- 6 ways to Check a remote port is open in Linux
- Methods to check if a remote port is open in Linux
- Use nc command to check the remote port is open in Linux
- Use nmap to check the remote port is open in Linux
- Use telnet to check the remote port is open in Linux
- Use python telnet to check remote port is open in Linux
- Use python socket to check remote port is open in Linux
- Use curl to check remote port is open in Linux
- Efficiently test if a port is open on Linux?
- 14 Answers 14
6 ways to Check a remote port is open in Linux
Checking remote port status is a common task for Linux admin. Now we collect 6 different ways for this task. We don’t need to install any package if we use the following two python commands. We need to install the package if we choose nc, nmap,telnet.
Methods to check if a remote port is open in Linux
The following commands can be used to check if a port is open on the remote server in Linux.
- Use nc command nc -zvw10 192.168.0.1 22
- Use nmap command nmap 192.168.0.1 -p 22
- Use telnet command telnet 192.168.0.1 22
- Use python telnet module
- Use python socket module
- Use curl command
Use nc command to check the remote port is open in Linux
$ nc [-options] [HostName or IP] [PortNumber]
- z: zero-I/O mode which is used for scanning
- v: for verbose output
- w10: timeout wait 10 seconds
The “nc” command stands for “netcat”. The “nc” command is a very versatile command that can be used for a variety of purposes, including network administration and data transmission.
For example, the “nc” command can be used to create a simple TCP connection between two computers. The “nc” command can be used to connect to a remote server on a given port and send/receive data.
For example, if you want to connect to a remote server on port xx, you would use the following command: nc -zv port
In this example, “” is the IP address or hostname of the remote server, and “” is the port that you want to connect to.
I needed to see if the port 22 (SSH) on a remote machine was open, so I opened a terminal and ran the following command:
The -v option enabled verbose output, and the -z option instructed nc to only scan for open ports, without actually establishing a connection.
The output showed me the results of the port scan:
Connection to hostname.com 22 port [tcp/ssh] succeeded!
This told me that the port 22 was open and that I could connect to the remote machine using SSH.
In another scenario, if the port was not open, the output would look something like this:
nc: connect to hostname.com port 22 (tcp) failed: Connection refused
You can also use the “nc” command to open a port in Linux. To do this, you would use the following command: nc -l -p 1234
In this example, “-l” is used to listen for a connection on port 1234
Use nmap to check the remote port is open in Linux
$ nmap [-options] [HostName or IP] [-p] [PortNumber]
The “nmap” command is a command-line tool used for network exploration and security auditing. The “nmap” command can be used to scan for open ports on a remote server, as well as to identify the operating system and services running on that server.
For example, if you want to scan for open ports on a remote server, you would use the following command:
In this example, “” is the IP address or hostname of the remote server, and “” is the port that you want to scan.
Use telnet to check the remote port is open in Linux
$ telnet [HostName or IP] [PortNumber]
The telnet command is a command-line tool used for network communication. The telnet command can be used to connect to a remote server on a given port.
For example, if you want to connect to a remote server on port, you would use the following command: telnet port
In this example, “” is the IP address or hostname of the remote server, and “” is the port that you want to connect to.
Use python telnet to check remote port is open in Linux
python -c «import telnetlib; tel=telnetlib.Telnet(‘192.168.0.1′,’22’,10); print tel; tel.close()»
If you are using Python3, using the following command:
python3 -c «import telnetlib; tel=telnetlib.Telnet(‘10.248.169.140′,’5432’,10); print(tel); tel.close()»
Telnetlib is a module in Python that allows you to communicate with remote servers using the Telnet protocol. The Telnet protocol is a text-based protocol used for communicating with remote servers.
To use the Telnetlib module, you first need to import it into your Python program: import telnetlib
Next, you need to create an instance of the Telnet object: telnet = telnetlib.Telnet()
The Telnet object has a number of methods that allow you to send and receive data. For example, the send() method allows you to send text data to the remote server, and the recv() method allows you to receive text data from the remote server.
