Recommended Free Tools
“Connection refused” means a connection attempt was rejected or found no listener at the endpoint the client contacted. It does not, by itself, identify the reason. The Linux man-pages project’s connect(2) manual describes one case: “A connect() on a stream socket found no one listening on the remote address.” The practical checks are to confirm the client’s destination, verify the server’s listener, and then inspect firewall or policy rules.
What “connection refused” tells you—and what it does not
For a TCP connection, the client targets an address and port. A service must bind to a local address and port and enter listening state to receive connections. If the contacted endpoint has no listener, the attempt can be refused. A refusal can also arise from an active rejection or, in a documented Linux case, a full listening queue.
As an Amazon Associate I earn from qualifying purchases.
The precise error is useful evidence, not a complete diagnosis. POSIX distinguishes ECONNREFUSED from ETIMEDOUT, ENETUNREACH and EHOSTUNREACH; these indicate different outcomes. Network intermediaries and client libraries can affect how an error is presented, so the displayed message alone may not identify the device or rule involved. See the POSIX connect() specification.
The three causes to check
| Possible cause | Where to look | Evidence to seek |
|---|---|---|
| No service listening at the contacted endpoint | Server process and listening sockets | The service is stopped, failed to start, or no listener exists on the target address and port |
| Service listening at a different endpoint | Client destination compared with server bind address and port | The client uses the wrong address or port, or the service listens only on loopback or another interface |
| Active firewall or policy rejection | Host and network policy, plus relevant logs | An applicable reject rule or log entry; the client error alone does not prove this cause |
1. Nothing is listening at the target
The service may be stopped, may have failed during startup, or may not have opened a listener. The Linux man-pages project states in connect(2): “A connect() on a stream socket found no one listening on the remote address.” Check service status and the server’s listening sockets using the tools appropriate to its operating system.
#1 Best Overall
2. The service is listening somewhere else
A running process is not necessarily reachable at the endpoint the client uses. Compare the client’s actual destination address and port with the service’s configured bind address and listening port. A service bound only to loopback, for example, is listening on the local host interface rather than necessarily accepting connections on another interface. Confirm the hostname’s resolved address, the port, and whether the client is on another host or in a container; container networking details depend on the platform and are not covered by a universal command here.
3. A firewall or policy actively rejects the attempt
A firewall or other policy can reject a connection, but not every ECONNREFUSED means a firewall is responsible. The Linux connect(2) documentation also describes local firewall-rule failures reported as EACCES or EPERM. The surfaced error can differ with the rule, network path and operating system. Once the target and listener are verified, inspect applicable host or network policy and its logs.
A less common Linux case: a full listening queue
Linux documents that a request arriving when a listening queue is full may give the client ECONNREFUSED. If the protocol supports retransmission, a request may instead be ignored and a later retry may succeed. This is a possible backlog or load condition, not proof that every busy server refuses connections immediately. See the Linux listen(2) manual.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A practical diagnostic order
- Confirm the client’s target. Check the hostname resolution, destination IP address, port and protocol. Establish whether the client runs on the same host, another host or inside a container.
- Check the service and listener on the server. Verify that the service process is running and that a socket is listening. On Linux, use the system’s current service-management and socket-inspection tools; commands and options vary by distribution and tool version. The socket setup sequence is bind, listen, then accept, as described in the Linux
bind(2),listen(2)andaccept(2)manuals. - Compare the destination with the bind address and port. Make sure the client is targeting the address and port where the service actually listens, and check whether the listener is limited to loopback or another interface.
- Inspect policy after endpoint checks. Review relevant host and network firewall rules and logs for an explicit rejection. A client-side refusal message does not identify the responsible device or rule.
- Use the exact error and connection context. Distinguish refusal from timeout or unreachable-network/host errors, and note whether the connection crosses a proxy, container boundary or other network intermediary.
If the connection uses a local UNIX socket
Not every connection uses a TCP address and port. For a local UNIX-domain socket, check that the pathname refers to a socket and that a process is listening there. Linux documents a refused connection in this context as well; see unix(7).
The commands, error presentation and firewall controls discussed here are not universal across Windows, macOS, Linux distributions, containers and cloud platforms. Use the documentation for the specific environment before applying platform-specific steps.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
