How to List Open Ports in Linux

A network port is a virtual point where network connections start and end. When an application runs on a Linux server—whether it is a web server like Nginx, a database like MySQL, or a secure shell service like SSH—it “listens” on a specific port for incoming traffic. Monitoring which ports are open and actively listening is a fundamental task for system administration and cybersecurity. If a port is open that you did not authorize, it could indicate a misconfiguration or a compromised system.

Why Check Open Ports?

Auditing open ports serves two primary functions:

• Troubleshooting: If you just installed a web server and it isn’t loading in your browser, checking the ports will tell you if the service is actually running and listening on port 80 (HTTP) or 443 (HTTPS).
• Security: Minimizing your attack surface means closing every port that isn’t strictly necessary. Listing your open ports is the first step in creating a strict firewall policy.

Method 1: Using the ‘ss’ Command (The Modern Standard)

For many years, the netstat command was the standard tool for this job. However, netstat is now considered deprecated in modern Linux distributions. The replacement is the ss (socket statistics) command, which is faster and displays more detailed information.

1. Open your terminal application or connect via SSH.
2. Type the following command and press Enter:
   sudo ss -tuln

You must run this command with sudo (root privileges) to see all processes; otherwise, some system-level ports will be hidden from you. Let’s break down the flags used:

• -t (TCP): Shows Transmission Control Protocol ports.
• -u (UDP): Shows User Datagram Protocol ports.
• -l (Listening): Only shows ports that are actively listening for incoming connections (ignoring established, ongoing connections).
• -n (Numeric): Displays the raw port numbers (e.g., 80) instead of trying to resolve them to service names (e.g., “http”), which makes the output much faster and easier to read.

To see the actual name of the program listening on the port, add the -p flag (e.g., sudo ss -tulnp). This will add a column showing the exact process (like nginx or sshd).

Method 2: Using the ‘lsof’ Command

The lsof (List Open Files) command is another incredibly powerful tool. Because Linux treats everything (including network sockets) as a file, lsof can show you exactly which application is holding a port open.

1. Run the following command:
   sudo lsof -i -P -n | grep LISTEN

• -i: Limits the output to internet/network files.
• -P and -n: Prevents the command from resolving port numbers and hostnames, drastically speeding up the query.
• grep LISTEN: Filters the massive output to only show services actively listening.

Troubleshooting Port Conflicts

A common issue when starting a new service is the “Port already in use” error.

• Identifying the Culprit: If you try to start Apache but it fails because port 80 is in use, you can use ss or lsof to find the conflict. Run sudo lsof -i :80. The output will immediately list the process (perhaps an old instance of Nginx) that is hogging the port. You can then use the kill command to terminate that specific process ID (PID) and free up the port.

By regularly auditing your open ports, you maintain strict control over the traffic entering and exiting your Linux environment.