The Silent Listeners
When you are managing an Ubuntu Linux server, security and performance dictate that you must know exactly what your machine is doing on the network. Are there rogue applications secretly downloading data in the background? Did you successfully configure Nginx to listen on port 443, or is it still bound only to port 80? Has a malicious script opened a hidden backdoor port? To answer these critical questions, you need to generate a real-time list of every single active network connection and listening socket currently open on your server.
Using the ss Command
While older tutorials often recommend the netstat command, modern Linux distributions have deprecated it in favor of ss (socket statistics), which is significantly faster and provides more detailed information.
- Open your Terminal application (Ctrl + Alt + T) or log into your server via SSH.
- Type the following command:
sudo ss -tuln- Press Enter and provide your administrator password.
Understanding the Flags
The -tuln flags are a standard combination used by system administrators to filter the massive output into something readable:
- -t: Show only TCP connections (ignoring internal UNIX sockets).
- -u: Show only UDP connections.
- -l: Show only “listening” sockets (ports that are actively waiting for incoming traffic).
- -n: Numeric output. This forces the command to display raw IP addresses and port numbers (like
0.0.0.0:80) instead of trying to resolve them into slow, confusing hostnames (like*:http).
Identifying the Process
If you see a strange port open (for example, port 8080) and you don’t know what application is using it, you can add the -p (process) flag:
sudo ss -tulnp
This will append a new column to the far right of the output, displaying the exact Process ID (PID) and the name of the software (e.g., users:(("node",pid=1234,fd=18))) that is holding that specific port open, allowing you to instantly identify and kill rogue applications.