Linux check all listening ports

Checking Open and Listening Ports on Linux Using netstat and ss

Estamos traduciendo nuestros guías y tutoriales al Español. Es posible que usted esté viendo una traducción generada automáticamente. Estamos trabajando con traductores profesionales para verificar las traducciones de nuestro sitio web. Este proyecto es un trabajo en curso.

One step in securing a Linux computer system is identifying which ports are active. Your system’s active ports give you information about which outside applications may be connected to your system. You can also discover if you are unintentionally exposing an application or service to the internet, like a MySQL database. There are several Linux tools that help you discover which ports are in use and identify both ends of active communications. This guide introduces three common tools you can use with links to guides that dive deeper into each tool.

What is a Port in Computer Networking?

Service names and port numbers are used to distinguish between different services that run over transport protocols. Common transport protocols are TCP, UDP, DCCP, and SCTP. These protocols enable communication between applications by establishing a connection and ensuring data is transmitted successfully. Well-known port assignments, such as HTTP at port 80 over TCP and UDP, are listed at the IANA Service Name and Transport Protocol Port Number Registry. These port assignments help distinguish different types of network traffic across the same connection.

How to Check Which Linux Ports Are in Use?

Three tools to help you check ports in use on a Linux system are:

• netstat: This tool shows your server’s network status.
• ss: You can view socket statistics with the ss tool. For example, ss allows you to monitor TCP, UDP, and UNIX sockets.
• lsof: This Linux utility lists open files. Since everything on a Linux system can be considered a file, lsof provides a lot of information on your entire system.

While all three tools help you learn how to check if a port is open in Linux, each program has its own advantages and disadvantages. See the following examples to identify which tool is the best fit for your purpose.

Using netstat

The netstat tool is great for inspecting the following areas of your Linux system:

• Unix sockets and network connections
• Routing tables
• Network interfaces
• Network protocols
• Multicast group membership

Running netstat without any options displays all open sockets and network connections. While this checks if a port is open in Linux, it can generate a lot of output. You can control the output using netstat’s command-line options. For example, to view the PID and program name for a system’s listening TCP connections, run netstat with the following command-line options:

The output resembles the following:

Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:http-alt 0.0.0.0:* LISTEN 381070/monitorix-ht tcp 0 0 localhost:domain 0.0.0.0:* LISTEN 553/systemd-resolve tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN 2145/sshd: /usr/sbi tcp 0 0 localhost:33060 0.0.0.0:* LISTEN 9638/mysqld tcp 0 0 localhost:mysql 0.0.0.0:* LISTEN 9638/mysqld tcp6 0 0 [::]:http [::]:* LISTEN 10997/apache2 tcp6 0 0 [::]:ssh [::]:* LISTEN 2145/sshd: /usr/sbi

To learn how to install netstat, interpret its output, and view common command line options, see our Inspecting Network Information with netstat guide.

Using ss

Another way to have Linux check ports is via the ss tool. ss was created to improve upon netstat and provides more functionality. It allows you to monitor TCP, UDP, and UNIX sockets. A socket enables programs to communicate with each other across a network and is comprised of an IP address and a port number.

Running the ss with no options displays TCP, UDP, and UNIX sockets. Similar to netstat, this unrestricted list can get quite big on busy machines, so it is useful to restrict the ss command’s output by using command-line options. For example, to view all listening and non-listening TCP sockets issue the following command:

The output resembles the following:

State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 4096 0.0.0.0:http-alt 0.0.0.0:* LISTEN 0 4096 127.0.0.53%lo:domain 0.0.0.0:* LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* LISTEN 0 70 127.0.0.1:33060 0.0.0.0:* LISTEN 0 151 127.0.0.1:mysql 0.0.0.0:* ESTAB 0 0 192.0.2.0:ssh 192.0.2.1:51617 TIME-WAIT 0 0 192.0.2.0:ssh 192.0.2.2:60630 TIME-WAIT 0 0 192.0.2.0:ssh 192.0.2.3:51312 TIME-WAIT 0 0 127.0.0.1:http-alt 127.0.0.1:52456 TIME-WAIT 0 0 192.0.2.0:ssh 192.0.2.4:44364 ESTAB 0 0 192.0.2.0:ssh 192.0.2.5:51718 LISTEN 0 511 *:http *:* LISTEN 0 128 [::]:ssh [::]:*

Using just the -l parameter tells ss to list all Linux’s listening ports, which are omitted by default, making it easier to check for listening ports in Linux.