Use python socket to check remote port is open in Linux
Python -c «import socket; s = socket.socket(); s.settimeout(10); s.connect((‘192.168.0.1’, 22)); «
The “socket” module is a module in Python that allows you to create and use sockets. A socket is a communication channel that allows two processes to connect and send/receive data.
The “socket” module has a number of functions that allow you to do a variety of things, including creating sockets, binding sockets to addresses, and sending/receiving data.
In order to use the “socket” module, you first need to import it into your Python program. You can do this by using the following command: import socket
Once you have imported the “socket” module, you can then use its functions to create sockets and communicate with other processes.
Use curl to check remote port is open in Linux
We have another solution for this with the curl command. curl -v telnet://192.168.0.1:22
The “curl” command is a tool used for transferring data with URL syntax. The “curl” command can be used to send data to a remote server, or it can be used to download data from a remote server.
If you want to download data from a remote server, you can use the following command: curl port -o filename.txt
In this example, “” is the IP address or hostname of the remote server, and “” is the port that you want to download data from.
The “curl” command can also be used to check whether a port is open or not. To do this, you would use the following command:
In this example, “” is the IP address or hostname of the remote server, and “” is the port that you want to check.
Efficiently test if a port is open on Linux?
From a bash script how can I quickly find out whether a port 445 is open/listening on a server. I have tried a couple of options, but I want something quick:
1. lsof -i :445 (Takes seconds)
2. netstat -an |grep 445 |grep LISTEN (Takes seconds)
3. telnet (it doesn’t return)
4. nmap , netcat are not available on the server It will be nice to know of a way that doesn’t enumerate first and greps after that.
netstat -lnt (with -t and without -a ) will limit output to listening TCP connections only. It may speed-up a little bit. You can add -4 for IPv4 only if you don’t need IPv6.
I don’t know why lsof is slow for you, but normally it is the best of the solutions you listed. Your netstat solution is not very reliable (you can guess it whenever you use grep ; anyway it returns true if someone is listening on e.g. 4450). telnet and netcat actually attempt to create a connection, which may not always be what you want.
14 Answers 14
A surprise I found out recently is that Bash natively supports tcp connections as file descriptors. To use:
exec 6<>/dev/tcp/ip.addr.of.server/445 echo -e "GET / HTTP/1.0\n" >&6 cat I'm using 6 as the file descriptor because 0,1,2 are stdin, stdout, and stderr. 5 is sometimes used by Bash for child processes, so 3,4,6,7,8, and 9 should be safe.
As per the comment below, to test for listening on a local server in a script:
exec 6<>/dev/tcp/127.0.0.1/445 || echo "No one is listening!" exec 6>&- # close output connection exec 6 To determine if someone is listening, attempt to connect by loopback. If it fails, then the port is closed or we aren't allowed access. Afterwards, close the connection.
Modify this for your use case, such as sending an email, exiting the script on failure, or starting the required service.
@AmanJain cat waits for EOF or Ctrl-C to quit. You'll need to adjust this for your protocol. BTW are you running this to a remote server?
@AmanJain I've updated it for a local system. You do just want to check if it's listening correct? There isn't any protocol checking, such as requesting a page via http?
if a port is taken, it returns nothing, is there any way to make it say "port is taken by
This is not a reliable method since not all OS (e.g. ubuntu 16 as I discovered today) are shipped with bash compiled for building the /dev/tcp/IP/PORT tree
I use it with 127.0.0.1 as "remote" address.
this returns "0" if the port is open and "1" if the port is closed
-z Specifies that nc should just scan for listening daemons, without sending any data to them. It is an error to use this option in conjunc- tion with the -l option.
That seems to be the easiest way, thanks. The sample script link is not working anymore though, yet it's quite self-explaining anyways.
