How to Check Open Ports in Linux (Ubuntu, CentOS, Debian)

A service must listen on a port before it can accept network connections. On Linux, you can check local listeners and then test reachability separately to see whether a firewall or network rule allows access.

Why checking open ports is important

Checking ports helps identify the services running on a server. A local listener does not prove the port is accessible from the internet: its bind address, server firewall and provider firewall also matter.

Using the ss command (Socket Statistics)

Run:

sudo ss -tulnp

This shows TCP listeners and UDP sockets, numerical addresses and ports, and process details where permissions allow. An address such as 127.0.0.1 is local to the server; 0.0.0.0 represents all IPv4 interfaces. Check IPv6 bindings separately.

Using the netstat command

On systems where the older net-tools package is installed, you can use:

sudo netstat -tulnp

Prefer ss when available. Do not assume older CentOS package instructions apply to a current distribution.

Using the lsof command

If lsof is installed, list TCP listeners with:

sudo lsof -nP -iTCP -sTCP:LISTEN

This helps associate a listening port with a process. It does not test an external connection.

Using the nmap command (Network Scanner)

To test a specific TCP port on a server you own or are authorised to test, run this from another computer with Nmap installed:

nmap -sT -p 443 server-address

Replace the address and port. A default Nmap scan covers a common set of TCP ports, not every port or UDP service. A scan of localhost cannot establish internet reachability.

Best practices after checking open ports

Check unfamiliar listeners against the server’s required services. Before changing a firewall or stopping a process, identify what depends on it and preserve your remote administration access.