From "is it up" to "which hop is broken"
These five tools form a natural escalation path for network troubleshooting: start with a basic reachability check, move to mapping the path, then to continuous per-hop monitoring, then narrow to a specific service port, and separately check whether an IP itself carries a bad reputation.
Ping — is it reachable at all
Ping sends ICMP echo requests to a host and measures whether it responds, plus round-trip time for each reply.
When to use it: the quick first check when a server or service seems unreachable, monitoring round-trip latency over a short window, or confirming basic connectivity before debugging anything more complex.
Reading results: 100% packet loss usually means a firewall is blocking ICMP, not that the host is actually down — many servers intentionally don't respond to ping. Latency and loss percentage matter more than any single response time in isolation.
Traceroute — mapping the path
Traceroute maps every network hop between our server and a destination, showing the IP and response time at each point along the way.
When to use it: identifying where in the network a connection is slowing down or failing, understanding the general route traffic takes for CDN or peering investigation, or as a first step before running MTR for more detailed data.
Reading results: asterisks at a hop usually mean that router doesn't respond to traceroute probes at all — not necessarily a problem, since many routers are configured that way intentionally. A hop where latency jumps sharply and stays high for every subsequent hop is the more useful signal to chase.
MTR — traceroute and ping, continuously
MTR (My Traceroute) combines traceroute and ping into one continuous test, showing packet loss and latency at every hop over time rather than a single snapshot.
When to use it: diagnosing intermittent issues a single ping or traceroute wouldn't catch, identifying exactly which hop is introducing latency or dropping packets, or providing evidence to an ISP or hosting provider about a routing problem.
Reading results: loss at a single hop in the middle of the path is often cosmetic — many routers deprioritize ICMP traffic. Loss that's consistent at the final hop, or that increases progressively along the path, is the signal that actually matters.
Port Check — is the service listening
Port Check attempts a TCP connection to a specific port on a host and reports whether it's open, closed, or filtered.
When to use it: verifying a firewall rule actually opened the port you intended, confirming a service is listening before debugging the application layer above it, or checking from outside your network whether a port that should be closed actually is.
Reading results: "Open" means a TCP handshake completed. "Closed" means the host actively refused the connection. "Filtered" — a timeout with no response — usually means a firewall is silently dropping packets, which is the expected, correct state for ports that should stay closed to the public internet.
IP Reputation — is this address flagged elsewhere
IP Reputation checks an IP against abuse-report databases tracking spam, malware, brute-force attempts, and other malicious activity reported against that address.
When to use it: investigating whether an IP attempting to access your server has an abuse history, checking your own server's IP before it becomes a problem (especially relevant on shared hosting), or due diligence before whitelisting an unfamiliar IP.
Reading results: a small number of historical reports isn't necessarily disqualifying — IPs get reused, and shared hosting or cloud IPs often carry a previous tenant's history. A high volume of recent, varied abuse reports is the signal that actually matters, not the mere presence of any report at all.
How these fit together
For "why can't I reach this host," go Ping → Traceroute → MTR in that order — each gives more detail than the last, and MTR is usually overkill unless the first two didn't pin down the problem. Port Check and IP Reputation are separate questions: one confirms a specific service is listening, the other checks whether the source or destination IP itself is a problem, independent of routing.