Ping Test (TCP) - Is the Host Up and How Far Away

The ping command you run in a terminal sends an ICMP Echo Request and waits for an Echo Reply. ICMP is a low-level control protocol, and sending it requires a raw socket, which in turn requires elevated privileges. Serverless and container platforms — including the one this site is deployed on — do not grant that privilege, so a tool that shelled out to ping would work on a developer's laptop and then fail with “operation not permitted” in production. Rather than ship a tool that is broken where it actually runs, this one measures a TCP connection instead.

The idea is simple. To open any TCP connection your machine sends a SYN packet, the host replies with a SYN-ACK, and your machine finishes with an ACK — the three-way handshake. Timing how long the SYN to SYN-ACK takes gives you a round-trip time in the same way ICMP does, and it exercises the same network path. The one practical difference is which packets a firewall lets through: many hosts drop ICMP but almost none drop TCP on port 443, because that is how the web works. So a TCP ping is often a more reliable reachability check for a public web server than a real ping would be.

This tool makes four connection attempts in sequence and records each one, then reports the minimum, average, and maximum round trip along with a packet-loss percentage. Four is the same count the default Windows ping uses, enough to see variance without hammering the target.

A ping answers one narrow question: did a packet make the round trip, and how long did it take. It cannot tell you whether a website returns the right content, whether TLS is valid, or whether an application behind the port is healthy — a server can complete a TCP handshake on port 443 while the site itself throws a 500 on every request. For those, reach for a tool that speaks the actual protocol: an SSL checker for certificates, a DNS lookup for name resolution, a port scanner to see which services are exposed. Ping is the first step, not the diagnosis.

The test also refuses to point anywhere it should not. Private ranges, loopback, and link-local addresses are rejected outright, and because the most dangerous case is a public hostname that resolves to an internal address — the classic way a diagnostic tool gets turned into a server-side request forgery pivot against a cloud metadata endpoint — the hostname is resolved first and the request is blocked if the resolved address falls in a blocked range. Use the tool on hosts you are allowed to probe; it is a reachability check, not a scanner for networks you do not control.