A Linux server communicates with the outside world through hundreds of digital gateways known as “ports.” If you are running a public-facing web server, port 80 (HTTP) must be open and actively listening for incoming traffic from browsers. If you are managing the server remotely, port 22 (SSH) must be open to accept your commands. However, if a malicious hacker successfully breaches your machine, they will almost always secretly open a hidden port (a backdoor) to maintain permanent access to the system. As a responsible systems administrator, you must be able to view exactly which network ports are currently open and actively listening on your machine. The modern, fastest tool for this job is the ss (Socket Statistics) command.
Replacing Netstat with SS
Historically, Linux administrators used the older netstat command to view this data. However, netstat is officially deprecated and is not installed on modern distributions (like Ubuntu 22.04 or RHEL 9). The ss utility replaces it entirely, offering significantly faster performance because it interacts directly with the kernel’s internal networking space.
How to View All Open Listening Ports
To generate a clean, highly structured table of all listening ports, you must use a specific combination of flags.
- Open your terminal application or connect to your server via SSH.
- Type the following command and press Enter:
ss -tulnUnderstanding the Output Flags
The command looks like gibberish, but each letter serves a highly specific, vital purpose in filtering the massive amount of data the kernel returns.
- -t : Instructs the command to only display TCP ports (the most common type of web traffic).
- -u : Instructs the command to also display UDP ports.
- -l : This is the most critical flag. It filters the list to only show listening ports. (Without this flag, the terminal would flood with thousands of lines showing every single temporary, active connection).
- -n : Forces the output to display raw numerical IP addresses and port numbers. (Without this flag, the kernel wastes time trying to resolve DNS hostnames, making the command painfully slow and the output difficult to read).
Analyzing the Results
Look at the column labeled Local Address:Port. You will see entries like 0.0.0.0:22 (which means the SSH daemon is listening on all network interfaces) or 127.0.0.1:3306 (which means a MySQL database is running, but is safely locked down to local traffic only). Reviewing this column regularly allows you to instantly identify any suspicious, unauthorized, or forgotten services running on your hardware.