- Check if port is open or closed on a Linux server?
- 8 Answers 8
- 5 ways to check if a Port is open on a remote Linux PC
- TCP and UDP ports
- Best ways to check if a Port is open on a Linux PC
- 1. netcat command
- How to Check (Scan) for Open Ports in Linux
- Introduction
- What is Open Port?
- Check Open Ports with nmap
- Check Open Ports with netcat
- Check Open Ports using Bash Pseudo Device
- Conclusion
Check if port is open or closed on a Linux server?
It’s not quite clear what you’re asking. What do you mean by «open»? Do you mean some server is listening on that port? Or do you mean it’s allowed by the system firewall? Or what?
nc -w5 -z -v
A topic that contains an answer also for kernel level services and programs serverfault.com/questions/1078483/…
8 Answers 8
You can check if a process listens on a TCP or UDP port with netstat -tuplen .
To check whether some ports are accessible from the outside (this is probably what you want) you can use a port scanner like Nmap from another system. Running Nmap on the same host you want to check is quite useless for your purpose.
GNU netstat knows the parameters -t , -u , -p , -l , -e , and -n . Thanks to the options parser it can be expressed as -tuplen . linux.die.net/man/8/netstat
Also, the telnet command usually does only supports TCP, so you’re out of luck if the service you want to check runs on another protocol.
According to article: computingforgeeks.com/netstat-vs-ss-usage-guide-linux netstat is deprecated, and ss is it’s replacement, so you can do ss -an , ss -tuplen or for tcp listening sockets ss -ntlp .
Quickest way to test if a TCP port is open (including any hardware firewalls you may have), is to type, from a remote computer (e.g. your desktop):
Which will try to open a connection to port 80 on that server. If you get a time out or deny, the port is not open 🙂
OK, in summary, you have a server that you can log into. You want to see if something is listening on some port. As root, run:
this will show a listing of processes listening on TCP and UDP ports. You can scan (or grep) it for the process you’re interest in,and/or the port numbers you expect to see.
If the process you expect isn’t there, you should start up that process and check netstat again. If the process is there, but it’s listening on a interface and port that you did not expect, then there’s a configuration issue (e.g., it could be listening, but only on the loopback interface, so you would see 127.0.0.1:3306 and no other lines for port 3306, in the case of the default configuration for MySQL).
If the process is up, and it’s listening on the port you expect, you can try running a «telnet» to that port from your Macbook in your office/home, e.g.,
telnet xxxxxxxxxxxx.co.uk 443 That will test if (assuming standard ports) that there’s a web server configured for SSL. Note that this test using telnet is only going to work if the process is listening on a TCP port. If it’s a UDP port, you may as well try with whatever client you were going to use to connect to it. (I see that you used port 224. This is masqdialer, and I have no idea what that is).
If the service is there, but you can’t get to it externally, then there’s a firewall blocking you. In that case, run:
This will show all the firewall rules as defined on your system. You can post that, but, generally, if you’re not allowing everything on the INPUT chain, you probably will need to explicitly allow traffic on the port in question:
iptables -I INPUT -p tcp --dport 224 -j ACCEPT or something along those lines. Do not run your firewall commands blindly based on what some stranger has told you on the Internet. Consider what you’re doing.
If your firewall on the box is allowing the traffic you want, then your hosting company may be running a firewall (e.g., they’re only allowing SSH (22/tcp), HTTP (80/tcp) and HTTPS (443/tcp) and denying all other incoming traffic). In this case, you will need to open a helpdesk ticket with them to resolve this issue, though I suppose there might be something in your cPanel that may allow it.
5 ways to check if a Port is open on a remote Linux PC
T here is an ample number of ways to check for any open ports on a remote Linux PC. Knowing open ports on a Linux machine helps system administrators to connect to the remote PC for troubleshooting system and cloud server issues.
TCP and UDP ports
TCP stands for Transmission Control Protocol. In this method, the computers get connected directly until the data transfer is taking place. Therefore, with this method, the data transfer is guaranteed and is reliable but puts a higher load on the server as it has to monitor the connection and the data transfer too.
UDP stands for User Datagram Protocol. Using this method, the data is sent in the form of little packages into the network with the hope that it reaches the final destination. It means the two computers are not connected directly to each other. This method does not provide any guarantee that the data you send will ever reach its destination. Load on the server is less, and so this method is used commonly by the system administrators first to try something that’s not so important.
Now that you know the types are ports on a Linux system, let’s get started with ways of finding the ones that are open.
Best ways to check if a Port is open on a Linux PC
There are multiple ways you can do it. However, the most reliable way to do this is by using the following commands:
- nc: netcat command
- nmap: network mapper tool
- telnet: telnet command
- echo > /dev/tcp/..
