Check Listening Ports on Linux: ss, netstat & lsof

Updated: 2025-11-17

Check Listening Ports on Linux: ss, netstat & lsof

Are you wondering how to check which ports are listening on your Linux server? Need to monitor network services and detect unauthorized applications automatically? This comprehensive guide shows you multiple methods to check listening ports, identify processes using ports, detect port changes, and maintain network security on your Linux server.

Why Monitoring Listening Ports Matters

Monitoring listening ports on your Linux server is crucial for security, network management, and troubleshooting. Unauthorized listening ports can indicate malware, backdoors, or misconfigured services. Regular port monitoring helps detect security threats, audit network configuration, troubleshoot connectivity issues, and ensure compliance with security policies. For comprehensive security auditing, see our Server Security Audit. If you need to monitor ports continuously with alerts, use Monitor Open TCP Ports. For troubleshooting network connectivity issues, see Network Connectivity Issues on Linux.

Method 1: Check Listening Ports with netstat

The netstat command is available on most Linux systems and shows network connections and listening ports.

List All Listening Ports

To see all listening ports:

# List all listening ports (TCP and UDP)
netstat -lntu

# List listening TCP ports
netstat -lnt

# List listening UDP ports
netstat -lnu

# List ports with process information
netstat -tulnp

Filter Specific Ports

To check specific ports:

# Check specific port (e.g., port 22)
netstat -lntu | grep :22

# Check multiple ports
netstat -lntu | grep -E ':(80|443|22)'

# Check port ranges
netstat -lntu | grep -E ':8[0-9]|:9[0-9]'

Method 2: Check Listening Ports with ss Command

The ss command is the modern replacement for netstat and provides faster and more detailed port information.

List All Listening Ports

# List all listening ports
ss -tulw

# List listening TCP ports
ss -tln

# List listening UDP ports
ss -uln

# List ports with process information
ss -tulnp

Show Detailed Port Information

# Show ports with process names
ss -tulnp | grep LISTEN

# Show ports with timers
ss -tulno

# Count listening ports
ss -tulw | grep LISTEN | wc -l

Method 3: Automated Port Monitoring with Zuzia.app

Checking by hand tells you the state right now. Zuzia checks from outside, around the clock, with nothing installed on the server.

How it works in Zuzia

Add a URL, a TCP port or a DNS record with the value you expect. The first check runs within about 30 seconds.
Websites can be checked as often as once a minute, from agents in Poland, New York and Singapore. Zuzia records the HTTP status code and response time of every check.
Zuzia warns you 14, 7 and 3 days before an SSL certificate expires, and does the same for the domain registration.
Alerts go by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account). A public status page or an embeddable widget shows your client the same uptime you see.

Setting it up

In the Zuzia dashboard, add the URL, port or DNS record.
Choose the check interval and your notification channels.
Optionally create a status page or a widget for the client.

For the checks in this guide that run on the server itself, install the Zuzia agent and save those commands as a scheduled task.

Method 4: Advanced Port Monitoring Techniques

Identify Processes Using Ports

To see which processes are using specific ports:

# Show processes using ports
netstat -tulnp | grep LISTEN

# Show process for specific port
lsof -i :22

# Show all processes with network connections
lsof -i -P -n

Check Port Status Changes

To detect port status changes:

# Monitor ports in real-time
watch -n 5 'netstat -tulnp | grep LISTEN'

# Compare port lists
diff <(netstat -lntu | sort) <(netstat -lntu | sort)

Real-World Use Cases for Port Monitoring

Security Audit

For security audits:

# Generate port report
netstat -tulnp > port-audit-$(date +%Y%m%d).txt

# Check for suspicious ports
netstat -lntu | grep -E ':(1337|31337|4444|5555)'

# Check for unauthorized services
netstat -tulnp | grep -vE ':(22|80|443|3306|5432)'

Troubleshooting Connectivity Issues

When troubleshooting:

# Check if service is listening
netstat -lntu | grep :80

# Check port conflicts
netstat -tulnp | grep :22

# Verify port accessibility
ss -tulnp | grep LISTEN

Best Practices for Port Monitoring

1. Monitor Ports Regularly

Check listening ports every hour or every few hours. This allows you to quickly detect changes in network configuration. Use Zuzia.app automated monitoring to check ports continuously without manual intervention.

2. Maintain Baseline Port Lists

Keep baseline port lists for comparison. Update baselines after authorized service installations to reduce false positives.

3. Monitor Critical Ports

Focus monitoring on critical ports (SSH, web servers, databases). Set up dedicated monitoring for these ports.

4. Alert on New Ports

Configure alerts for any new listening ports. Investigate new ports immediately to verify they are authorized.

5. Track Port Changes Over Time

Use Zuzia.app to track port changes over time. Identify patterns and detect anomalies in port usage.

Troubleshooting Common Port Issues

For comprehensive troubleshooting guidance, see Network Connectivity Issues on Linux. If you need to check firewall configuration, see Check Firewall Configuration Security Audit.

Port Not Listening

If a port is not listening:

# Check if service is running
systemctl status service-name

# Check port with netstat
netstat -lntu | grep :port

# Check port with ss
ss -tulnp | grep :port

Unexpected Ports

If unexpected ports are detected:

# Identify process using port
lsof -i :port

# Check process details
ps aux | grep process-name

# Review system logs
journalctl | grep process-name

FAQ: Common Questions About Checking Listening Ports

How often should I check listening ports?

For a one-time or periodic security audit, checking listening ports every hour or every few hours is usually enough to detect changes in network configuration. In production, use Zuzia.app automated monitoring to check ports continuously without manual intervention.

What if a new port appears?

When a new port appears in your audit or automated checks, verify whether it is an authorized service or a potential security concern. Check the process using the port, verify with system administrators, and take appropriate security actions if it is unauthorized.

Can I filter specific ports?

How do I identify which process is using a port?

Use lsof -i :port or netstat -tulnp | grep :port to see which process is using a specific port. The output shows process ID and name, which helps identify the application that owns that port.

How can I monitor ports across multiple servers?

You can add multiple servers in Zuzia.app and monitor listening ports across all of them simultaneously. Each server executes commands independently, and all results are stored in Zuzia.app's database for centralized monitoring and analysis.

Does Zuzia.app use AI to analyze port patterns?

On paid plans, AI can read the output of your scheduled tasks and commands, explain it in plain language and alert you only when it spots a problem. Metric alerts work without AI: Zuzia alerts when CPU, RAM or load drifts from the server's normal and forecasts when a disk will fill up.

Check Listening Ports on Linux: ss, netstat & lsof