How to Check Open Ports in Linux

Network ports serve as communication endpoints for applications and services running on Linux systems. Understanding which ports are open and listening helps maintain system security, troubleshoot connectivity issues, and monitor service availability across your infrastructure. This article covers comprehensive methods to check open ports in Linux using built-in tools and utilities. You will learn to identify listening services, examine network connections, and implement monitoring practices to maintain visibility into your system’s network activity.

Prerequisites

Before following this guide, ensure you have:

• A Linux system (Ubuntu, CentOS, RHEL, or similar distribution)
• Basic command-line familiarity
• Standard user account with sudo privileges
• Network utilities installed (most are included by default)

Understanding Ports and Network Connections

Linux systems use TCP and UDP ports to facilitate network communication between applications and services. TCP ports provide reliable, connection-oriented communication, while UDP ports offer faster, connectionless data transmission for specific use cases. Port numbers range from 1 to 65535, with well-known ports (1-1023) reserved for system services like HTTP (80), HTTPS (443), and SSH (22). Dynamic or private ports (49152-65535) are typically used for client connections and temporary services. Understanding port states helps interpret network information: LISTEN indicates a service accepting connections, ESTABLISHED shows active connections, and TIME_WAIT represents connections in closing state.

Check Open Ports Using netstat

The netstat command provides comprehensive network connection information and remains one of the most widely used tools for port monitoring across Linux distributions.

1. 1. Display all listening ports with associated services.

$ sudo netstat -tuln

The flags represent: -t for TCP ports, -u for UDP ports, -l for listening ports only, and -n for numerical addresses instead of hostnames.

1. 1. Show listening ports with process information.

$ sudo netstat -tulnp

The -p flag displays process ID and name for each listening service.

1. 1. Filter results to show only TCP listening ports.

$ sudo netstat -tln

1. 1. Display all network connections including established connections.

$ sudo netstat -tuan

The -a flag shows all connections, not just listening ports.

1. 1. Check specific port status.

$ sudo netstat -tln | grep :22

$ sudo netstat -tln | grep :80

Replace the port numbers to check specific services.

Use ss Command for Modern Port Checking

The ss (socket statistics) command provides faster and more detailed network information than netstat, making it the preferred tool for modern Linux systems.

1. 1. Display all listening TCP and UDP ports.

$ sudo ss -tuln

1. 1. Show listening ports with process information.

$ sudo ss -tulnp

1. 1. Display detailed socket information.

$ sudo ss -tulnp -e

The -e flag shows extended socket information including memory usage and connection details.

1. 1. Filter connections by state.

$ sudo ss -t state listening

$ sudo ss -t state established

1. 1. Check specific port or service.

$ sudo ss -tuln | grep :443

$ sudo ss -tuln sport = :22

The sport (source port) syntax provides more precise filtering.

Check Ports with lsof Command

The lsof (list open files) command shows which processes have opened specific ports, providing detailed process and user information.

1. 1. List all network connections.

$ sudo lsof -i

1. 1. Show only listening ports.

$ sudo lsof -i -P | grep LISTEN

The -P flag prevents port number to service name conversion for faster output.

1. 1. Check specific port usage.

$ sudo lsof -i :22

$ sudo lsof -i :80

$ sudo lsof -i :443

1. 1. Display TCP connections only.

$ sudo lsof -i TCP

1. 1. Show UDP connections.

$ sudo lsof -i UDP

1. 1. List connections by specific user.

$ sudo lsof -u username -i

Use nmap for Port Scanning

Nmap provides powerful port scanning capabilities for both local and remote systems, offering detailed information about service detection and port states.

1. 1. Install nmap if not already available.

$ sudo apt update && sudo apt install nmap

On CentOS/RHEL systems:

$ sudo yum install nmap

1. 1. Scan localhost for open ports.

$ nmap localhost

$ nmap 127.0.0.1

1. 1. Perform comprehensive local scan with service detection.

$ sudo nmap -sS -sU -O localhost

The flags enable TCP SYN scan (-sS), UDP scan (-sU), and OS detection (-O).

1. 1. Scan specific port ranges.

$ nmap -p 1-1000 localhost

$ nmap -p 22,80,443 localhost

1. 1. Fast scan of common ports.

$ nmap -F localhost

[!WARNING] Use nmap responsibly and only scan systems you own or have explicit permission to test. Unauthorized port scanning may violate security policies or legal regulations.

Check Ports Using /proc File System

The Linux /proc filesystem provides direct access to kernel information about network connections without requiring additional utilities.

1. 1. View TCP connections from kernel perspective.

$ cat /proc/net/tcp

1. 1. Display UDP connections.

$ cat /proc/net/udp

1. 1. Show listening sockets in human-readable format.

$ awk 'NR>1 {print $2}' /proc/net/tcp | sed 's/.*://' | sort -u

This command extracts and sorts unique port numbers from TCP connections.

1. 1. Check IPv6 connections.

