The Network Listening Vector
When securing a headless Ubuntu Linux server, the absolute first step is identifying exactly which services are exposing themselves to the outside world. Every running web server, database daemon, or SSH daemon binds itself to a specific numerical port (such as 80, 443, or 22) and actively listens for incoming connections. If a rogue application or misconfigured service opens a port without your knowledge, it creates a direct vector for unauthorised access.
How to Find Open Ports and Listening Connections
While the legacy netstat command is still widely used, the modern, significantly faster, and more detailed standard in Ubuntu is the ss (socket statistics) command.
1. Open your terminal application or connect to your server via SSH.
2. To view all TCP and UDP ports that are currently in a “listening” state, execute the following command with elevated privileges:
sudo ss -tulpn
3. The terminal will immediately output a cleanly formatted table.
– The Netid column confirms whether the connection is TCP or UDP.
– The State column confirms it is LISTEN.
– The Local Address:Port column shows exactly which port is open (for example, 0.0.0.0:22 indicates SSH is listening on all IPv4 interfaces).
– Because you used sudo, the Process column will reveal the exact name and Process ID (PID) of the application holding that port open.
By executing this rapid diagnostic check, administrators can instantly identify exposed services and shut down unauthorised daemons before they can be exploited.