Keep a TCP service on watch

A listening port, a useful signal

A TCP monitor checks whether a service accepts a TCP connection. It closes the connection immediately, without reading a banner, checking a certificate or sending commands. A reachable port is a useful signal, but it does not prove the application behind it is working correctly.

Use it for an already-public service you own or are authorized to monitor. Do not expose a private database or internal service just to monitor it.

Set up your lookout

TCP belongs in Endpoint monitors alongside HTTP, WebSocket and TLS checks. It is included in every plan and uses your normal monitor allowance and minimum interval.

1. Open Monitors → Endpoint monitors and choose Add monitor.
2. Choose Check a service, then TCP connection. Give the monitor a clear name.
3. Enter tcp:// followed by the public hostname or IP and an explicit port, for example tcp://service.example.com:443. Ports must be between 1 and 65535; paths, query strings and login details are not supported.
4. Choose the interval, timeout, confirmation thresholds and any maintenance window. Save the monitor.

Read the result calmly

Up means the connection was accepted before the timeout. Refusal, an unreachable service or a timeout produces a failed check; your confirmation settings decide when status changes and alerts are sent. Latency covers DNS resolution and establishing the connection, not an application response.

A service that accepts and then immediately closes can still count as up. Use an HTTP/API, WebSocket or TLS monitor if you need response content, protocol validation or certificate checks. Existing incidents, pause/resume, maintenance and notification preferences apply. Slack, Teams and mobile push are available on every plan; monitor email alerts require a paid plan.

When a connection cannot be made

Check that the service is listening on the chosen port and that its firewall accepts traffic from your monitoring infrastructure. Cloudflare or another proxy may accept only particular ports: monitor the intended publicly reachable endpoint, not a proxied hostname that cannot carry that service.

Private, loopback, link-local and other special-purpose destinations are rejected. DNS answers are checked before connecting, and a hostname with any non-public answer is rejected. A TCP check does not provide ICMP ping or private-network monitoring. Address family lets you select IPv4 only or IPv6 only.

Changing protocol requires removing incompatible HTTP rules and protected request details. The shared editor clears them when saving TCP. Exported TCP monitors retain the target and import paused.