How to Check Open Ports on a Linux Server Print

Checking open ports is an important part of Linux server administration and network troubleshooting.

An open port normally indicates that a service is listening for network connections. This guide explains how to check listening ports on Ubuntu and Debian servers using common Linux tools.

Check Open Ports with ss

The ss command is one of the easiest ways to check listening ports on modern Linux systems.

Run:

sudo ss -tulpn

This displays TCP and UDP ports currently listening on the server.

The options mean:

-t  TCP connections
-u  UDP connections
-l  Listening ports
-p  Process information
-n  Show numerical ports and IP addresses

Show Only TCP Ports

To display listening TCP ports:

sudo ss -tlpn

Show Only UDP Ports

To display listening UDP ports:

sudo ss -ulpn

Check a Specific Port

For example, to check whether port 22 is listening:

sudo ss -ltnp | grep ':22'

Port 22 is commonly used for SSH.

To check port 80:

sudo ss -ltnp | grep ':80'

To check HTTPS port 443:

sudo ss -ltnp | grep ':443'

Find Which Process Is Using a Port

You can use ss to identify the process associated with a listening port:

sudo ss -ltnp

Another useful tool is lsof.

Install it if necessary:

sudo apt update
sudo apt install lsof -y

Then check a specific port:

sudo lsof -i :80

For example:

sudo lsof -i :443

This can help identify which application is using a port.

Check Ports with netstat

Older Linux guides often use netstat.

If it is not installed:

sudo apt install net-tools -y

Then run:

sudo netstat -tulpn

On modern Ubuntu systems, ss is generally preferred.

Check Whether a Remote Port Is Reachable

A service can be listening locally while still being inaccessible from the Internet because of a firewall or network policy.

You can test a remote TCP port with Netcat.

Install Netcat:

sudo apt install netcat-openbsd -y

Test SSH:

nc -vz SERVER-IP 22

Test HTTP:

nc -vz SERVER-IP 80

Test HTTPS:

nc -vz SERVER-IP 443

Replace SERVER-IP with the server address you want to test.

Check a Port with curl

For HTTP and HTTPS services, curl is particularly useful.

Test HTTP:

curl -I http://SERVER-IP

Test HTTPS:

curl -I https://example.com

This can confirm whether a web service is responding rather than simply whether the TCP port accepts connections.

Check UFW Firewall Rules

If Ubuntu UFW is enabled, check its status:

sudo ufw status

For more information:

sudo ufw status verbose

A service may be running correctly but remain inaccessible because the firewall blocks incoming connections.

Open a Port with UFW

For example, to allow TCP port 443:

sudo ufw allow 443/tcp

To allow port 80:

sudo ufw allow 80/tcp

Only open ports that are required by your applications.

Check SSH Port

To check whether SSH is listening:

sudo ss -ltnp | grep ssh

You can also check port 22:

sudo ss -ltnp | grep ':22'

If SSH uses a custom port, check your SSH server configuration.

Local Port vs Publicly Accessible Port

It is important to understand the difference between a service listening locally and one accessible from the Internet.

For example:

127.0.0.1:3306

means the service is listening only on localhost.

A service listening on:

0.0.0.0:80

is listening on all IPv4 interfaces.

For IPv6 you may see:

[::]:443

Firewall and upstream network rules still determine whether the service is externally reachable.

Common Server Ports

Some commonly used ports include:

22    SSH
25    SMTP
53    DNS
80    HTTP
443   HTTPS
3306  MySQL/MariaDB
5432  PostgreSQL

A port number alone does not guarantee that a specific application is running on it. Services can be configured to use different ports.

Security: Close Unnecessary Ports

Public servers should expose only the services they actually require.

Regularly check listening ports:

sudo ss -tulpn

If you discover an unexpected service:

1. Identify the process.
2. Determine whether the service is required.
3. Stop or disable unnecessary services.
4. Review firewall rules.
5. Investigate unexpected applications or processes.

Do not simply block a suspicious port without understanding which service created it.

Troubleshooting a Port That Is Not Reachable

If an application is running but the port cannot be reached remotely, check:

1. Is the service running?

sudo systemctl status SERVICE-NAME

2. Is the port listening?

sudo ss -tulpn

3. Is the firewall blocking it?

sudo ufw status

4. Is the application listening on the correct interface?

Check whether it is bound to 127.0.0.1, a specific IP address or all interfaces.

5. Is there an upstream firewall?

Some hosting platforms and network environments provide an additional firewall outside the operating system.

IDONCLOUD Server Infrastructure

IDONCLOUD provides VPS and Dedicated Server infrastructure for Linux workloads with IPv4, IPv6 and high-bandwidth connectivity options.

Our Knowledge Base provides practical Linux and networking documentation to help administrators configure and troubleshoot their servers.

Visit idoncloud.com to explore IDONCLOUD infrastructure.

Related Guides

• How to Diagnose Packet Loss with MTR on Linux
• How to Test Network Speed with iperf3
• How to Use Traceroute on Linux
• How to Configure a Static IP Address on Ubuntu with Netplan
• How to Secure SSH on Ubuntu
• How to Configure UFW Firewall on Ubuntu