- netstat – tuplen
Let’s go through each method one by one.
1. netcat command
netcat is a simple Unix utility that can be used to write and read data using UDP and TCP protocol across network connections.
The primary reason for its design is to provide a back-end tool that works with the scripts and programs. It is also an exploration and network debugging tool that offers tons of features.
To use it, you need to install it in your distro using the respective installation commands.
How to Check (Scan) for Open Ports in Linux
In this tutorial, we will discuss many methods for determining which ports on your Linux system are available to the outside world.
Introduction
One of the first things to check when troubleshooting network connectivity issues or establishing a firewall is whether ports are truly open on your machine.
In this tutorial, we will discuss many methods for determining which ports on your Linux system are available to the outside world.
What is Open Port?
A program that listens on a network port is known as a listening port. You may retrieve a list of your system’s listening ports by using tools like ss , netstat , or lsof to query the network stack. Using a firewall, each listening port can be opened or blocked (filtered).
A network port that admits incoming packets from faraway destinations is known as an open port.
For instance, if your web server listens on ports 80 and 443 and those ports are open on your firewall, anyone (excluding blocked ips) can use his browser to view websites housed on your web server. Both ports 80 and 443 are open in this scenario.
Open ports can be a security issue since attackers can use them to exploit vulnerabilities or carry out other types of attacks. All other ports should be closed and just the ports required for your application’s operation should be exposed.
Check Open Ports with nmap
Nmap is a network scanning program capable of scanning both single hosts and big networks. It’s mostly used for penetration testing and security assessments.
When it comes to port scanning, nmap should be your first choice if it is available. Nmap can determine the Mac address, OS type, kernel versions, and much more in addition to port scanning.
Which ports are listening for TCP connections from the network can be determined by using the following command from the console:
The -sT option instructs nmap to scan for TCP ports, whereas the -p- option instructs it to scan for all 65535 ports. If the -p- option is not specified, nmap will only scan the 1000 most popular ports.
Output Starting Nmap 7.60 ( https://nmap.org ) at 2019-07-09 23:10 CEST Nmap scan report for 10.10.8.8 Host is up (0.0012s latency). Not shown: 998 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:05:49:23 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 0.41 seconds Only ports 22 , 80 , and 8069 are open on the target system, according to the output.
Instead of -sT , use -sU to scan for UDP ports:
Visit the nmap man page for more information and to learn about all of this tool’s other useful features.
Check Open Ports with netcat
Netcat (or nc ) is a command-line utility that uses the TCP or UDP protocols to read and write data across network connections.
Netcat can scan a single port or a range of ports.
To search for open TCP ports on a distant system with IP address 10.10.8.8 in the range 20-80 , for example, execute the command:
The -z option instructs nc to scan only for open ports and not transfer any data, whereas the -v option provides more detailed information.
This is what the output will look like:
Output The -z option instructs nc to scan only for open ports and not transfer any data, whereas the -v option provides more detailed information. This is what the final product will look like: If you just want the lines with open ports written on the screen, use the grep command to filter the results.
nc -z -v 10.10.8.8 20-80 2>&1 | grep succeeded Output Connection to 10.10.8.8 22 port [tcp/ssh] succeeded! Connection to 10.10.8.8 80 port [tcp/http] succeeded! Pass the -u argument to the nc command to scan for UDP ports:
nc -z -v -u 10.10.8.8 20-80 2>&1 | grep succeeded Check Open Ports using Bash Pseudo Device
The Bash shell /dev/tcp/.. or /dev/udp/.. pseudo-device can also be used to determine whether a port is open or closed.
Bash will open a TCP or UDP connection to the specified host on the specified port when a command is run on a /dev/$PROTOCOL/$HOST/$IP pseudo-device.
The if..else statement below will check if port 443 on kernel.org is open:
if timeout 5 bash -c '/dev/null' then echo "Port is open" else echo "Port is closed" fi What is the purpose of the code above?
Because the default timeout when connecting to a port via a pseudo-device is so long, we’re utilizing the timeout command to kill the test command after 5 seconds. The test command will return true if the connection to kernel.org port 443 is established.
Use the for loop to check for a port range:
for PORT in ; do timeout 1 bash -c "/dev/null" && echo "port $PORT is open" done You will get an output like below:
Output port 22 is open port 80 is open Conclusion
We’ve taught you how to scan for open ports with a variety of tools. You can also check for open ports using other utilities and methods, such as the Python socket module, curl , telnet , or wget .
If you have any queries, please leave a comment below and we’ll be happy to respond to them.