To take a deeper dive into the ss tool, read our Learning to Use the ss Tool to its Full Potential guide. This guide provides commands specific to each protocol, commands to view general statistics about a system’s current connections, and ways to filter your output.

Using lsof

Since everything on a Linux system can be considered a file, the lsof tool can report on many aspects of a system, including open network interfaces and network connections. By default, it will list open ports in Linux. The lsof tool is preinstalled on many Linux distributions, so you may consider using it before a tool you need to install.

While one of the most frequent uses of lsof is determining which program listens to a given TCP port, one unique feature of the lsof tool is repeat mode*. This mode allows you to run the lsof command continuously on a timed interval. When inspecting your system to find information about which ports are in use, lsof can return information about which user and processes are using a specific port. For example, when working with a local development environment you may want to find which localhost ports are currently in use. Use the following command to retrieve this information:

The output returns a similar response:

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME Adobe\x20 932 jdoe 14u IPv4 0x3dab8c45775e6b5b 0t0 TCP localhost:15292 (LISTEN) Code\x20H 38254 jdoe 81u IPv4 0x3dab8c45922118fb 0t0 TCP localhost:49336 (LISTEN) VBoxHeadl 49798 jdoe 15u IPv4 0x3dab8c45a01fcf1b 0t0 TCP localhost:rockwell-csp2 (LISTEN) Google 55001 jdoe 37u IPv4 0x3dab8c457579acbb 0t0 TCP localhost:51706->localhost:bmc_patroldb (ESTABLISHED) hugo 57981 jdoe 8041u IPv4 0x3dab8c45a423853b 0t0 TCP localhost:bmc_patroldb (LISTEN) hugo 57981 jdoe 8042u IPv4 0x3dab8c45a3a8e2db 0t0 TCP localhost:bmc_patroldb->localhost:51706 (ESTABLISHED)

lsof is a powerful diagnostic tool capable of a significant number of ways that you can combine its command line options to troubleshoot various issues. To learn more about the lsof command read our How to List Open Files with lsof guide. This guide provides information about command-line options, the anatomy of the lsof output, and filtering your output with regular expressions.

This page was originally published on Thursday, February 25, 2021.

Источник

How to Check for Listening Ports in Linux (Ports in use)

When troubleshooting network connectivity or application-specific issues, one of the first things to check should be what ports are actually in use on your system and which application is listening on a specific port.

This article explains how to use the netstat , ss and lsof commands to find out which services are listening on which ports. The instructions are applicable for all Linux and Unix-based operating systems like macOS.

What is Listening Port #

Network port is identified by its number, the associated IP address, and type of the communication protocol, such as TCP or UDP.

Listening port is a network port on which an application or process listens on, acting as a communication endpoint.

Each listening port can be open or closed (filtered) using a firewall. In general terms, an open port is a network port that accepts incoming packets from remote locations.

You can’t have two services listening to the same port on the same IP address.

For example, if you are running an Apache web server that listens on ports 80 and 443 and you try to install Nginx , the later will fail to start because the HTTP and HTTPS ports are already in use.

Check Listening Ports with netstat #

netstat is a command-line tool that can provide information about network connections.

To list all TCP or UDP ports that are being listened on, including the services using the ports and the socket status use the following command:

The options used in this command have the following meaning:

• -t — Show TCP ports.
• -u — Show UDP ports.
• -n — Show numerical addresses instead of resolving hosts.
• -l — Show only listening ports.
• -p — Show the PID and name of the listener’s process. This information is shown only if you run the command as root or sudo user.

