How to Check Open Ports on a Linux Server

By Ravindra Bagale, Cyber Security trainer LinkedIn Published: 27 October 2026 Last updated: 27 October 2026

To see what is listening on your Linux server, run sudo ss -tulpn. That lists TCP/UDP sockets, the process name and the port. Use nmap -sT -F 127.0.0.1 from the same host for a second view. Close ports you do not need with the firewall and by stopping unused services.

Quick answer

sudo ss -tulpn
sudo ss -tulpn | grep -E ':(22|80|443|3306)\s'
nmap -sT -F 127.0.0.1

Why check open ports?

Every listening port is a door. Attackers knock on forgotten doors: old Tomcat, open Redis, test Node apps. Sara in Chicago and Rohan in Nagpur both start incident checks the same way: "What is listening?"

What counts as an open port?

A process has called listen() on a TCP or UDP port. ss shows that from inside the OS. Whether the internet can reach it also depends on cloud security groups, NACLs and the host firewall.

How do I check step by step?

SSH into your server.

List listeners:

sudo ss -tulpn

Netid State  Local Address:Port  Process
tcp   LISTEN 0.0.0.0:22         users:(("sshd",pid=812,fd=3))
tcp   LISTEN 127.0.0.1:3306     users:(("mysqld",pid=990,fd=20))
tcp   LISTEN 0.0.0.0:80         users:(("nginx",pid=1001,fd=6))

What it means: SSH and nginx listen on all interfaces. MySQL listens only on localhost — good.

Filter common ports:
```
sudo ss -tulpn | grep -E ':(22|80|443|3306)\s'
```
What it means: A short filter helps when the full list is long.
Scan yourself with Nmap (same host):
```
nmap -sT -F 127.0.0.1
```
```
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
```
What it means: Nmap agrees SSH and HTTP are open on localhost. Fast (-F) checks common ports only.
From another machine you control (optional):
```
nc -zv 203.0.113.10 443
```
What it means: From another host, nc tells you if 443 accepts a TCP connect. Use only on systems you may test.
Close what you do not need: sudo systemctl disable --now SERVICE, then tighten firewalld/ufw and the cloud security group.

Ravindra Bagale's Tip

Friends, an "open" port on localhost is not the same as open to the internet. Check the security group (AWS) or firewalld/ufw next. Anil in Nashik once panicked about MySQL on 3306 — it was bound to 127.0.0.1 only.

Quick quiz: check what you learned

Which command lists listening TCP ports with process names on modern Linux?
1. ss -tulpn (sockets + processes)
2. df -h (disk free space only)
3. chmod 777 / (world-write root)
4. history | tail (shell history)
Show answer
A. ss shows sockets; -tulpn lists TCP/UDP listening ports with programs.
You see port 22 open. What should you do first?
1. Confirm SSH should be open and limit source IPs
2. nmap every IP on the internet
3. chmod 777 the SSH key file
4. Disable the firewall completely
Show answer
A. Know your expected ports; lock SSH to known admin IPs.

Learn it properly

This guide is the short path. These pages go deeper, with labs:

Frequently asked questions

What command shows open ports on Linux?

sudo ss -tulpn is the modern default. Older systems may use netstat -tulpn.

What does 0.0.0.0:80 mean?

The service accepts connections on all IPv4 interfaces on port 80.

How do I check if port 443 is open from another machine?

From a host you control: nc -zv YOUR_SERVER_IP 443 or nmap -p 443 YOUR_SERVER_IP — only with permission.

ss vs nmap — which should I use?

ss shows what your OS is listening on. nmap shows what a scanner can reach. Use both.

Is this the same as an EC2 security group check?

No. Security groups filter before traffic hits the OS. Check both layers.