How to View Open Ports in a Linux System

1. 1. Use the netstat command to view

• Basic syntax：netstat -tuln。

• Here, the -t option indicates that only TCP protocol-related port information will be displayed; the -u option is used to show UDP protocol-related ports; the -l option indicates that only ports in the listening state will be listed, which are ports waiting to receive incoming connection requests; the -n option is to display information in numeric form (such as IP addresses and port numbers) rather than resolving port numbers to service names, making it easier to see the port numbers directly.

• Example output and explanation：

Active Internet connections (only servers)
Proto Recv - Q Send - Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:22              0.0.0.0:0               LISTEN
tcp        0      0 127.0.0.1:25            0.0.0.0:0               LISTEN
udp        0      0 0.0.0.0:68              0.0.0.0:0               ESTABLISHED

• In this output, the Proto column shows the protocol type (TCP or UDP). The Recv - Q and Send - Q columns represent the number of bytes in the receive and send queues, respectively. The Local Address column is the most important part, showing the local IP address and port number that the server is listening on, for example, 0.0.0.0:22 indicates that the server is listening on port 22 (usually for SSH) on all available local IP addresses, while 127.0.0.1:25 indicates listening on port 25 (usually for SMTP) on the local loopback address.Foreign Address column shows the remote address, which is usually 0.0.0.0:0 for listening ports, as no connection has been established yet.State column shows the state of the port, such as LISTEN indicating that the port is listening for client connection requests, and ESTABLISHED indicating that a connection has been established.

2. 2. Use the ss command to view

• Basic syntax：ss -tuln，the meaning of the parameters is basically the same as that of netstat -tuln。
• Advantages：In high-load server environments, the ss command usually performs better than the netstat command, allowing for faster retrieval of port information. Its output format is similar to that of netstat, but may be more concise and clear. For example, it can handle a large number of connections more efficiently, reducing system resource usage.

• Example output：

State       Recv - Q Send - Q      Local Address:Port      Peer Address:Port
LISTEN      0      0         0.0.0.0:22               0.0.0.0:0
LISTEN      0      0         127.0.0.1:25             0.0.0.0:0
ESTAB       0      0         0.0.0.0:68               0.0.0.0:0

• Here, the State、Recv - Q、Send - Q、Local Address:Port、and Peer Address:Port columns have meanings similar to the corresponding columns in the output of the netstat command, clearly showing the port information in different states in the system.

3. 3. Use the lsof command to view (from the process perspective)

• Basic syntax：lsof -i -n -P。

• Here, the -i option indicates displaying all network-related files (in Linux, network connections are treated as files), the -n option indicates displaying IP addresses and port numbers in numeric form, and the -P option is to avoid converting port numbers to service names.

• Example output and explanation：

COMMAND    PID   USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
sshd       1234  root    3u  IPv4  123456    0t0    TCP *:22 (LISTEN)
sendmail   1235  root    4u  IPv4  123457    0t0    TCP 127.0.0.1:25 (LISTEN)
dhclient   1236  root    6u  IPv4  123458    0t0    UDP *:68

• In this output, the COMMAND column shows the associated process name, such as sshd (SSH service process), sendmail (mail sending service process), etc. The PID column is the process ID number, the USER column shows the user who owns the process. The FD column indicates the file descriptor, which identifies how the process is associated with the network connection (e.g., 3u indicates using the third file descriptor for read/write operations). The TYPE column shows the type of connection (e.g., IPv4), the DEVICE column indicates the device number, the SIZE/OFF column indicates the file size or offset, the NODE column indicates node information, and the NAME column shows detailed information about the network connection, including the listening IP address, port number, and state (e.g., *:22 (LISTEN) indicates listening on port 22 on all local IP addresses and in the listening state). This command allows you to see which processes are using which ports from the process perspective.

Leave a Comment Cancel reply