The output will look something like this:

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 445/sshd tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 929/master tcp6 0 0 . 3306 . * LISTEN 534/mysqld tcp6 0 0 . 80 . * LISTEN 515/apache2 tcp6 0 0 . 22 . * LISTEN 445/sshd tcp6 0 0 . 25 . * LISTEN 929/master tcp6 0 0 . 33060 . * LISTEN 534/mysqld udp 0 0 0.0.0.0:68 0.0.0.0:* 966/dhclient 

The important columns in our case are:

• Proto — The protocol used by the socket.
• Local Address — The IP Address and port number on which the process listen to.
• PID/Program name — The PID and the name of the process.

If you want to filter the results, use the grep command . For example, to find what process listens on TCP port 22 you would type:

sudo netstat -tnlp | grep :22

The output shows that on this machine port 22 is used by the SSH server:

tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 445/sshd tcp6 0 0 . 22 . * LISTEN 445/sshd 

If the output is empty it means that nothing is listening on the port.

You can also filter the list based on criteria, for example, PID, protocol, state, and so on.

netstat is obsolete and replaced with ss and ip , but still it is of the most used commands to check network connections.

Check Listening Ports with ss #

ss is the new netstat . It lacks some of the netstat features, but exposes more TCP states and it is slightly faster. The command options are mostly the same, so the transition from netstat to ss is not difficult.

To get a list of all listening ports with ss you would type:

The output is almost the same as the one reported by netstat :

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=445,fd=3)) LISTEN 0 100 0.0.0.0:25 0.0.0.0:* users:(("master",pid=929,fd=13)) LISTEN 0 128 *:3306 *:* users:(("mysqld",pid=534,fd=30)) LISTEN 0 128 *:80 *:* users:(("apache2",pid=765,fd=4),("apache2",pid=764,fd=4),("apache2",pid=515,fd=4)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=445,fd=4)) LISTEN 0 100 [::]:25 [::]:* users:(("master",pid=929,fd=14)) LISTEN 0 70 *:33060 *:* users:(("mysqld",pid=534,fd=33)) 

Check Listening Ports with lsof #

lsof is a powerful command-line utility that provides information about files opened by processes.

In Linux, everything is a file. You can think of a socket as a file that writes to the network.

To get a list of all listening TCP ports with lsof type:

sudo lsof -nP -iTCP -sTCP:LISTEN

The options used are as follows:

• -n — Do not convert port numbers to port names.
• -p — Do not resolve hostnames, show numerical addresses.
• -iTCP -sTCP:LISTEN — Show only network files with TCP state LISTEN.

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 445 root 3u IPv4 16434 0t0 TCP *:22 (LISTEN) sshd 445 root 4u IPv6 16445 0t0 TCP *:22 (LISTEN) apache2 515 root 4u IPv6 16590 0t0 TCP *:80 (LISTEN) mysqld 534 mysql 30u IPv6 17636 0t0 TCP *:3306 (LISTEN) mysqld 534 mysql 33u IPv6 19973 0t0 TCP *:33060 (LISTEN) apache2 764 www-data 4u IPv6 16590 0t0 TCP *:80 (LISTEN) apache2 765 www-data 4u IPv6 16590 0t0 TCP *:80 (LISTEN) master 929 root 13u IPv4 19637 0t0 TCP *:25 (LISTEN) master 929 root 14u IPv6 19638 0t0 TCP *:25 (LISTEN) 

Most of the output columns names are self-explanatory:

• COMMAND , PID , USER — The name, the pid and the user running the program associated with the port.
• NAME — The port number.

To find what process is listening on a particular port, for example, port 3306 you would use:

sudo lsof -nP -iTCP:3306 -sTCP:LISTEN

The output shows that MySQL server uses port 3306 :

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME mysqld 534 mysql 30u IPv6 17636 0t0 TCP *:3306 (LISTEN) 

For more information, visit the lsof man page and read about all other powerful options of this tool.

Conclusion #

We have shown you several commands that you can use to check what ports are in use on your system, and how to find what process listens on a specific port.

If you have any questions or remarks, please leave a comment below.

Источник