How to Check if an MQTT Port Is Open (nc, telnet, nmap)

To check whether an MQTT port is open, run nc -vz -w 5 broker.connectmq.com 1883 on Linux or macOS, or Test-NetConnection broker.connectmq.com -Port 1883 in PowerShell. "Succeeded" means a TCP connection was accepted; "refused" or "timed out" tells you where to look next. This guide shows each tool, what its output means, and how to tell a firewall problem from a broker problem.

The ports to check

Exact numbers depend on the broker's configuration — see MQTT ports explained. For the examples below we use broker.connectmq.com, which listens on 1883, 8883, 8083 and 8084.

nc (netcat) — Linux and macOS

nc -z opens a TCP connection and closes it without sending data; -v prints the result and -w 5 gives up after five seconds.

nc -vz -w 5 broker.connectmq.com 1883

Connection to broker.connectmq.com port 1883 [tcp/ibm-mqtt] succeeded!
nc: connect to broker.connectmq.com port 1883 (tcp) failed: Connection refused
nc: connect to broker.connectmq.com port 1883 (tcp) failed: Connection timed out

The exact wording varies between netcat variants (macOS prints connectx to ..., some builds print open), but the three outcomes are always the same. Check all MQTT ports in one go:

for p in 1883 8883 8083 8084; do nc -vz -w 5 broker.connectmq.com "$p"; done

No nc installed? Bash can open a TCP socket by itself:

timeout 5 bash -c '</dev/tcp/broker.connectmq.com/1883' && echo open || echo closed

telnet

telnet is still installed on many servers and works on Windows once the Telnet Client feature is enabled:

telnet broker.connectmq.com 1883

Trying 203.0.113.10...
Connected to broker.connectmq.com.
Escape character is '^]'.

Connected to means the port is open. Press Ctrl+] and type quit to leave. If you instead see telnet: Unable to connect to remote host: Connection refused, nothing accepted the connection; a long pause followed by Connection timed out points to a filter in between. Don't type anything after connecting — MQTT is a binary protocol, and the broker will close the connection once its connect timeout expires without a valid CONNECT packet. That is normal.

nmap — several ports and their state

nmap reports a clear state for every port, which makes it the best tool to separate "closed" from "filtered":

nmap -Pn -p 1883,8883,8083,8084 broker.connectmq.com

PORT     STATE    SERVICE
1883/tcp open     mqtt
8883/tcp open     secure-mqtt
8083/tcp open     us-srv
8084/tcp filtered websnp

-Pn skips the ping check, which many cloud hosts block. The SERVICE column is just nmap's port-number guess, not proof that MQTT is running there.

PowerShell Test-NetConnection — Windows

Test-NetConnection broker.connectmq.com -Port 1883

ComputerName     : broker.connectmq.com
RemoteAddress    : 203.0.113.10
RemotePort       : 1883
TcpTestSucceeded : True

On failure you'll see WARNING: TCP connect to (203.0.113.10 : 1883) failed and TcpTestSucceeded : False. Use -InformationLevel Quiet to get just True / False for scripts. If a local broker is unreachable from other machines, the Windows Defender Firewall is a frequent cause — see MQTT and the Windows firewall.

Reading the result: firewall or broker?

Then run the same check from a second network — your phone's hotspot, a cloud VM, a colleague's machine. If the port is open from outside but not from your office, your network blocks it (common for 1883 and 8883 on corporate and guest Wi-Fi; see MQTT behind a corporate firewall). If it's closed everywhere, the problem is on the broker side.

On the broker host: is anything listening?

If you run the broker yourself and see "refused", check what is listening:

sudo ss -ltnp | grep -E '1883|8883'        # Linux
sudo lsof -iTCP -sTCP:LISTEN -n -P | grep -E '1883|8883'   # macOS

netstat -ano | findstr :1883

A listener on 127.0.0.1:1883 accepts only local connections. Mosquitto 2.x does this by default when no listener is configured and logs Starting in local only mode. Connections will only be possible from clients running on this machine. Add an explicit listener (and authentication) to accept remote clients:

listener 1883 0.0.0.0
allow_anonymous false
password_file /etc/mosquitto/passwd

The Mosquitto config generator builds a complete file with TLS and WebSocket listeners. In Docker, also check that the port is published (-p 1883:1883).

Open port, still no connection? Test the next layer

An open port proves only that TCP works. Two quick checks cover the layers above it:

openssl s_client -connect broker.connectmq.com:8883 -servername broker.connectmq.com </dev/null

mosquitto_pub -h broker.connectmq.com -p 1883 -t testmqtt/port-check/ping -m ok -d

With -d, a healthy broker shows a sending CONNECT line followed by received CONNACK (0). A non-zero CONNACK is an authentication or protocol problem — look the code up with the reason codes tool. If TLS hangs on 1883 or MQTT fails on 8883, you have mixed up the plain and TLS ports. Certificate errors are covered in testing a TLS connection. Finally, connect with the online MQTT client to confirm a full publish/subscribe round trip.

Confirm with a real MQTT round trip

Checking a port takes seconds and splits the problem in two: if TCP fails, it's a network, firewall or listener issue; if TCP succeeds, look at TLS, credentials and MQTT itself. Run the check from more than one network, read "refused" and "timed out" differently, and you'll know where to look before opening a single log file.

Frequently asked questions