How to Monitor Open Ports on Linux Server

Updated: 2025-11-17

How to Monitor Open Ports on Linux Server

Automated solution for which ports are open on your Linux server? Need to monitor open TCP and UDP ports to detect unauthorized services or security threats?...

Why Monitoring Open Ports Matters

Open ports represent services listening for incoming connections. Unauthorized open ports can indicate security breaches, misconfigured services, or malicious software. Regular monitoring of open ports helps you detect unauthorized services, monitor network configuration changes, identify potential security threats, and audit network security to ensure your Linux server remains protected.

Method 1: Check Open Ports with netstat Command

The netstat command shows network connections and listening ports.

List All Listening Ports

To see all listening TCP and UDP ports:

# List all listening ports
netstat -tuln

# Human-readable format
netstat -tulnp

This shows:

Protocol (TCP/UDP)
Local address and port
Foreign address
State (LISTEN, ESTABLISHED, etc.)
Process ID and name (with -p)

Extract Port Numbers Only

To get just the port numbers:

# Extract port numbers
netstat -tuln | awk 'NR>2{print $4}' | awk -F: '{print $NF}'

# Sort and remove duplicates
netstat -tuln | awk 'NR>2{print $4}' | awk -F: '{print $NF}' | sort -u

This provides a clean list of open ports.

Check Specific Port

To check if a specific port is open:

# Check if port 80 is open
netstat -tuln | grep :80

# Check if port 443 is open
netstat -tuln | grep :443

This helps verify specific services.

Method 2: Check Open Ports with ss Command

The ss command is a modern replacement for netstat and is faster.

List All Listening Ports

# List all listening ports
ss -tuln

# With process information
ss -tulnp

# Human-readable format
ss -tulnw

ss provides similar functionality to netstat but with better performance.

Extract Port Numbers

# Extract port numbers
ss -tuln | awk 'NR>1{print $5}' | awk -F: '{print $NF}' | sort -u

This gives a clean list of listening ports.

Method 3: Check Open Ports with lsof Command

The lsof command lists open files and can show network ports.

List Ports with lsof

# List all listening ports
lsof -i -P -n | grep LISTEN

# List TCP ports only
lsof -iTCP -sTCP:LISTEN -P -n

# List UDP ports only
lsof -iUDP -P -n

This shows processes listening on ports with detailed information.

Method 4: Automated Open Port Monitoring with Zuzia.app

Checking by hand tells you the state right now. Zuzia checks from outside, around the clock, with nothing installed on the server.

How it works in Zuzia

Add a URL, a TCP port or a DNS record with the value you expect. The first check runs within about 30 seconds.
Websites can be checked as often as once a minute, from agents in Poland, New York and Singapore. Zuzia records the HTTP status code and response time of every check.
Zuzia warns you 14, 7 and 3 days before an SSL certificate expires, and does the same for the domain registration.
Alerts go by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account). A public status page or an embeddable widget shows your client the same uptime you see.

Setting it up

In the Zuzia dashboard, add the URL, port or DNS record.
Choose the check interval and your notification channels.
Optionally create a status page or a widget for the client.

For the checks in this guide that run on the server itself, install the Zuzia agent and save those commands as a scheduled task.

Method 5: Advanced Port Monitoring Techniques

Compare Port Lists Over Time

By storing port lists in Zuzia.app, you can compare current open ports with previous lists to detect new ports or closed ports.

Monitor Specific Ports

To monitor specific ports:

# Check specific ports
for port in 80 443 22 3306; do
  netstat -tuln | grep ":$port " && echo "Port $port is open" || echo "Port $port is closed"
done

This helps track critical service ports.

Identify Processes Using Ports

To see which processes are using ports:

# Show processes with ports
netstat -tulnp | grep LISTEN

# Using ss
ss -tulnp | grep LISTEN

# Using lsof
lsof -i -P -n | grep LISTEN

This helps identify services listening on ports.

Real-World Use Cases for Port Monitoring

Security Auditing

For security compliance, audit open ports:

# Export open ports
netstat -tuln > /tmp/ports-audit-$(date +%Y%m%d).txt

# Document findings
echo "Port audit completed: $(date)" >> /tmp/ports-audit-$(date +%Y%m%d).txt

Store audit results in Zuzia.app for compliance documentation.

