PortQry Command Line Port Scanner: A Complete Guide for Admins
System administrators frequently need to verify network connectivity and troubleshoot port statuses. While GUI tools exist, command-line utilities offer speed, automation, and scriptability. PortQry is a powerful, lightweight command-line port scanner developed by Microsoft designed specifically for troubleshooting TCP/IP connectivity issues.
Unlike generic port scanners, PortQry is tailored for Windows environments, offering deep insights into specific services like Active Directory, DNS, and RPC. This guide covers how PortQry works, its core syntax, and practical examples for daily administration. Understanding PortQry Status Outputs
Standard port scanners usually report ports as “Open” or “Closed.” PortQry provides a third, highly useful status. It reports port connectivity in three distinct ways:
Listening: A process is actively listening on the target port of the destination computer. PortQry successfully received a response.
Not Listening: No process is listening on the target port of the destination system. PortQry received an ICMP “Destination Unreachable” message or a TCP RST packet.
Filtered: The target port is being blocked by a firewall, router, or security policy. PortQry did not receive any response from the port. Basic Syntax and Core Parameters
PortQry runs directly from the Windows Command Prompt or PowerShell. The basic structure of a PortQry command requires a target destination and a specific port or range of ports. portqry -n -p -e Use code with caution. Essential Switches:
-n (Name/IP): Specifies the target server name or IP address (required).
-p (Protocol): Specifies the protocol to use. Options are tcp, udp, or both (default is TCP). -e (Endpoint): Specifies a single port to test.
-r (Range): Specifies a range of ports to test (e.g., -r 21:80). -o (Order): Specifies the order to scan a list of ports. -l (Log file): Saves the output to a specified log file.
-q (Quiet mode): Suppresses screen output, returning only exit codes (useful for batch scripts). Practical PortQry Examples 1. Checking a Single TCP Port
To verify if a remote web server is running and accessible on standard HTTP port 80: portqry -n 192.168.1.50 -p tcp -e 80 Use code with caution. 2. Checking a Range of Ports
To scan a specific range of ports, such as common mail and web protocols on a server: portqry -n ://domain.com -p tcp -r 25:110 Use code with caution. 3. Scanning Interactive Windows Services
One of PortQry’s greatest strengths is its ability to query Windows-specific services. When targeting certain ports, PortQry sends a formatted query to the service to return version numbers or configuration data.
For example, checking the RPC Endpoint Mapper (TCP port 135) returns a detailed list of UUIDs and endpoints registered on that server: portqry -n dc01.internal.local -p tcp -e 135 Use code with caution. 4. Querying UDP Services (DNS)
UDP troubleshooting is notoriously difficult because UDP is stateless. PortQry handles this by sending a valid application-layer query to common UDP ports. To check if a DNS server is responding: portqry -n 10.0.0.5 -p udp -e 53 Use code with caution.
If the service is active, PortQry will display the actual DNS query response instead of just a generic packet confirmation. Automating PortQry with Batch Scripts
Administrators can leverage PortQry’s Quiet Mode (-q) to build automated network monitoring scripts. When -q is active, PortQry suppresses text output and returns an error level code to the operating system: 0: The port is Listening. 1: The port is Not Listening. 2: The port is Filtered or an error occurred.
Here is a simple batch script example to verify a critical SQL server connection:
@echo off portqry -n sqlserver01 -p tcp -e 1433 -q if %errorlevel%==0 ( echo SQL Server port 1433 is OPEN. ) else ( echo WARNING: SQL Server port 1433 is DOWN or FILTERED. ) Use code with caution. When to Use PortQry vs. Test-NetConnection
Modern Windows administrators often use the PowerShell cmdlet Test-NetConnection for network diagnostics. While Test-NetConnection is excellent for basic TCP handshakes, PortQry remains superior in several scenarios:
UDP Diagnosis: Test-NetConnection only tests TCP ports. PortQry can accurately assess UDP ports by sending interactive, protocol-specific payloads.
Service-Specific Logic: PortQry interprets data returned by LDAP, RPC, and SMB services, providing contextual troubleshooting information that generic tools miss.
Speed in Legacy Environments: PortQry has a tiny footprint and runs instantly without requiring the PowerShell subsystem to load, making it ideal for older server environments or limited winPE recovery environments. Conclusion
PortQry is a vital tool for any Windows administrator’s utility belt. It bridges the gap between basic ping utilities and heavy network protocol analyzers. By providing explicit “Filtered” status visibility and deep service-level queries, it saves valuable time during complex network outages and security audits. To help you get the most out of PortQry,
Learn how to use the PortQryUI graphical interface alternative.
Troubleshoot a specific error message you are currently seeing in your environment.