Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Start by checking which process is trying to connect, the exact server URL, and the network environment where the scanner runs. A scanner on your computer, inside a container, or on a CI runner may need a different address to reach the same server. Also, some code scanners analyze files locally and do not need a server for that scan; their connection error may instead involve login, uploads, policy checks, or syncing results.
First confirm that this scan needs a server
Some tools can analyze local files without contacting a server, while other commands or features need an account or platform connection. For example, Semgrep Community Edition documents local scanning without login (Semgrep Community Edition). Snyk CLI’s default API connection is to Snyk’s hosted API, though its API connection can be configured (Snyk CLI API configuration). Check the documentation for the specific scanner and command: a server may be required for uploads or policy features, but not for local analysis.
![Computer Networking Bible: [3 in 1] The Complete Crash Course to Effectively Design, Implement and Manage Networks. Including Sections on Security, Performance and Scalability](https://m.media-amazon.com/images/I/41H4YJnxKgL._SL160_.jpg)
Identify where the scanner runs and where the server lives
“Local server” can mean several different network locations. The address must be valid from the scanner’s point of view, not merely from a browser on your desktop.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Both run directly on the same machine:
localhostor127.0.0.1may work if the server listens on the port and interface the scanner uses. - Scanner runs in a container; server runs on the host: container loopback points to the container, not the host. Docker Desktop provides
host.docker.internalfor reaching a host service; on Linux, Docker documents ahost-gatewaymapping for this name, subject to runtime and configuration (Docker Desktop networking; Docker container run reference). - Scanner and server are separate Compose services: use the server’s Compose service name and its container port when both services share a network. Compose service names remain usable when containers are replaced, while their IP addresses can change (Docker Compose networking).
- Server runs on another computer: use an address and port reachable from the scanner’s machine, taking its VPN, VM, WSL, NAT, and LAN routing into account.
Docker’s networking overview explains how networks isolate containers and connect them to other endpoints (Docker networking overview). A successful test from the host does not prove a container or CI runner can reach the same endpoint.
#1 Best Overall
Run three checks from the scanner’s environment
Run these checks in the same shell, container, CI runner, or service account that launches the scan. Replace HOST and PORT with the configured server values. Start with the URL the scanner actually uses, including scheme, port, and any path prefix required by a reverse proxy.
1. Test the TCP port
On Windows PowerShell:
Test-NetConnection -ComputerName HOST -Port PORT
Microsoft documents this command for testing TCP connectivity to a specified remote port (Test-NetConnection documentation). On Linux, inspect listening sockets on the server with ss -ltnp; showing process details may require suitable permissions. A failed connection alone cannot distinguish a stopped service from a wrong address, firewall rejection, or routing problem.
2. Make an HTTP or HTTPS request
Use the protocol the server is configured to serve:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →curl -v --connect-timeout 5 http://HOST:PORT/
curl -v --connect-timeout 5 https://HOST:PORT/
If HTTPS certificate trust is the issue, test with the correct CA bundle:
curl --cacert ca-bundle.pem https://HOST:PORT/
curl -v can expose sensitive request or response details, so redact output before sharing it. Do not use -k or --insecure as a fix: disabling certificate verification makes a transfer insecure. See the curl man page, curl certificate FAQ, and curl HTTPS guidance.
3. Compare hostname and IP carefully
If the hostname fails, test whether it resolves in the scanner’s environment and compare with the server’s IP address. If the IP works but the hostname does not, investigate DNS, search domains, container DNS, or VPN and split-DNS settings. For HTTPS, keep the hostname in the URL when validating the final setup: a certificate may not match a request made to an IP address.
