If you have just installed a brand new Apache web server on your Linux machine, but nobody on the internet can access your website, you have a networking problem. The first step in diagnosing any networking issue is verifying that the software is actually “listening” on the correct communication channel. In networking terminology, these channels are called Ports (e.g., Port 80 for HTTP, Port 22 for SSH).
You must query the Linux kernel to see exactly which ports are open, and which specific applications are holding them open. You can do this locally (from inside the server) using ss or netstat, or you can do it externally (from a different computer) using nmap or telnet.
Method 1: Check Local Ports Using the “ss” Command
The ss (Socket Statistics) command is the modern industry standard for inspecting open ports in Linux. It is incredibly fast and is pre-installed on almost every distribution.
- Open your terminal or SSH into your server.
- Type this exact command:
sudo ss -tuln
- Press Enter.
Here is what those specific flags are doing:
-t: Show TCP ports (the standard internet protocol).-u: Show UDP ports (used for fast, connectionless data like video streaming or DNS).-l: Only show “Listening” ports (ports that are actively waiting for an incoming connection).-n: Show raw numerical addresses instead of trying to resolve them into slow hostnames.
The terminal will print a clean table. Look at the column labeled Local Address:Port. If you see 0.0.0.0:80, it means Port 80 is wide open and listening to all incoming IPv4 traffic. If you see 127.0.0.1:3306, it means Port 3306 (MySQL) is open, but it is restricted only to internal localhost traffic (the outside internet cannot see it).
How to See the Application Name
If you see a random port open (like Port 8080) and want to know exactly what software is using it, add the -p flag.
sudo ss -tulnp
The final column will now print the exact process ID (PID) and the name of the software (e.g., users:(("nginx",pid=1234,fd=6))).
Method 2: Check Local Ports Using “netstat”
If you are working on a very old legacy server (like CentOS 6), the ss command might not exist. You must use its predecessor, netstat. (Note: You can install netstat on modern systems by running sudo apt install net-tools).
The syntax is completely identical to the ss command.
sudo netstat -tulnp
This will output a nearly identical table, showing the protocol (TCP/UDP), the local address, the state (LISTEN), and the PID/Program name holding the port open.
Method 3: Test Externally Using “telnet” (The Firewall Check)
This is the most critical step in network troubleshooting. Just because ss says Port 80 is open on the server does NOT mean the internet can reach it. An external firewall (like AWS Security Groups or UFW) might be blocking the connection before it even hits the software.
To test this, you must go to a completely different computer and try to knock on the door.
- Open a terminal on your personal laptop (not the server).
- Type
telnet, followed by the server’s IP address, followed by a space, followed by the Port number you want to test. For example:
telnet 198.51.100.25 80
- Press Enter.
There are only three possible outcomes:
- Outcome A (Success): The terminal will say “Connected to 198.51.100.25.” The port is open, and the firewall is allowing traffic through. (Press Ctrl+] and type ‘quit’ to exit).
- Outcome B (Connection Refused): The terminal will instantly reject you. This means the firewall let you through, but the software on the server (like Apache) is broken or not currently running.
- Outcome C (Timeout/Hanging): The terminal will freeze and say “Trying 198.51.100.25…” forever. This means a firewall is silently dropping your packets. The traffic is never even reaching the server. You must adjust your firewall rules.