Test if a port on a remote system is reachable (without telnet)
In the old days, we used telnet to see if a port on a remote host was open: telnet hostname port would attempt to connect to any port on any host and give you access to the raw TCP stream. These days, the systems I work on do not have telnet installed (for security reasons), and all outbound connections to all hosts are blocked by default. Over time, it’s easy to lose track of which ports are open to which hosts. Is there another way to test if a port on a remote system is open – using a Linux system with a limited number of packages installed, and telnet is not available?
I was having this same issue. The answer by @Subhranath Chunder below helped. However, I then found out that installing Telnet was a small matter of running brew install telnet . So I expect Linux users can do the same with yum and apt-get .
When «all outbound connections to all hosts are blocked by default» there will be no way to perform such a test — you are offline
14 Answers 14
Bash has been able to access TCP and UDP ports for a while. From the man page:
/dev/tcp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, bash attempts to open a TCP connection to the corresponding socket. /dev/udp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, bash attempts to open a UDP connection to the corresponding socket. So you could use something like this:
However on ports that were not open it timed out after 22 seconds (tried on Ubuntu 14.04 (Trusty Tahr) for a remote server). Interestingly, the timeout period is much shorter than the one for nc (see thnee’s answer).
@lornix, ok, but in this case I have to get the same result with use nc without -z option, but it still does not work: # nc -v -w5 127.0.0.1 18080 Connection to 127.0.0.1 18080 port [tcp/*] succeeded! # cat < /dev/tcp/127.0.0.1/18080 Just hangs without any result. Just want to understand when I can use "/dev/tcp/host/port" option
@Alexandr. actually, «hangs without any result» is pretty much expected behavior. cat is waiting for input. nc has extra smarts to enable it to sense no-data pending and stops trying. cat isn’t quite as smart. Try cat < /dev/tcp/localhost/22 , you should get your sshd header. Evidently, your process on port 18080 waits for something to come in, before sending anything. Port 22 (ssh) greets you with it’s version and whatnot. Try it out!
@lornix, thank you very much for explanation! Now the restriction is clear. I think using nc should be a preferred way to check ports.
This was incredibly helpful when working with a docker container that had nothing installed. Was able to quickly verify that the container had access to non-containerized DB via DNS. Example: cat < /dev/tcp/hostname/5432
Nice and verbose! From the man pages.
Single port:
This hanged when tried on Ubuntu 14.04 (Trusty Tahr) for a remote server (same LAN) for closed ports (it timed out after 127 seconds) — thus not very suitable in scripts. It did work though for a service that had a port open. Using option «-w2» could be the solution.
that’s great, but only if nc is actually installed 😛 the accepted answer via bash works almost everywhere, more GNU/Linux servers have bash than nc
Will output 0 if port 123 is open, and 1 if it’s closed.
This is a far more elegant and scriptable answer than my own. It is unfortunate for me that the security-conscious sysadmins who withheld telnet also withheld nc (though – strangely – not curl or wget ).
This hanged when tried on Ubuntu 14.04 (Trusty Tahr) for a remote server (same LAN) for closed ports (it timed out after about 127 seconds) — thus not very suitable in scripts. It did work though for a service that had a port open, returning 0. Using option «-w2» could be the solution.
The simplest method, without making use of another tool, such as socat , is as described in @lornix’s answer above. This is just to add an actual example of how one would make use of the psuedo-device /dev/tcp/. within Bash if you wanted to, say, test if another server had a given port accessible via the command line.
Examples
Say I have a host on my network named skinner .
$ (echo > /dev/tcp/skinner/22) >/dev/null 2>&1 \ && echo "It's up" || echo "It's down" It's up $ (echo > /dev/tcp/skinner/222) >/dev/null 2>&1 && \ echo "It's up" || echo "It's down" It's down The reason you want to wrap the echo > /dev/. in parentheses like this, (echo > /dev/. ) is because if you don’t, then with tests of connections that are down, you’ll get these types of messages showing up.
$ (echo > /dev/tcp/skinner/223) && echo hi bash: connect: Connection refused bash: /dev/tcp/skinner/223: Connection refused These can’t simply be redirected to /dev/null since they’re coming from the attempt to write out data to the device /dev/tcp . So we capture all that output within a sub-command, i.e. (. cmds. ) and redirect the output of the sub-command.
Checking Open and Listening Ports on Linux Using netstat and ss
Estamos traduciendo nuestros guías y tutoriales al Español. Es posible que usted esté viendo una traducción generada automáticamente. Estamos trabajando con traductores profesionales para verificar las traducciones de nuestro sitio web. Este proyecto es un trabajo en curso.
One step in securing a Linux computer system is identifying which ports are active. Your system’s active ports give you information about which outside applications may be connected to your system. You can also discover if you are unintentionally exposing an application or service to the internet, like a MySQL database. There are several Linux tools that help you discover which ports are in use and identify both ends of active communications. This guide introduces three common tools you can use with links to guides that dive deeper into each tool.
What is a Port in Computer Networking?
Service names and port numbers are used to distinguish between different services that run over transport protocols. Common transport protocols are TCP, UDP, DCCP, and SCTP. These protocols enable communication between applications by establishing a connection and ensuring data is transmitted successfully. Well-known port assignments, such as HTTP at port 80 over TCP and UDP, are listed at the IANA Service Name and Transport Protocol Port Number Registry. These port assignments help distinguish different types of network traffic across the same connection.
