Check open ports and connections with ss and netstat

"Address already in use", a service you cannot reach, or a port you did not expect to be open: all start with the same question, what is listening? This guide shows how to check open ports on Linux with ss, the modern replacement for netstat, and how to test them from outside.

Before you start

• SSH access; use sudo to see process names for services owned by other users.
• ss ships with every modern distro (iproute2). netstat needs apt install net-tools or dnf install net-tools.

List listening ports

sudo ss -tulpn

• -t TCP, -u UDP, -l listening only, -p show process, -n numeric ports.

Example output:

Netid State  Local Address:Port  Process
tcp   LISTEN 0.0.0.0:22          users:(("sshd",pid=812))
tcp   LISTEN 127.0.0.1:3306      users:(("mariadbd",pid=1033))
tcp   LISTEN *:443               users:(("nginx",pid=901))

The local address tells you who can reach the service:

Databases, Redis and admin panels should normally listen on 127.0.0.1.

Find what uses a specific port

sudo ss -ltnp 'sport = :8080'

sudo lsof -i :8080

Either shows the process and PID. Stop the right service, or kill a stray process with kill <pid>.

See active connections

• All established TCP connections: ss -tn state established
• Connections to the web server: ss -tn state established '( sport = :443 )'
• Count connections per remote IP:
  Copy

  ss -tn state established | awk 'NR>1{split($4,a,":"); print a[1]}' | sort | uniq -c | sort -nr | head

• Summary of all sockets: ss -s

Many connections in SYN-RECV can mean a SYN flood; many in TIME-WAIT are usually normal for a busy web server.

netstat equivalents

Test a port from outside

A port listening locally can still be blocked by a firewall. From another machine:

nc -zv 203.0.113.10 443

On Windows PowerShell:

Test-NetConnection 203.0.113.10 -Port 443

• succeeded / open: reachable.
• Connection refused: the packet arrived but nothing listens (or a firewall rejects it).
• Timed out: a firewall silently drops it, or the route is broken.

Check the server's own firewall with ufw status, firewall-cmd --list-all or csf -l.

Troubleshooting

• Address already in use when starting a service: another process holds the port. Find it with ss -ltnp and stop or reconfigure one of them.
• Service runs but cannot be reached: it listens on 127.0.0.1 only, or the firewall blocks the port.
• No process names shown: run ss with sudo.

Open ports FAQ

Is ss better than netstat?

Yes: it is faster on busy servers, shows more TCP detail and is installed by default. netstat still works if you prefer it.

Which ports should be open on a web server?

Usually only 80, 443 and your SSH port. cPanel servers need extra ports for mail, FTP and the panels; see the cPanel port list guide.

Can I scan my server for open ports?

Yes, scanning your own server with nmap 203.0.113.10 from another machine is a good audit. Do not scan servers you do not own.

Next steps

• cPanel and WHM firewall ports list
• Capture traffic with tcpdump
• TCP vs UDP ports explained