How to Check Open Ports in Linux with Commands or PowerShell?

Most people think checking open ports is a task only for security experts until their server gets compromised through an exposed port they didn’t even know was listening. You can check open ports in Linux using built-in commands like netstat, ss, lsof, nmap, and netcat, or remotely scan ports using PowerShell from Windows systems. Each method offers different levels of detail and requires varying permissions.

Port management matters more than ever. Automated reconnaissance activities keep rising, and attackers probe for vulnerable entry points constantly. Whether you’re securing production servers or testing local services, mastering port security is fundamental to maintaining a safe and functional system.

TL;DR: Quick Overview

• Use ss or netstat for quick checks of listening ports without installing additional tools
• Deploy nmap when you need comprehensive port scanning with detailed service detection
• Use lsof to identify which specific process is using a particular port
• Use PowerShell’s Test-NetConnection from Windows to check ports on remote Linux servers

What Is a Port in Simple Terms?

Think of ports as numbered doorways on your server. Each port serves as a communication endpoint where network traffic enters or exits your system. Port numbers range from 0 to 65,535, divided into three categories: well-known ports (0-1023), registered ports (1024-49151), and dynamic ports (49152-65,535).

In simpler words, when you browse a website, your browser knocks on port 80 for HTTP or port 443 for HTTPS. Email servers answer at port 25 for SMTP, while SSH remote access operates on port 22. These listening ports act as gateways for legitimate traffic, but they can also become entry points for attackers if left unprotected.

Ports work in conjunction with two main transport protocols: TCP for reliable, connection-oriented communication and UDP for faster, connectionless data transfer. Understanding how ports function helps you make informed decisions about which ones to keep open and which to close for better security.

How to Check Open Ports in Linux

Linux provides several powerful tools for port analysis, each with distinct advantages. Some come pre-installed, while others require installation. Choosing the right tool depends on your permission level, required detail, and specific use case.

Using the netstat Command

The netstat command has been a reliable tool for network analysis for decades. To check open ports, use netstat -tuln where each flag serves a specific purpose: -t shows TCP connections, -u displays UDP connections, -l filters for listening ports only, and -n presents results in numeric format rather than resolving hostnames.

When you run this command, you’ll see output showing the protocol, local address with port number, foreign address, and connection state. For example, 0.0.0.0:22 indicates SSH is listening on all network interfaces on port 22. Each entry provides immediate visibility into active services and their network status.

The Linux netstat command offers additional flags for more detailed analysis. Adding -p shows which process owns each connection, though this requires root privileges. For instance, sudo netstat -tulnp reveals both the port and the process ID using it.

Using the ss Command

The ss command serves as the modern replacement for netstat, offering superior performance and more detailed socket statistics. Use ss -tuln with the same flags as netstat for comparable output. However, ss processes information faster, especially on systems with numerous connections.

To check open ports with advanced filtering, ss provides powerful syntax options. Running ss -tulnp | grep :22 shows only SSH-related connections. The command ss -tn state established displays all established TCP connections, helping you monitor active sessions.

One advantage of ss is its ability to filter by specific criteria. For example, ss -t ‘( dport = :80 or sport = :80 )’ shows only connections related to web traffic on port 80. This precision makes ss invaluable for troubleshooting specific service issues.

Using the lsof Command

The lsof command excels at identifying which process is using a specific port. Running sudo lsof -i -P -n shows all network connections with process details. The -i flag filters for internet connections, -P prevents port number conversion to service names, and -n skips DNS resolution for faster results.

When you need to find what’s using a specific port, lsof provides the answer. For instance, sudo lsof -i :3306 reveals if MySQL is running and which process ID owns it. This becomes crucial when troubleshooting port conflicts or identifying unauthorized services.

You can also filter results by specific applications. If you suspect a particular program is listening on unexpected ports, sudo lsof -i -a -p [PID] shows all network connections for that specific process ID.

Using Nmap for Port Scanning

Nmap stands as one of the most comprehensive port scanning tools available. First, install it with sudo apt install nmap on Ubuntu or Debian systems. For local port checks, use nmap localhost or nmap 127.0.0.1 for a basic scan.

For remote servers, specify the IP address: nmap 192.168.1.100. Nmap provides detailed information about open ports, service versions, and even operating system detection with advanced flags. The command nmap -sV localhost performs service version detection, revealing exactly what software is running on each port.

Security teams value Nmap’s ability to test firewall rules. Running nmap -Pn [IP] scans a host even if ping is blocked. However, always ensure you have permission before scanning remote servers, as unauthorized port scanning can violate security policies.

Using Netcat (nc) to Check Open Ports

Netcat offers a straightforward approach to port checking with minimal overhead. The command nc -zv localhost 22-80 scans port range 22 through 80, displaying which ports accept connections. The -z flag enables scanning mode without sending data, while -v provides verbose output.

For single-port verification, nc -zv hostname 443 quickly confirms if HTTPS is accessible. This method proves useful in scripts and automation workflows. You can combine netcat with shell loops for broader scanning: for port in {1..1000}; do nc -zv localhost $port 2>&1 | grep succeeded; done

The netcat listener functionality extends beyond port checking to actual service testing and data transfer, making it a versatile tool in any administrator’s toolkit.