Nice! This is much faster than the other answers on a server with many ports open. Returns in
The -z flag is not available in the nmap based ncat which most recent distros ship with: Fedora, Centos, etc. (nmap-ncat-6.01-9.fc18.x86_64)
@Sean unix commands typically return '0' to indicate success and non-zero for failure. So '0' indicates that it successfully connected and non-zero that it didn't connect for some reason. Note, however, that some versions of 'nc' don't support the '-z' argument so stackoverflow.com/a/25793128/6773916 is arguably a better solution.
You can use netstat this way for much faster results:
netstat -lnt | awk '$6 == "LISTEN" && $4 ~ /\.445$/' netstat -anp tcp | awk '$6 == "LISTEN" && $4 ~ /\.445$/' This will output a list of processes listening on the port (445 in this example) or it will output nothing if the port is free.
Actually it is correct syntax but probably you're using Linux and I am on Mac. For Linux use this: netstat -lnt | awk '$6 == "LISTEN" && $4 ~ ".445"'
In order to check for port 80 I needed to use awk '$6 == "LISTEN" && $4 ~ "80$"' . Instead of checking for the dot before the port number with \.80 , I used 80$ . Otherwise, this also matched IP addresses containing .80 and ports starting with 80 such as 8000 .
@PatrickOscity: Good point, but to make this robust to you need to combine both approaches: awk '$6 == "LISTEN" && $4 ~ "\.80$"'
You can use netcat for this.
connects to the server and directly closes the connection again. If netcat is not able to connect, it returns a non-zero exit code. The exit code is stored in the variable $?. As an example,
will return 0 if and only if netcat could successfully connect to the port.
This answer needs more upvotes. nc works perfectly for this case. the /dev/tcp trick is clever, but seems difficult to implement a script with signal interrupts.
nc has the -z flag for this purpose, which doesn't require taking input from /dev/null . There's already an answer using the -z flag above.
@AbeVoelker Not all versions of nc support the -z flag. I am on CentOS 7 and found Tony's solution to be what I needed.
Based on Spencer Rathbun's answer, using bash:
Good, it will suppress "Connection Refused" message. Auto-exits if the service accept the connection without wait forever.
Best solution for services that send no data after a new connection. About 20 times faster than calling netcat. Can be shortened to : &>/dev/null
I'd add a timeout to get a closed result faster: timeout 5s bash -c ': &>/dev/null ' && echo open || echo closed
@user1338062 This happens on an Ubuntu Bionic on Azure against external IP (not localhost or 127.0.0.1 ).
they're listed in /proc/net/tcp.
it's the second column, after the ":", in hex:
> cat /proc/net/tcp sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode 0: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 10863 1 ffff88020c785400 99 0 0 10 -1 1: 0100007F:0277 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 7983 1 ffff88020eb7b3c0 99 0 0 10 -1 2: 0500010A:948F 0900010A:2328 01 00000000:00000000 02:00000576 00000000 1000 0 10562454 2 ffff88010040f7c0 22 3 30 5 3 3: 0500010A:E077 5F2F7D4A:0050 01 00000000:00000000 02:00000176 00000000 1000 0 10701021 2 ffff880100474080 41 3 22 10 -1 4: 0500010A:8773 16EC97D1:0050 01 00000000:00000000 02:00000BDC 00000000 1000 0 10700849 2 ffff880104335440 57 3 18 10 -1 5: 0500010A:8772 16EC97D1:0050 01 00000000:00000000 02:00000BF5 00000000 1000 0 10698952 2 ffff88010040e440 46 3 0 10 -1 6: 0500010A:DD2C 0900010A:0016 01 00000000:00000000 02:0006E764 00000000 1000 0 9562907 2 ffff880104334740 22 3 30 5 4 7: 0500010A:AAA4 6A717D4A:0050 08 00000000:00000001 02:00000929 00000000 1000 0 10696677 2 ffff880106cc77c0 45 3 0 10 -1 so i guess one of those :50 in the third column must be stackoverflow :o)
look in man 5 proc for more details. and picking that apart with sed etc is left as an exercise for the gentle reader.