Send a TCP message to a remote host for network checks and infrastructure automation

Send a raw TCP payload from Kestra to any host and port, with a pre-flight reachability probe and a fail-fast assertion on the send output. This blueprint covers the network validation, infrastructure smoke testing, and socket-level health check scenarios where HTTP is not available or not appropriate, including echo servers, legacy daemons, internal appliances, and custom socket listeners.

How it works

1. check_port runs io.kestra.plugin.scripts.shell.Commands and uses the bash /dev/tcp pseudo-device to verify that {{ inputs.host }}:{{ inputs.port }} accepts a TCP connection before any payload is sent.
2. log_inputs uses io.kestra.plugin.core.log.Log to record the destination and message, giving you a durable audit trail in execution logs.
3. send_tcp uses io.kestra.plugin.fs.tcp.Send to open a TCP socket to host:port and transmit payload bytes.
4. assert_send uses io.kestra.plugin.core.execution.Assert with the condition {{ outputs.send_tcp is not null }} so the execution fails immediately if the send task did not produce an output map.

What you get

• A reusable TCP ping that turns ad hoc nc and telnet checks into versioned, auditable workflows.
• A safe pattern (probe, log, send, assert) you can drop in front of any downstream task.
• Full execution logs with the host, port, and payload for every run.
• A clear failure signal when a TCP endpoint is unreachable or silently drops the connection.

Who it's for

• Platform and SRE teams that need scheduled or event-driven reachability checks for internal services.
• DevOps engineers smoke-testing VMs, containers, and load balancers after deployment.
• Integration engineers talking to legacy systems that only expose raw TCP sockets.
• Network and security teams automating firewall and route verification across environments.

Why orchestrate this with Kestra

A bash one-liner or a cron-managed shell script can open a socket, but it cannot give you retries, alerting, lineage, and audit trails out of the box. With Kestra you get declarative YAML, event triggers (webhooks, message queues, schedules), automatic retries on transient socket errors, per-task logs, and a single place to chain TCP checks with downstream actions like Slack alerts, ticket creation, or deployment rollbacks. The TCP socket itself has no scheduler, no concurrency control, and no notion of an execution: Kestra supplies all of that.

Prerequisites

• A Kestra instance with the plugin-fs plugin available (bundled by default).
• Network connectivity from the Kestra worker to the target host:port.
• A TCP service to talk to. For local testing, run an echo server with docker run --rm -p 9090:9090 alpine/socat -v tcp-listen:9090,reuseaddr,fork system:'cat'.

Secrets

This flow uses no secrets. TCP Send does not authenticate, so if you need TLS, mutual auth, or credentials, terminate them upstream (for example with a sidecar proxy) or switch to a protocol-aware plugin.

Quick start

1. Copy this blueprint into a namespace such as company.team.
2. Set host, port, and payload inputs to point at your TCP service (defaults target 127.0.0.1:9090 with Hello from Kestra).
3. Execute the flow and confirm check_port succeeds, send_tcp returns metadata, and assert_send passes.
4. Inspect the Logs and Outputs tabs to see the recorded destination and the TCP send result.

How to extend

• Replace the static defaults with a schedule trigger to run health checks every minute.
• Add a webhook trigger so an upstream system (CI, monitoring tool, chatops bot) can fire a TCP probe on demand.
• Wrap send_tcp in a retry policy on io.kestra.core.models.tasks.retries.Constant to tolerate flaky networks.
• Fan out across many hosts with io.kestra.plugin.core.flow.ForEach and a list of targets.
• On failure, branch into a Slack, PagerDuty, or ServiceNow notification task to alert the on-call.
• Swap payload for a binary or protocol-specific frame to talk to bespoke TCP daemons.

Links

• Plugin docs: https://kestra.io/plugins/plugin-fs