Frequently Asked Questions
How is this different from the ping command on my machine?
The classic ping command uses ICMP echo packets sent from your own computer. This tool uses a TCP connection from a hosted edge server to a specific port you choose, and measures how long the connection takes to establish. The difference matters in two ways: it runs from the server's location rather than yours, so the latency reflects that path, and because it uses TCP it works against the many hosts and firewalls that silently drop ICMP but still accept connections on ports like 443. It is a reachability and latency check for a specific service, not a raw network echo.
Why is the round-trip time higher than my local ping?
Two reasons. First, the probe starts from the hosted edge server, not your computer, so the measured path is from that server to the target — it may be geographically further or routed differently than your own connection. Second, a TCP handshake involves more than a single ICMP echo: it completes the connection setup, which can include extra round-trips. Use the number as a consistent relative measure between hosts rather than as an exact match to your local ICMP ping.
What does refused mean in a probe result?
Refused means the host is reachable and actively rejected the connection on that port — the port is closed and something replied to say so, usually instantly. That is actually useful information: the host is up, but it is not listening on the port you tried. If you expected a service there, either it is down or you have the wrong port. Try the port the service actually uses, such as 443 for HTTPS or 22 for SSH.
What does timeout vs. unreachable mean?
A timeout means the probe got no response at all within the time limit — the packet went out and nothing came back, which typically points to a firewall silently dropping traffic, a host that is down, or a filtered port. Unreachable means the network actively reported that the destination cannot be reached, for example because there is no route to it. Refused, by contrast, means a reply did come back rejecting the connection. Timeout and unreachable both count as packet loss; refused confirms the host is alive.
Why is the port limited to an allow-list?
The tool only connects to a curated set of common service ports — such as 443, 80, 22, 53, 587, 993, 3306, 5432, 8080 and 8443 — to keep it a legitimate diagnostic rather than a general-purpose port scanner. An open relay that can connect to any host on any port is easily abused for scanning and probing, so the allow-list limits it to the ports people actually need to test while preventing misuse. If a common port you need is missing, the standard service ports above cover the vast majority of real checks.
Can I ping an IPv6 host?
Yes. You can enter a hostname or an IPv4 or IPv6 literal. If you give a hostname, the edge server resolves it and connects over whichever protocol the host supports. The probe measures the TCP connect time to the chosen port the same way regardless of address family, so IPv6-only and dual-stack hosts both work.
Why do some sites I know are online time out?
The ping runs from a Cloudflare edge worker, and Cloudflare does not let a worker open TCP connections to Cloudflare's own network. Any site served through Cloudflare — a large share of the modern web — will therefore time out here even when it is perfectly healthy, and so will Cloudflare's own addresses such as 1.1.1.1. Hosts that are not behind Cloudflare, like google.com, github.com or wikipedia.org, measure normally. A timeout in this tool means the host is either genuinely unreachable on that port or sitting behind Cloudflare; it does not on its own prove the host is down.