. Learn to reach for the right one without thinking.

The core distinction​

Three different questions

1. Is the host up? → ping, ICMP. 2. Is the TCP port open? → Test-NetConnection, telnet, nc, nmap. 3. Is the application healthy? → curl -v, application logs, SSL check.

A green ping tells you nothing about 2 or 3. That gap is where most support incidents actually live.

Test-NetConnection — the PowerShell default​

Test-NetConnection -ComputerName dc01.corp.local -Port 445
Do not write Test-Connection. It is a different command.

Test-Connection is the ping command. It has no -Port parameter and never will:

PS> Test-Connection -ComputerName 127.0.0.1 -Port 22
Test-Connection: A parameter cannot be found that matches parameter name 'Port'.

Use Test-NetConnection (alias tnc) for ports, Test-Connection for ICMP:

tnc 127.0.0.1 -Port 22            # port 22 open?
Test-Connection 127.0.0.1 -Count 4  # ping
Test-Connection 127.0.0.1 -Quiet   # ping, True/False only

Two cmdlets, one word apart, doing completely different things. This is the single most common PowerShell mistake in this job.

The single most important line to remember. Read its output:

ComputerName     : dc01.corp.local
RemoteAddress    : 10.0.0.5
RemotePort       : 445
InterfaceAlias   : Ethernet
SourceAddress    : 10.0.0.20
TcpTestSucceeded : True
Read `TcpTestSucceeded`, not `PingSucceeded`

If PingSucceeded is False but TcpTestSucceeded is True, the host is blocking ICMP and is perfectly healthy. A common false alarm.

Useful variations:

# Does DNS resolve as well as connect?
Test-NetConnection dc01.corp.local -Port 389 -InformationLevel Detailed

# Range a set of ports
445, 389, 3389 | ForEach-Object {
  $r = Test-NetConnection dc01.corp.local -Port $_ -WarningAction SilentlyContinue
  "$_ -> $($r.TcpTestSucceeded)"
}

The port tester script — write this from memory​

This is a standard take-home and a fair interview question:

$hosts = 'web01.corp.local', 'dc01.corp.local', '192.168.1.1'
$ports = 80, 443, 445, 3389

foreach ($h in $hosts) {
    foreach ($p in $ports) {
        $r = Test-NetConnection -ComputerName $h -Port $p -WarningAction SilentlyContinue
        [pscustomobject]@{
            Host     = $h
            Port     = $p
            Open     = $r.TcpTestSucceeded
            RemoteIP = $r.RemoteAddress
        }
    }
}
Why -WarningAction SilentlyContinue

Without it, Test-NetConnection emits a warning per unreachable port and the output becomes unusable. Interviewers notice this.

Be ready to explain it: the outer loop walks hosts, the inner walks ports, Test-NetConnection does a TCP handshake, and [pscustomobject] emits objects you can pipe to Export-Csv or Format-Table.

telnet and netcat​

telnet 10.0.0.5 443

A successful connection shows a blank or garbled screen — that is the success signal. If it says "Connection refused", the host answered but nothing is listening. If it times out, a firewall is dropping the packets.

nc -zv 10.0.0.5 443     # Linux equivalent, with a verdict
The three outcomes mean different things
ResultMeaning
ConnectedPort open, something is listening
Connection refusedHost reachable, nothing bound to that port
Timed outPacket dropped — firewall, or wrong host

netstat — what is listening on MY machine​

netstat -ano                          # everything
netstat -ano | findstr :445           # a specific port
netstat -ano | findstr LISTENING      # listening sockets only
netstat -e                            # interface errors and discards

The PID at the end is how you find the culprit process:

tasklist /FI "PID eq 4128"
# Or, one step:
Get-NetTCPConnection -LocalPort 445 |
  Select-Object LocalPort, State, OwningProcess,
                @{n='Process'; e={(Get-Process -Id $_.OwningProcess).ProcessName}}
ss -tulpn          # Linux
netstat -tulpn    # older Linux
The interview question behind netstat

"A user says a file share is slow. Netstat shows thousands of connections in TIME_WAIT. What does that mean?" — Answer: the local side is closing first and sockets are lingering in the 2×MSL wait before final teardown. Very high connection churn against a server that closes connections slowly.