How to Check Which Linux Ports Are in Use?
Three tools to help you check ports in use on a Linux system are:
- netstat: This tool shows your server’s network status.
- ss: You can view socket statistics with the ss tool. For example, ss allows you to monitor TCP, UDP, and UNIX sockets.
- lsof: This Linux utility lists open files. Since everything on a Linux system can be considered a file, lsof provides a lot of information on your entire system.
While all three tools help you learn how to check if a port is open in Linux, each program has its own advantages and disadvantages. See the following examples to identify which tool is the best fit for your purpose.
Using netstat
The netstat tool is great for inspecting the following areas of your Linux system:
- Unix sockets and network connections
- Routing tables
- Network interfaces
- Network protocols
- Multicast group membership
Running netstat without any options displays all open sockets and network connections. While this checks if a port is open in Linux, it can generate a lot of output. You can control the output using netstat’s command-line options. For example, to view the PID and program name for a system’s listening TCP connections, run netstat with the following command-line options:
The output resembles the following:
Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:http-alt 0.0.0.0:* LISTEN 381070/monitorix-ht tcp 0 0 localhost:domain 0.0.0.0:* LISTEN 553/systemd-resolve tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN 2145/sshd: /usr/sbi tcp 0 0 localhost:33060 0.0.0.0:* LISTEN 9638/mysqld tcp 0 0 localhost:mysql 0.0.0.0:* LISTEN 9638/mysqld tcp6 0 0 [::]:http [::]:* LISTEN 10997/apache2 tcp6 0 0 [::]:ssh [::]:* LISTEN 2145/sshd: /usr/sbiTo learn how to install netstat, interpret its output, and view common command line options, see our Inspecting Network Information with netstat guide.
Using ss
Another way to have Linux check ports is via the ss tool. ss was created to improve upon netstat and provides more functionality. It allows you to monitor TCP, UDP, and UNIX sockets. A socket enables programs to communicate with each other across a network and is comprised of an IP address and a port number.
Running the ss with no options displays TCP, UDP, and UNIX sockets. Similar to netstat, this unrestricted list can get quite big on busy machines, so it is useful to restrict the ss command’s output by using command-line options. For example, to view all listening and non-listening TCP sockets issue the following command:
The output resembles the following:
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 4096 0.0.0.0:http-alt 0.0.0.0:* LISTEN 0 4096 127.0.0.53%lo:domain 0.0.0.0:* LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* LISTEN 0 70 127.0.0.1:33060 0.0.0.0:* LISTEN 0 151 127.0.0.1:mysql 0.0.0.0:* ESTAB 0 0 192.0.2.0:ssh 192.0.2.1:51617 TIME-WAIT 0 0 192.0.2.0:ssh 192.0.2.2:60630 TIME-WAIT 0 0 192.0.2.0:ssh 192.0.2.3:51312 TIME-WAIT 0 0 127.0.0.1:http-alt 127.0.0.1:52456 TIME-WAIT 0 0 192.0.2.0:ssh 192.0.2.4:44364 ESTAB 0 0 192.0.2.0:ssh 192.0.2.5:51718 LISTEN 0 511 *:http *:* LISTEN 0 128 [::]:ssh [::]:*Using just the -l parameter tells ss to list all Linux’s listening ports, which are omitted by default, making it easier to check for listening ports in Linux.
To take a deeper dive into the ss tool, read our Learning to Use the ss Tool to its Full Potential guide. This guide provides commands specific to each protocol, commands to view general statistics about a system’s current connections, and ways to filter your output.
Using lsof
Since everything on a Linux system can be considered a file, the lsof tool can report on many aspects of a system, including open network interfaces and network connections. By default, it will list open ports in Linux. The lsof tool is preinstalled on many Linux distributions, so you may consider using it before a tool you need to install.
While one of the most frequent uses of lsof is determining which program listens to a given TCP port, one unique feature of the lsof tool is repeat mode*. This mode allows you to run the lsof command continuously on a timed interval. When inspecting your system to find information about which ports are in use, lsof can return information about which user and processes are using a specific port. For example, when working with a local development environment you may want to find which localhost ports are currently in use. Use the following command to retrieve this information:
The output returns a similar response:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME Adobe\x20 932 jdoe 14u IPv4 0x3dab8c45775e6b5b 0t0 TCP localhost:15292 (LISTEN) Code\x20H 38254 jdoe 81u IPv4 0x3dab8c45922118fb 0t0 TCP localhost:49336 (LISTEN) VBoxHeadl 49798 jdoe 15u IPv4 0x3dab8c45a01fcf1b 0t0 TCP localhost:rockwell-csp2 (LISTEN) Google 55001 jdoe 37u IPv4 0x3dab8c457579acbb 0t0 TCP localhost:51706->localhost:bmc_patroldb (ESTABLISHED) hugo 57981 jdoe 8041u IPv4 0x3dab8c45a423853b 0t0 TCP localhost:bmc_patroldb (LISTEN) hugo 57981 jdoe 8042u IPv4 0x3dab8c45a3a8e2db 0t0 TCP localhost:bmc_patroldb->localhost:51706 (ESTABLISHED)lsof is a powerful diagnostic tool capable of a significant number of ways that you can combine its command line options to troubleshoot various issues. To learn more about the lsof command read our How to List Open Files with lsof guide. This guide provides information about command-line options, the anatomy of the lsof output, and filtering your output with regular expressions.
This page was originally published on Thursday, February 25, 2021.