TCP / port monitor

Check that any TCP port accepts connections — databases, brokers, mail, SSH and custom protocols.

Last updated August 5, 2026

The TCP monitor (shown in the dashboard as Port (TCP)) opens a TCP connection to a host and port and records whether the handshake completed and how long it took. Use it for anything that listens on a port but does not speak HTTP.

What each check records

Status — up if the three-way handshake completed, down otherwise.
Latency — connection time in milliseconds, including DNS resolution.

The check does not send or read any application bytes. If a process is bound to the port but wedged, TCP still reports up. Pair it with an HTTP monitor when you need service-level health.

Configuration

Option	Notes
Host	Hostname or IP. DNS is resolved on every check.
Port	1–65535.
Interval	How often to check. Your plan sets the floor.

The connection timeout is fixed at 3 seconds and is not configurable per monitor.

TCP or HTTP?

Scenario	Monitor
Web service with a health endpoint	HTTP
Postgres, MySQL, Redis, MongoDB accepting connections	TCP
SMTP, IMAP, SSH, FTP	TCP
Custom binary or line protocol	TCP
Anything needing an application-level verdict	HTTP

If both matter — a Postgres server that also fronts PgBouncer on another port — create two monitors.

Common ports

Service	Port
SSH	22
SMTP	25, 587
HTTP / HTTPS	80 / 443
LDAPS	636
IMAPS	993
MySQL	3306
RDP	3389
PostgreSQL	5432
Redis	6379
MongoDB	27017

Example

A Postgres replica on db-replica-1.internal:5432:

example

Type:     Port (TCP)
Host:     db-replica-1.internal
Port:     5432
Interval: 60s

Firewalls and private networks

A TCP monitor only verifies the port is reachable from the checking node's network path. If the service sits behind a private network or an allowlist, either allowlist the checking node or run a dedicated node inside your own network. Dedicated nodes are available on Starter and above — 1 on Starter, 3 on Growth, unlimited on Scale.

TLS

A TCP monitor stops at the TCP handshake — it does not negotiate TLS and it cannot tell you anything about a certificate. To track certificate validity and expiry, use the SSL & domain expiry monitor.

Limitations

No application-level assertions — no banner matching, no EHLO, no STARTTLS probing.
Connection refused counts as down, even when refusing is the correct behaviour for that source IP. If your service rejects non-allowlisted addresses, allowlist the node or use a dedicated one.
No port-knocking or multi-stage handshakes.
No UDP.