Unauthorized Service Detection

Detect unauthorized services:

# Compare current ports with baseline
netstat -tuln | awk 'NR>2{print $4}' | awk -F: '{print $NF}' | sort -u > /tmp/current-ports.txt
diff /tmp/baseline-ports.txt /tmp/current-ports.txt

Set up Zuzia.app to check ports hourly and alert when new ports are detected.

Service Availability Monitoring

Monitor critical service ports:

# Check web server port
netstat -tuln | grep :80

# Check database port
netstat -tuln | grep :3306

# Check SSH port
netstat -tuln | grep :22

Ensure critical services are listening on expected ports.

Best Practices for Port Monitoring

1. Monitor Ports Regularly

Check open ports at least every hour or every few hours. Port changes can indicate security issues or service problems. Use Zuzia.app automated monitoring to ensure regular checks.

2. Track Port Changes

Use Zuzia.app's historical data to track port changes over time. Understanding when ports are opened or closed helps detect unauthorized access or service failures.

3. Maintain Baseline Port List

Maintain a baseline list of expected open ports. Compare current ports with baseline to detect unauthorized services quickly.

4. Monitor Critical Service Ports

Monitor ports for critical services:

Port 22 (SSH)
Port 80/443 (Web servers)
Port 3306 (MySQL)
Port 5432 (PostgreSQL)
Application-specific ports

5. Review Audit Results Promptly

Review port monitoring results promptly and investigate any unauthorized ports immediately. Unauthorized open ports are serious security risks.

Troubleshooting Common Port Monitoring Issues

Ports Not Showing

If ports are not showing:

Check command syntax: Ensure netstat/ss command is correct
Verify permissions: Some commands require root privileges
Check network interfaces: Ensure you're checking the correct interface
Verify services are running: Check if services are actually listening

Unexpected Ports Open

If unexpected ports are detected:

Identify the process: netstat -tulnp | grep :PORT
Verify the service is authorized
Check system logs for service startup
Investigate potential security breach

Expected Ports Closed

If expected ports are closed:

Check if service is running: systemctl status servicename
Verify firewall configuration: iptables -L or firewall-cmd --list-all
Check service configuration
Restart service if needed

FAQ: Common Questions About Monitoring Open Ports

How often should I check open ports on Linux?

We recommend checking open ports every hour or every few hours. This allows you to quickly detect changes in open ports. Use Zuzia.app automated monitoring to check ports continuously without manual intervention.

What should I do if I find unauthorized open ports?

If you find unauthorized open ports, immediately investigate: identify the process using the port, verify if the service is authorized, check system logs for when the port was opened, and investigate potential security breaches. Close unauthorized ports and secure the system to prevent recurrence.

Can I monitor ports across multiple Linux servers?

Yes, Zuzia.app allows you to add multiple servers and monitor open ports across all of them simultaneously. Each server executes port check commands independently, and all results are stored in Zuzia.app's database for centralized monitoring and comparison.

How can I see port changes over time?

Zuzia.app stores all port data historically in its database, allowing you to view port changes over time. You can see historical data showing which ports were open on different dates, identify when ports were opened or closed, and track port usage trends.

What's the difference between netstat and ss for checking ports?

netstat is the traditional tool for checking network connections and ports, while ss is a modern replacement that's faster and more efficient. Both provide similar functionality, but ss is recommended for newer systems. Use whichever is available on your system.

Can I monitor specific ports only?

Yes, you can modify commands to check specific ports: netstat -tuln | grep :80 for port 80, or filter the output for multiple ports. This helps focus monitoring on critical service ports.

Does Zuzia.app use AI to analyze port patterns?

On paid plans, AI can read the output of your scheduled tasks and commands, explain it in plain language and alert you only when it spots a problem. Metric alerts work without AI: Zuzia alerts when CPU, RAM or load drifts from the server's normal and forecasts when a disk will fill up.

How to Monitor Open Ports on Linux Server