How to Diagnose Network Reachability

Ping, traceroute, and ports answer different questions

Ping checks for ICMP replies and measures round-trip timing. Traceroute attempts to identify intermediate hops. A TCP port check tries to establish a connection to a specific service port. A host can block ping while still serving web traffic, and intermediate routers can hide traceroute replies without breaking the final connection.

A sensible diagnostic order

1. Confirm the hostname resolves through DNS.
2. Ping the host to collect latency and loss samples, understanding that ICMP may be filtered.
3. Use traceroute to identify where replies change or stop.
4. Check only the specific TCP port used by the authorized service, such as 443 for HTTPS.

Reading the output

Occasional high latency at one hop is not automatically a fault if later hops respond normally; routers often deprioritize diagnostic traffic. Consistent loss continuing through subsequent hops is more meaningful. An open TCP port means a connection was accepted, not that the service is secure or correctly configured.

Use these tools responsibly

Run port and reachability checks only against systems you own or have permission to test. Rate limits, firewalls, and provider policies may affect output. Avoid broad repeated scans, and use service logs from the target system when you need an authoritative diagnosis.