Using PowerShell to Check Open Ports

PowerShell enables Windows users to check open ports on remote Linux servers without installing additional software. The command Test-NetConnection -ComputerName [Linux-IP] -Port 22 verifies SSH accessibility from a Windows machine.

For scanning multiple ports, create a simple PowerShell loop: 1..1024 | ForEach-Object { Test-NetConnection -ComputerName 192.168.1.100 -Port $_ -WarningAction SilentlyContinue } | Where-Object { $_.TcpTestSucceeded }. This method works effectively when checking ports on Ubuntu, Debian, or any other Linux distribution from Windows systems.

PowerShell’s advantage lies in its integration with Windows infrastructure. You can export results to CSV, send alerts via email, or trigger automated responses based on port status, making it ideal for hybrid environment monitoring.

Port Scanning Method Comparison

Tool	Command Syntax	Best For	Prerequisites
netstat	netstat -tuln	Quick overview of listening ports	Pre-installed on most systems
ss	ss -tuln	Fast performance, detailed socket info	Pre-installed (modern Linux)
lsof	sudo lsof -i -P -n	Finding which process uses a port	Root/sudo access required
nmap	nmap localhost	Comprehensive port scanning	Must install separately
netcat	nc -zv host port	Simple port connectivity tests	Pre-installed or easy install
PowerShell	Test-NetConnection	Remote scanning from Windows	Windows machine required

Common Linux Ports and Their Associated Services

Port	Service	Protocol	Common Use
22	SSH	TCP	Secure remote access via SSH remote connection
80	HTTP	TCP	Unencrypted web traffic
443	HTTPS	TCP	Encrypted web traffic
21	FTP	TCP	File transfers
25	SMTP	TCP	Email sending
3306	MySQL	TCP	Database connections
5432	PostgreSQL	TCP	Database connections

Port configuration requires knowledge of firewall settings and service bindings. Many administrators change the SSH port in Linux from the default 22 to a non-standard port to reduce automated attack attempts. The Telnet vs. SSH debate highlights why port 23 (Telnet) should remain closed in favor of port 22’s encrypted SSH protocol.

Understanding Open Ports in Linux

Every open port represents a potential entry point into your system. Security implications have intensified, with automated port scanning activity surging by 16.7% globally, as threat actors continuously probe for vulnerable entry points. These reconnaissance activities scan billions of ports monthly, searching for misconfigured services or outdated software.

Fair enough, but what’s actually happening when attackers find an open port? Port states tell you the story. A port in the LISTEN state accepts incoming connections, ESTABLISHED indicates active data transfer, and TIME_WAIT shows a connection recently closed but still tracked. Attackers exploit open ports through various methods: brute force attacks on SSH (port 22), SQL injection through web ports (80/443), and remote code execution via vulnerable services.

Opening ports safely requires a defense-in-depth approach. Start with a default-deny firewall policy. Verify your configuration with iptables show rules. Only open ports for services you actively use, and close them immediately when no longer needed. Consider changing default ports for common services to reduce automated scanning success.

The Linux ecosystem faced significant security challenges, with hundreds of vulnerabilities requiring patches. Regular port auditing helps you discover unauthorized services before attackers do. Use file transfer tools that respect security boundaries, such as copying files over SSH instead of unencrypted FTP. When moving files between systems, using SCP to copy files from a remote to local system provides encrypted transfer over SSH’s secure channel.

Best practices include implementing port knocking for sensitive services, using fail2ban to block repeated authentication failures, and maintaining detailed logs of connection attempts. Schedule regular security audits to review which ports remain open and whether they still serve legitimate purposes.

How Cloudzy’s Linux VPS Simplifies Port Management

Managing ports becomes significantly easier with a well-configured infrastructure. Cloudzy’s Linux VPS solutions provide pre-configured security settings that include intelligent firewall rules and streamlined port management through an intuitive control panel. With full root access, you maintain complete control over which ports to open or close.

Performance matters when checking and managing ports. Cloudzy’s NVMe storage ensures your port scanning tools run efficiently, while up to 10 Gbps connections handle high-volume traffic without bottlenecks. The infrastructure benefits from the fact that Linux powers a significant portion of global server infrastructure, making these optimized configurations battle-tested and reliable.

Starting at just $3.96 monthly, you get a professional-grade environment perfect for practicing port management techniques. Multiple data center locations allow you to test geo-distributed setups, while 24/7 support assists with complex firewall configurations or port-related troubleshooting. Whether you’re learning how to check open ports in Linux or deploying production services, having a flexible VPS environment accelerates your security implementations.

Conclusion

So, what’s the best way to check open ports? To put it quite plainly, there isn’t one. For quick local checks, ss or netstat get the job done without fuss. When you need comprehensive security audits, Nmap reveals everything. For tracking down which process owns a port, lsof saves hours of guessing. PowerShell bridges Windows and Linux when you need remote verification.

The real lesson here isn’t about memorizing commands. It’s about making port auditing a routine instead of a panic response. Schedule weekly scans, close unused ports the moment you spot them, and document which services need which ports. That approach transforms port checking from reactive firefighting into proactive defense.