$ cat /proc/net/tcp6

$ cat /proc/net/udp6

Monitor Ports with Custom Scripts

Create monitoring scripts to automate port checking and generate reports for regular system maintenance and security auditing.

1. 1. Create a comprehensive port monitoring script.

$ nano ~/check-ports.sh

Add the following content:

#!/bin/bash  
echo "=== Port Status Report - $(date) ==="  
echo  
echo "Listening TCP Ports:"  
ss -tln | grep LISTEN | awk '{print $4}' | sed 's/.*://' | sort -n | uniq  
echo  
echo "Listening UDP Ports:"  
ss -uln | awk 'NR>1 {print $4}' | sed 's/.*://' | sort -n | uniq  
echo  
echo "Top 10 Network Connections by Process:"  
ss -tulnp | grep -v State | awk '{print $7}' | sort | uniq -c | sort -nr | head -10  
echo  
echo "Unusual High-Number Ports (>10000):"  
ss -tln | grep LISTEN | awk '{print $4}' | sed 's/.*://' | awk '$1>10000' | sort -n

1. 1. Make the script executable.

$ chmod +x ~/check-ports.sh

1. 1. Run the monitoring script.

$ ./check-ports.sh

1. 1. Schedule regular port monitoring.

$ crontab -e

Add daily monitoring at 6:00 AM:

0 6 * * * /home/$(whoami)/check-ports.sh >> /home/$(whoami)/port-monitor.log 2>&1

Compare Port States Over Time

Tracking port changes helps identify new services, detect unauthorized applications, and monitor system modifications.

1. 1. Create a baseline port snapshot.

$ sudo ss -tulnp > ~/baseline-ports.txt

$ date >> ~/baseline-ports.txt

1. 1. Create a script to compare current ports with baseline.

$ nano ~/compare-ports.sh

Add comparison logic:

#!/bin/bash  
BASELINE="$HOME/baseline-ports.txt"  
CURRENT="/tmp/current-ports.txt"  
if [ ! -f "$BASELINE" ]; then    
    echo "Baseline file not found. Creating baseline..."    
    sudo ss -tulnp > "$BASELINE"    
    date >> "$BASELINE"    
    echo "Baseline created. Run script again to compare."    
    exit 0  
fi  
# Generate current port list  
sudo ss -tulnp > "$CURRENT"  
echo "=== New Listening Ports ==="  
comm -13 <(grep LISTEN "$BASELINE" | sort) <(grep LISTEN "$CURRENT" | sort)  
echo "=== Closed Ports ==="  
comm -23 <(grep LISTEN "$BASELINE" | sort) <(grep LISTEN "$CURRENT" | sort)  
rm "$CURRENT"

1. 1. Make the comparison script executable and run it.

$ chmod +x ~/compare-ports.sh

$ ./compare-ports.sh

Analyze Common Ports and Services

Understanding typical port usage helps identify normal system behavior and detect anomalies that may require investigation. Common system ports include SSH (22), HTTP (80), HTTPS (443), DNS (53), SMTP (25), and POP3 (110). Database services typically use MySQL (3306), PostgreSQL (5432), and MongoDB (27017). Application servers commonly listen on ports like 8080, 8443, or 3000, while development servers often use higher-numbered ports. Understanding your environment’s normal port usage creates a baseline for security monitoring. Unexpected high-numbered ports or services on unusual ports warrant investigation to ensure they represent legitimate applications rather than security threats.

Security Considerations for Open Ports

Every open port represents a potential attack vector, making port management crucial for system security. Regular auditing helps maintain minimal exposure while ensuring necessary services remain available. Close unnecessary services and ports to reduce attack surface. Use firewall rules to restrict access to required ports, limiting connections to specific IP addresses or networks when possible. Monitor for unexpected port openings that might indicate malware, unauthorized services, or configuration drift. Implement automated alerting for new listening ports to ensure rapid detection of changes. Consider using port knocking or VPN access for sensitive services instead of exposing them directly to networks. This approach provides additional security layers for critical administrative interfaces.

Troubleshooting Port-Related Issues

Port conflicts occur when multiple applications attempt to bind to the same port, resulting in service failures. Use the tools covered in this article to identify conflicting processes and resolve binding issues. Connection timeouts often indicate firewall restrictions, service unavailability, or network configuration problems. Verify that services are listening on expected ports before investigating network connectivity. Permission issues may prevent applications from binding to low-numbered ports (1-1023) without appropriate privileges. Ensure services run with necessary permissions or configure them to use higher-numbered ports.

Conclusion

Comprehensive port monitoring provides essential visibility into your Linux system’s network activity and security posture. You have learned to use multiple tools including netstat, ss, lsof, and nmap to examine open ports from different perspectives. The monitoring scripts and comparison tools you implemented enable ongoing port management and change detection. Your system now has robust capabilities for identifying listening services, tracking port usage over time, and detecting unexpected network activity. Regular application of these port checking techniques helps maintain system security, troubleshoot network issues, and ensure optimal service availability across your Linux infrastructure.