nmap​

nmap -Pn -p 445,3389,53 10.0.0.5      # specific ports, skip ping scan
nmap -sV -p 443 10.0.0.5             # service/version detection
nmap -A 10.0.0.5                    # aggressive: OS + services + scripts
nmap -sn 192.168.1.0/24             # host discovery only
FlagWhy it matters here
-PnTreat the host as up even if it blocks ping — otherwise you get "0 hosts up" and no results
-sVTurns 445/tcp open into 445/tcp open microsoft-ds
-pRestrict to the ports the ticket is about
Scope

nmap is a scanner. Only run it on networks you are authorised to test. Running it across an employer's network without permission is a disciplinary matter, and in some jurisdictions a legal one.

curl — the one that checks the application​

curl -vk https://dc01.corp.local/     # -v verbose, -k ignore cert
curl -I https://example.com           # headers only
curl -sS -o /dev/null -w "%{http_code}\n" https://example.com

This is the step that separates "the port is open" from "the service works".

Combining them — the real diagnostic​

Say this ordering out loud

Being able to recite this layered escalation is worth more than memorising any individual command. It is what "troubleshoot connectivity issues" means in practice.

Linux equivalents​

ss -tulpn                          # sockets
ip a ; ip r                        # addresses and routes
dig +short example.com             # DNS
nc -zv host 443                    # port test
curl -vk https://host/             # application
ping -c 4 host                     # ping (note -c on Linux)
traceroute host                    # path

Wireshark​

FilterCaptures
tcp.port == 445SMB traffic
udp.port == 67 or udp.port == 68DHCP DORA
dnsAll DNS
arpAddress resolution
tcp.flags.syn == 1SYN scan attempts
Note

You will not be asked to be a Wireshark expert. Knowing that you can filter for tcp.port == 445 to prove traffic is leaving a machine is enough.

Reference​

Port reference — 35 of 35
PortProtoServiceWhy support cares
20TCPFTP dataPassive FTP. Blocked by most firewalls.
21TCPFTP controlCleartext credentials — avoid.
22TCPSSHLinux/Unix remote administration.
23TCPTelnetCleartext. Your JD names it as a test tool.
25TCPSMTPOutbound mail from a mail client.
53TCP/UDPDNSUDP for lookups, TCP for zone transfers.
67UDPDHCP serverOffers and acknowledgements.
68UDPDHCP clientDiscover and Request.
69UDPTFTPUsed during PXE network boot.
80TCPHTTPUnencrypted web.
88UDP/TCPKerberosAD authentication ticket exchange.
123UDPNTPTime sync — Kerberos fails without it.
137UDPNetBIOS nameLegacy Windows name service.
139TCPNetBIOS sessionLegacy file sharing.
143TCPIMAPMail retrieval.
161UDPSNMPNetwork monitoring polling.
162UDPSNMP trapUnsolicited device alerts.
389TCP/UDPLDAPAD directory queries.
443TCPHTTPSAlso RDP-over-Gateway, SQL Server TLS.
464TCP/UDPKerberos password change
500UDPIKE (IPsec)VPN negotiation phase 1.
514UDPSyslogCentralised log shipping.
636TCPLDAPSLDAP over TLS.
3389TCP/UDPRDPRemote Desktop. Almost guaranteed in a support call.
4500UDPNAT-T / IPsecVPN when UDP 500 is blocked.
3268TCPGlobal CatalogAD global catalogue search.
3269TCPGlobal Catalog TLS
5985TCPWinRM (HTTP)PowerShell Remoting.
5986TCPWinRM (HTTPS)Remoting over TLS.
1433TCPMS SQL Server
3306TCPMySQL
5432TCPPostgreSQL
27017TCPMongoDB
8080TCPHTTP alternateProxies, Tomcat.
8443TCPHTTPS alternate

Verification​

Port testing readiness
0 / 6 complete

Next​

VLANs & Routing.

Was this page helpful?
Configured for Docusaurus v3.10.2 with future.v4 flags enabled.See how this banner was added