4 Ways to Find Out What Ports Are Listening in Linux

Linux is a popular operating system that is widely used by system administrators, developers, and other tech enthusiasts. One of important tasks in managing a Linux system is to identify which ports are being used and which ones are available. In this article, we will discuss 4 ways to find out what ports are listening in Linux.

Using netstat Command

The netstat command is a powerful tool that provides detailed information about network connections, routing tables, and other related statistics. To check which ports are listening, you can use following command −

$ netstat -ltn

This command will display a list of all ports that are currently listening on system. "-l" option tells netstat to only show listening sockets, "-t" specifies TCP connections, and "-n" displays port numbers instead of resolving them to names.

Here is an example output −

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN     

The output shows that SSH daemon is listening on port 22 and CUPS printing service is listening on port 631.

Using lsof Command

The lsof command (short for "list open files") is a powerful tool that can be used to list all open files and network connections on a Linux system. To find out which ports are listening, you can use following command −

$ sudo lsof -i -P -n | grep LISTEN

This command will display a list of all open network connections on system that are in a listening state. "-i" option specifies that we are interested in network connections, "-P" tells lsof to use port numbers instead of service names, and "-n" disables hostname resolution.

Here is an example output −

sshd      2269     root    3u  IPv4  11758      0t0  TCP *:22 (LISTEN)
cupsd     2889     root    7u  IPv4  16314      0t0  TCP 127.0.0.1:631 (LISTEN)

The output shows that SSH daemon is listening on port 22 and CUPS printing service is listening on port 631.

Using ss Command

The ss command is a modern replacement for netstat command and provides similar functionality. To check which ports are listening, you can use following command −

$ sudo ss -ltn

This command will display a list of all TCP ports that are currently listening on system. "-l" option tells ss to only show listening sockets, "-t" specifies TCP connections, and "-n" displays port numbers instead of resolving them to names.

Here is an example output −

State      Recv-Q Send-Q          Local Address:Port            Peer Address:Port
LISTEN     0      128                       *:22                     *:*
LISTEN     0      5                     127.0.0.1:631                    *:*

The output shows that SSH daemon is listening on port 22 and CUPS printing service is listening on port 631.

Using nmap Command

The nmap command is a powerful tool that can be used for network exploration, security scanning, and port scanning. To check which ports are listening on a remote system, you can use following command −

$ sudo nmap -sS -p- <remote_ip>

This command will perform a TCP SYN scan on all ports on remote system and report which ports are open and listening. "-sS" option tells nmap to use a SYN scan, which is a stealthy scanning technique that can evade some network intrusion detection systems. "-p-" option tells nmap to scan all 65535 ports on system.

Here is an example output −

Starting Nmap 7.60 ( https://nmap.org ) at 2023-03-23 10:00 PDT
Nmap scan report for <remote_ip>
Host is up (0.035s latency).
Not shown: 65534 filtered ports
PORT     STATE  SERVICE
22/tcp   open   ssh
80/tcp   open   http
443/tcp  open   https

The output shows that remote system has ports 22, 80, and 443 open and listening.

Using the fuser Command

The fuser command is a simple utility that identifies processes using a particular file, directory, or socket. To check which ports are listening using the fuser command, use the following command −

$ sudo fuser -n tcp -v 1-65535

This command will display all processes using TCP ports 1 to 65535. Let's break down the options used in the command −

-n tcp tells fuser to only display TCP connections

-v tells fuser to display more verbose output

The output of the fuser command will display a list of processes using TCP ports, along with their respective PIDs.

Using the lshw Command

The lshw command is a hardware information utility that can also be used to display network information, including open ports. To check which ports are listening using the lshw command, use the following command −

$ sudo lshw -class network -short

This command will display a list of network devices on your system, along with their respective drivers and open ports.

Using the iptables Command

The iptables command is a powerful firewall utility that can be used to display and manipulate firewall rules, including open ports. To check which ports are listening using the iptables command, use the following command −

$ sudo iptables -L -n

This command will display the current firewall rules on your system, including any open ports that are allowed through the firewall.

Conclusion

Identifying which ports are listening on a Linux system is an important task for system administrators, developers, and security professionals. In this article, we discussed 4 ways to find out what ports are listening in Linux: using netstat command, using lsof command, using ss command, and using nmap command. Each of these methods has its own strengths and weaknesses, and you should choose one that best fits your needs. With these tools in your arsenal, you can better manage your Linux system and keep it secure.