Use the error to choose the next check
These are diagnostic clues, not guaranteed explanations. Correlate the client’s exact message with server logs and the test results above.
| Symptom | What it suggests | Next check |
|---|---|---|
| Name-resolution error | The client could not resolve the hostname. | Check spelling, DNS and search domains, container DNS, and VPN or split-DNS context. |
| Connection refused | The address may be reachable, but no service accepts that port, or a firewall actively rejected it. | Confirm the server process, listening port, bind address, and server-side logs. |
| Timeout | The client did not get a timely response; routing, firewall drops, VPN, NAT, or an unreachable runtime are possible causes. | Test the route and port from the scanner’s environment; inspect relevant firewall and network rules. |
| TLS or certificate error | A TLS-speaking endpoint may have been reached, but the handshake or certificate validation did not complete. | Check HTTP versus HTTPS, certificate validity, hostname match, trust chain, and the scanner’s CA store. |
| HTTP 401 or 403 | The server responded, but the request was not authenticated or authorized. | Check token validity and scope, account, and required permissions or roles. |
| HTTP 404 | The server responded but did not find the requested route. | Check the URL path, base path, reverse-proxy routing, and server version. |
| HTTP 5xx | The request reached an HTTP server that reported a server-side failure. | Inspect server logs and dependencies. |
| Works on host, fails in container | The two tests use different network contexts. | Use an address valid from the container and verify network membership or published ports. |
Check the server listener and container port mapping
A server can be running but listening only on loopback, the wrong port, or an interface the scanner cannot reach. Confirm the actual listener on the server and that its HTTP or HTTPS configuration matches the client URL.
Container service to host
For Docker Desktop, try host.docker.internal from the container. Docker documents Linux host-gateway mapping, but availability depends on the runtime and configuration; verify the mapping rather than assuming the name resolves.
Container to container
When services share a Compose network, address the server by its service name and use its container port. A host-published port is intended for clients outside that network. Prefer service names over fixed container IPs because addresses can change after recreation (Docker Compose networking).
Host to container
Publish the port, for example with -p HOST_PORT:CONTAINER_PORT, and inspect the actual mapping with docker port CONTAINER. Docker’s run reference distinguishes exposed container ports from ports published to the host; EXPOSE alone does not publish a port (Docker run reference).
Consider exposure before changing the bind address. Binding a published port to 127.0.0.1 restricts access to the Docker host; publishing without a host IP can bind on all interfaces. Docker documents a localhost-publishing caveat for Engine releases older than 28.0.0 on the same layer-2 segment (Docker port publishing and mapping). If access from another machine is required, prefer a specific trusted interface or narrow firewall rule over exposing a development service broadly.
Best Value
- Used Book in Good Condition
Separate network, proxy, TLS, and permission problems
Firewall and proxy
Check the relevant inbound and outbound rules for the specific source, destination, and port. Do not disable firewalls globally to test a connection. Also inspect proxy environment variables and scanner-specific proxy configuration: a request intended for a local address may be routed through a proxy or blocked by proxy policy. Change only the narrow rule or bypass needed for the intended endpoint, following your organization’s policy.
TLS trust
Confirm the URL uses the protocol the server actually serves. For HTTPS, verify that the certificate is current, issued through a trusted chain, and valid for the hostname in the URL. If a corporate CA or self-signed certificate is used, install the appropriate trust anchor in the scanner runtime’s trust store or configure the client to use the correct CA bundle. Do not permanently suppress certificate verification; it can hide a wrong endpoint or trust configuration and leaves the connection vulnerable to interception (curl FAQ).
Authentication and authorization
A 401 or 403 response means the HTTP endpoint answered; it is not the same as a TCP connection failure. Check for an expired or incorrect token, wrong account, insufficient token scope, or missing role. Avoid pasting tokens into commands that may be saved in shell history or shared logs.
For intermittent errors, check readiness and changing network details
If connections work sometimes, look for server restarts, startup races, resource pressure, proxy timeouts, DNS caching, and changing container addresses. In Compose, service-name discovery avoids relying on an IP that can change when a container is recreated (Docker Compose networking). Ensure the scanner starts only after the server is ready to accept requests, not merely after its process has launched.
Collect useful details before escalating
- The exact error text and timestamp, plus the scanner’s version and the server’s version.
- The redacted endpoint: preserve scheme, hostname, port, and path structure, but remove credentials, tokens, and sensitive query values.
- Where the scanner runs (host, container, Compose service, VM, WSL, or CI runner) and how it is launched.
- The TCP and HTTP/TLS test results from that same environment, along with relevant server and proxy logs.
- Any recent changes to DNS, VPN, certificates, firewall rules, container networks, or server configuration.
Review verbose output and logs before sharing them. They can contain authorization headers, tokens, internal hostnames, or other sensitive data.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
