How TCP checks work

A TCP check goes one layer deeper than ping: instead of asking "is this machine there?", it asks "is something on this machine listening on port X?" It does that by performing the same three-way handshake that opens every real application connection: the monitor sends a SYN packet to the target port, a listening service answers SYN-ACK, and the monitor completes with ACK — then closes the connection immediately. If the handshake completes within the timeout, the check succeeds and the connection time is recorded in milliseconds.

What it proves

A successful TCP check is solid evidence of three things at once:

• The host is reachable — everything a ping proves.
• A process is actually bound to that port and accepting new connections. A stopped or crashed service can't complete the handshake.
• Firewalls along the path allow traffic to that port.

The failure modes are informative too. Connection refused means the host is up but nothing is listening — the service has stopped. A timeout means the host is unreachable or a firewall is silently dropping traffic to that port. The recorded error tells you which one happened.

What it doesn't prove

The handshake happens before the application does any real work, so a TCP check can't see application-level breakage. A database can accept connections on port 3306 while authentication is broken or the disk is full; a mail server can accept on port 25 while its delivery queue is jammed. TCP answers "is the door open?" — not "does anyone answer when you walk in?"

For websites, that's why an HTTP check is better: it goes further and validates the response status. For services that don't speak HTTP, though, a TCP check is usually the best signal you can get from outside without credentials — and a monitoring probe shouldn't be logging into your client's database anyway.

Common ports

Mail, databases, and RDP are the classic MSP use cases: they're the services clients notice immediately when they stop, and none of them can be probed with HTTP.

TCP checks in UpAll

Choose the TCP port check type and a Port field appears (1–65535). The timeout is fixed at 10 seconds, the connection time counts against the degraded threshold (default 500 ms), and consecutive failures open an incident like any other check. Setup details and examples: TCP port monitors; for choosing between check types, see Monitor types and check types; for the layer below, see how ping checks work.