How do you check whether a remote port is reachable from a Linux machine?
Use nc -zv host port for a quick TCP check, or curl -v telnet://host:port, or bash's /dev/tcp. A refused connection means nothing listens there; a timeout usually means a firewall or routing problem. ping only tests ICMP, not ports.
Explain it simply
Imagine calling a company switchboard. Ping checks that the building exists. A port check tries to reach a specific extension.
nc -zv db.example.com 5432 (netcat): -z just test, -v verbose. It prints "succeeded" or an error.
Without netcat, bash can open TCP sockets: timeout 3 bash -c '</dev/tcp/db.example.com/5432' && echo open || echo closed. Or curl -v telnet://host:5432.
Reading the result matters:
- Connection refused: the host replied, but no program is listening, or the service is down.
- Timed out: packets are being dropped, typically by a firewall, security group or wrong route.
- Succeeded: TCP handshake worked, but the application may still reject you.
For HTTP, curl -I https://host tests the app layer as well. Ping can fail even when a service works, because many networks block ICMP.
Example
nc -zv example.com 443
# Connection to example.com 443 port [tcp/https] succeeded!
timeout 3 bash -c '</dev/tcp/127.0.0.1/9' && echo open || echo closed
# closedWhat to say in the interview
"I use nc -zv or bash /dev/tcp to test a TCP port. Refused means nothing is listening; a timeout points to a firewall or routing. ping alone is not enough because ICMP is often blocked and it does not test ports."
Common mistakes
- Concluding the service is down because ping fails.