<｜tool▁sep｜>tags: [ports, network, linux, server, security, monitoring]
published: true

How to Check Listening Ports on Linux Server - Complete Guide

Are you wondering how to check which ports are listening on your Linux server? Need to monitor network services and detect unauthorized applications automatically? This comprehensive guide shows you multiple methods to check listening ports, identify processes using ports, detect port changes, and maintain network security on your Linux server.

Why Monitoring Listening Ports Matters

Monitoring listening ports on your Linux server is crucial for security, network management, and troubleshooting. Unauthorized listening ports can indicate malware, backdoors, or misconfigured services. Regular port monitoring helps detect security threats, audit network configuration, troubleshoot connectivity issues, and ensure compliance with security policies.

Method 1: Check Listening Ports with netstat

The netstat command is available on most Linux systems and shows network connections and listening ports.

List All Listening Ports

To see all listening ports:

# List all listening ports (TCP and UDP)
netstat -lntu

# List listening TCP ports
netstat -lnt

# List listening UDP ports
netstat -lnu

# List ports with process information
netstat -tulnp

Filter Specific Ports

To check specific ports:

# Check specific port (e.g., port 22)
netstat -lntu | grep :22

# Check multiple ports
netstat -lntu | grep -E ':(80|443|22)'

# Check port ranges
netstat -lntu | grep -E ':8[0-9]|:9[0-9]'

Method 2: Check Listening Ports with ss Command

The ss command is the modern replacement for netstat and provides faster and more detailed port information.

List All Listening Ports

# List all listening ports
ss -tulw

# List listening TCP ports
ss -tln

# List listening UDP ports
ss -uln

# List ports with process information
ss -tulnp

Show Detailed Port Information

# Show ports with process names
ss -tulnp | grep LISTEN

# Show ports with timers
ss -tulno

# Count listening ports
ss -tulw | grep LISTEN | wc -l

Method 3: Automated Port Monitoring with Zuzia.app

Manually checking listening ports works for occasional audits, but for production servers, you need automated monitoring that alerts you when new ports appear. Zuzia.app provides comprehensive port monitoring through scheduled command execution.

Setting Up Automated Port Monitoring

1. Add Scheduled Task in Zuzia.app Dashboard

   • Navigate to your server in Zuzia.app
   • Click "Add Scheduled Task"
   • Choose "Command Execution" as the task type

2. Configure Port Check Command

   • Enter command: netstat -lntu or ss -tulw
   • Set execution frequency: Every hour or every few hours
   • Configure alert conditions: Alert when new ports appear
   • Set up comparison with previous runs

3. Set Up Notifications

   • Choose notification channels (email, webhook, Slack, etc.)
   • Configure alert thresholds (e.g., alert if new port detected)
   • Set up escalation rules for unauthorized ports

Monitor Port Changes

Track port changes over time:

# Save current port list
netstat -lntu > /tmp/ports-$(date +%Y%m%d).txt

# Compare with previous snapshot
diff /tmp/ports-old.txt /tmp/ports-new.txt

# Find new ports
comm -13 <(sort /tmp/ports-old.txt) <(sort <(netstat -lntu))

Zuzia.app stores all command outputs in its database, allowing you to track port changes over time and identify patterns in network configuration.

Method 4: Advanced Port Monitoring Techniques

Identify Processes Using Ports

To see which processes are using specific ports:

# Show processes using ports
netstat -tulnp | grep LISTEN

# Show process for specific port
lsof -i :22

# Show all processes with network connections
lsof -i -P -n

Check Port Status Changes

To detect port status changes:

# Monitor ports in real-time
watch -n 5 'netstat -tulnp | grep LISTEN'

# Compare port lists
diff <(netstat -lntu | sort) <(netstat -lntu | sort)

Real-World Use Cases for Port Monitoring

Security Audit

For security audits:

# Generate port report
netstat -tulnp > port-audit-$(date +%Y%m%d).txt

# Check for suspicious ports
netstat -lntu | grep -E ':(1337|31337|4444|5555)'

# Check for unauthorized services
netstat -tulnp | grep -vE ':(22|80|443|3306|5432)'

Troubleshooting Connectivity Issues

When troubleshooting:

# Check if service is listening
netstat -lntu | grep :80

# Check port conflicts
netstat -tulnp | grep :22

# Verify port accessibility
ss -tulnp | grep LISTEN

Best Practices for Port Monitoring

1. Monitor Ports Regularly

Check listening ports every hour or every few hours. This allows you to quickly detect changes in network configuration. Use Zuzia.app automated monitoring to check ports continuously without manual intervention.

2. Maintain Baseline Port Lists

Keep baseline port lists for comparison. Update baselines after authorized service installations to reduce false positives.

3. Monitor Critical Ports

Focus monitoring on critical ports (SSH, web servers, databases). Set up dedicated monitoring for these ports.

4. Alert on New Ports

Configure alerts for any new listening ports. Investigate new ports immediately to verify they are authorized.

5. Track Port Changes Over Time

Use Zuzia.app to track port changes over time. Identify patterns and detect anomalies in port usage.

Troubleshooting Common Port Issues

Port Not Listening

If a port is not listening:

# Check if service is running
systemctl status service-name

# Check port with netstat
netstat -lntu | grep :port

# Check port with ss
ss -tulnp | grep :port

Unexpected Ports

If unexpected ports are detected:

# Identify process using port
lsof -i :port

# Check process details
ps aux | grep process-name

# Review system logs
journalctl | grep process-name

FAQ: Common Questions About Checking Listening Ports

How often should I check listening ports?

We recommend checking listening ports every hour or every few hours. This allows you to quickly detect changes in network configuration. Use Zuzia.app automated monitoring to check ports continuously without manual intervention.

What if a new port appears?

You'll receive notifications when new ports are detected through Zuzia.app. You can then verify whether it's an authorized service or a potential security concern. Check the process using the port, verify with system administrators, and take appropriate security actions if unauthorized.

Can I filter specific ports?

Yes, you can modify the command to filter specific ports or port ranges. For example: netstat -lntu | grep -E ':(80|443|22)' shows only ports 80, 443, and 22. Use ss -tulnp | grep -E ':(80|443|22)' for the same with ss command.

How do I identify which process is using a port?

Use lsof -i :port or netstat -tulnp | grep :port to see which process is using a specific port. The output shows process ID and name, which helps identify the application.

How can I monitor ports across multiple servers?

Zuzia.app allows you to add multiple servers and monitor listening ports across all of them simultaneously. Each server executes commands independently, and all results are stored in Zuzia.app's database for centralized monitoring and analysis.

Does Zuzia.app use AI to analyze port patterns?

Yes, if you have Zuzia.app's full package, AI analysis is enabled. The AI can detect patterns in port usage, identify suspicious ports, predict potential security threats, and suggest security improvements based on historical port data and machine learning algorithms.