| ICMP | router.local or 192.168.1.1; no port | Sends an ICMP echo request and measures its reply. Payload size, TTL, and the Don't Fragment option are configurable where the operating system supports them. | You need basic host reachability or path latency. A failed probe does not necessarily mean the host is offline because firewalls commonly block ICMP. |
| TCP | host:port; port required | Opens a TCP connection and reports success when the connection is established. An optional payload can be sent, but no application response is validated. | You only need to know whether a TCP port accepts connections, or NetSonar has no protocol-specific probe for the service. |
| UDP | host:port; port required | Sends the configured payload and waits for a reply from the remote endpoint. Sending alone is not considered success. | The service uses a request/reply UDP protocol. Do not use it for services that normally send no response to an arbitrary payload. |
| TLS | host or host:port; default 443/TCP | Performs an SNI-aware TLS handshake using the operating system's certificate trust and hostname validation, then reports the negotiated TLS version. | You need to validate TLS independently of an application protocol, including certificate trust, hostname, and validity failures. |
| DNS | host or host:port; default 53/UDP | Queries the server for the A record of example.com and validates the transaction ID, response flags and code, echoed question, and answer count. | You need to confirm that a DNS resolver can answer a real DNS query, rather than only checking whether its host is reachable. |
| NTP | host or host:port; default 123/UDP | Sends an NTP client request and validates the response mode, version, synchronization state, stratum, timestamps, and request correlation. | You need to confirm that a time server is synchronized and returning valid NTP responses. |
| HTTP | http://host/path or https://host/path; HTTP is assumed if the scheme is omitted | Sends a GET request and completes after receiving the response headers without downloading the body. HTTP success status codes are treated as successful probes. | You need to validate a website, API route, reverse proxy, or TLS-enabled HTTPS endpoint. |
| WebSocket | ws://host/path or wss://host/path; defaults 80 and 443 | Performs the WebSocket HTTP upgrade and requires the connection to reach the Open state. Paths, custom ports, and TLS through wss:// are supported. | You need to validate a WebSocket endpoint rather than only its underlying HTTP or TCP listener. |
| SSH | host or host:port; default 22/TCP | Sends a NetSonar SSH 2.0 identification, tolerates permitted server pre-banner lines, and requires a valid SSH-2.0- server identification. It does not authenticate or start key exchange. | You need to confirm that an SSH 2.0 service is responding instead of only checking whether port 22 is open. |
| SMTP | host or host:port; default 25/TCP | Connects and validates a complete single-line or multiline SMTP 220 greeting. It does not start TLS or authenticate. | You need to confirm that a plain SMTP listener is ready. Custom ports such as 587 work when the server sends its greeting before STARTTLS. |
| IMAP | host or host:port; defaults 143/TCP, with implicit TLS on 993/TCP | Requires an OK or PREAUTH greeting, sends a tagged CAPABILITY command, and validates both the capability data and successful tagged completion. Port 993 negotiates TLS with certificate and hostname validation before the IMAP exchange. It does not issue STARTTLS or authenticate. | You need to validate a cleartext or implicit-TLS IMAP listener without accessing a mailbox. |
| MQTT | host or host:port; default 1883/TCP | Sends an MQTT 3.1.1 CONNECT packet with a randomized client ID and clean session, then requires an accepted CONNACK response. It does not use TLS or credentials. | You need to validate an anonymous, plain-TCP MQTT broker. Brokers that require authentication correctly reject this probe. |
| STUN | host or host:port; default 3478/UDP | Sends a Binding request and validates the response type, declared length, magic cookie, transaction ID, attribute framing, and mapped address. | You need to validate a STUN server or diagnose UDP and NAT traversal availability. |
| SIP | host or host:port; default 5060/UDP | Sends an unauthenticated OPTIONS request, correlates Via branch, Call-ID, and CSeq fields, ignores provisional responses, and requires a successful final response. | You need to monitor a SIP server, PBX, proxy, or VoIP endpoint that accepts OPTIONS over UDP. |
NetSonar
