How to Check Open Ports and Listening Services on Linux (ss / netstat)

Knowing which ports are open on your server — and which service is listening on each — is basic hygiene for security and troubleshooting. An unexpected open port can be a warning sign; a closed one explains why a service is unreachable. The modern tool for this is ss, with the older netstat still widely used.

You will need SSH access.

Step 1: List listening ports with ss

ss -tulnp

That combination is worth remembering: tcp, udp, listening only, numeric ports, and process names. The output shows each open port and the program behind it.

Step 2: Read the results

• Local Address:Port — 0.0.0.0:80 means listening on all interfaces; 127.0.0.1:3306 means local-only (good for databases).
• Process — the service holding the port, so you know what it is.

A database showing 0.0.0.0 instead of 127.0.0.1 is a red flag — it is exposed to the internet when it probably should not be.

Step 3: The netstat equivalent

If you prefer or inherited netstat:

netstat -tulnp

It reads almost identically. Install it via the net-tools package if it is missing.

Turning this into action

If you find a service listening that should not be, stop or firewall it. For which ports your control panel legitimately needs open, see our reference on server ports, and lock the rest down. Pair this with Fail2Ban to protect the ports you do keep open.

Frequently asked questions

ss or netstat — which should I use?

ss is the modern, faster replacement and is installed by default on current systems. Use it unless you are on an old server where only netstat is present; they show the same information.

I see a port open I do not recognise.

Check the process name in the output first — it is often a legitimate service you forgot about. If you cannot account for it, investigate the process, and scan the server for compromise if it looks suspicious.

How do I check a port from outside the server?

These commands show ports from inside. To see what the outside world can reach, a firewall may still be blocking a locally-open port — test externally with a port-checking tool, remembering that a filtered port can be open locally yet unreachable remotely.