How can I prove (with logging) where a port block is occurring?

I've set up an FTP site on IIS (windows 7 home) and set up a rule in the Windows Firewall allowing access. The ftp site is accessible via my local browser to my static IP (ftp.example.com, where DNS is godaddy, so its resolving to my static IP and the ftp directory is being served). I've also set up a rule in my uVerse router firewall allowing FTP Server access to this machine. However, my customer cannot reach my FTP site, and when I test using mxtoolbox.com ..

1 open ports:

80  http    Success 78 ms

These ports were closed:

21  ftp Timeout 0 ms

Furthermore, I can add other open ports, such as IMAP and POP3, and they show as open once I edit the router firewall. No matter how many times I delete and add FTP Server, port 21 never shows as open on mxtoolbox.com, and of course the customer cannot reach the FTP site. He can successfully reach my locally-hosted webpage.

3 Answers 3


From the remote site, you can use traceroute to work out where in the path the port is blocked. Note that this has to be a *nix traceroute, eg linux, as Windows does not support traceroute over arbitrary ports.


sudo traceroute -p 21 -T <your server ip>


sudo traceroute -p 80 -T <your server ip>

These have to be run as root as it requires elevated privileges.

Note that it is the IP after the last successful hop that tells you where the block is - ie, the hop that does not respond. So look for the next hop in the port 80 traceroute after the last successful one in the port 21 traceroute.

  • Do you know of any websites set up to do this for a visitor? Such as mxtoolbox.com checks MX issues, and canyouseeme.org checks for open ports, a site that does a trace route and displays the results would be very useful here. (I don't have control over the remote customer box and he's not technical) Nov 17, 2011 at 5:30
  • 1
    I have never heard of any that would do something like this. Do you have no one you know that has a linux box? If you like I can test it. In my profile is my website, and there is contact form you can send me the IP address if you don't want to publish it here.
    – Paul
    Nov 17, 2011 at 6:01
  • Here's a site which does offer an online traceroute of TCP ports: websitepulse.com/tools/tcp-traceroute-test
    – bsplosion
    Mar 20, 2020 at 21:19

To check at which point or hop your port is being blocked use tracetcp. its very simple as below.

To check port 31 all the way to destination:

$ tracetcp www.ebay.co.uk:31

Tracing route to [www.ebay.co.uk] on port 31

Over a maximum of 30 hops.

1       1 ms    1 ms    1 ms     [wintermute]

2       10 ms   13 ms   9 ms

3       *       *       *       Request timed out.

4       *       *       *       Request timed out.

5       *       *       *       Request timed out.

6 ... continues until maximum number of hops reached.

you just need to install winpcap than this utility will work from Windows Cmd.



If you don't have access to a Linux box, just install the telnet client on Windows:

Control Panel -> Programs and Features

telnet server-ip port

Or you can download PuTTY.

If the conenction timesout or is refused, then that is a problem :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .