Port (TCP) monitors

What it checks

A port monitor opens a TCP connection to a host and port from one of Mon's locations. If the connection opens within the timeout, the service is up, and the time it took to connect is recorded. If the connection is refused, or nothing answers in time, it's down.

It works for anything that accepts TCP connections - SSH, mail, databases, remote desktops, game servers - on any port from 1 to 65535. It only knows that something accepted the connection, not that the service behind it is healthy. Port monitors don't check UDP.

Adding one

Under Monitors, choose Add Monitor, then Port, and enter:

• Host - the machine the port is opened on, by name or by IP address. A URL is cut down to its host.
• Port - the port to connect to. It has no default - enter the one your service listens on.
• Expect Port Closed - for a port that should be shut. See below.

Under Advanced options:

• IP Protocol - Automatic, IPv4 or IPv6, to connect over one address family specifically.

To add several at once, choose Add several at once and paste the hosts into Hosts, one per line or separated by commas. Add :port to a host - mail.example.com:465 - to use a port other than the one in Port. Each becomes its own monitor, named after its host and port, and repeats are dropped.

The rest of the form is shared with every monitor: Monitoring - interval, timeout, maintenance windows and locations, see How checks work - then Alerts, see Alerts and contacts, and the monitor's Name, suggested as host:port.

Port monitors are on every plan, checked as often as every minute on paid plans and every 5 minutes on the Free plan.

What it reports

What happened	Monitor	With Expect Port Closed
The connection opened within the timeout	Up	Down
The connection was refused or failed	Down	Up
Nothing answered within the timeout	Down	Up
The host's name didn't resolve	Down	Down

Each check records how long the connection took to open, shown on the monitor's Response Time chart, and each failed check records its reason in the Message column under Checks.

A refused or timed-out connection is something another location might not see, so Mon tries the next of the monitor's locations before calling it down - see How checks work.

Ports that should be closed

Turn on Expect Port Closed and the check works the other way round: the monitor is up while the port doesn't accept connections, and goes down the moment it does. It's the way to catch a database, cache or admin port exposed to the internet by a firewall change - checked from outside your network, the way anyone else would see it.

A port found open is down straight away - Mon doesn't try other locations first. A name that doesn't resolve is down too: the check never reached the host, so it can't say the port is closed - a mistyped host or a lapsed domain shows up rather than passing quietly.

Firewalls

If your firewall only lets known addresses in, allow Mon's - listed on Locations and IP addresses and in your account under Locations.

Port, ping and HTTP

A ping monitor tells you the machine is reachable; a port monitor tells you a service on it is accepting connections. For a website, an HTTP monitor is the better fit: it makes the request a browser would and checks the status code and the page itself, where a port check only knows that something answered on 443. To watch a certificate on a port, use an SSL monitor.