249

I would like to see what ports are open on my machine, e.g. what ports my machine is listening on. E.g. port 80 if I have installed a web server, and so on.

Is there any command for this?

0

10 Answers 10

397

I've always used this:

sudo netstat -ntlp

If the netstat command is not available, install it with:

sudo apt install net-tools
7
  • 5
    sudo netstat -ntlp | grep LISTEN ... use sudo otherwise ... pid will not be printed. Aug 28, 2016 at 5:14
  • 10
    -l already filters for listening. grep LISTEN won't help beyond hiding 2 lines of header information. Jan 18, 2017 at 19:19
  • 6
    -t: tcp, -l: listening socket, -p: show pid and program name, -n: print 127.0.0.1:80 instead of localhost:http. Reference: linux.die.net/man/8/netstat
    – Rick
    Oct 19, 2018 at 9:45
  • 4
    install netstat with sudo apt-get install net-tools
    – RichArt
    Oct 28, 2018 at 22:12
  • 6
    The expanded command is sudo netstat --tcp --listening --programs --numeric. There’s no need to use grep unless you want to eliminate column headers. Mar 12, 2019 at 7:50
151

nmap (install)

Nmap ("Network Mapper") is a free and open source utility for network exploration or security auditing.

Use nmap 192.168.1.33 for internal PC or nmap external IP address.

More information man nmap.

Zenmap is the official GUI frontend.

7
  • 16
    Thanks, nmap localhost worked great.
    – Jonas
    Oct 25, 2010 at 13:24
  • 12
    Remember that there is a difference between nmap localhost and nmap 192.168.0.3 (or what ever you machine IP is) Oct 25, 2010 at 14:47
  • 9
    I think netstat is a better answer to this. netstat will list what the system is listening on directly, and without using an additional application or doing unnecessary calls over localhost or thought the network. Nov 3, 2010 at 1:57
  • 4
    This is stupid. If you have access to the computer, just use netstat -ln. You'll instantly see all the open ports. Oct 8, 2016 at 18:51
  • 1
    nmap localhost didn't find services that were bound only to localhost. For example, I run influxd with bind-address:localhost:8086. That didn't show up in sudo nmap localhost, but did show up in sudo netstat -tulpn. Jan 18, 2017 at 17:58
80

Other good ways to find out what ports are listenting and what your firewall rules are:

  • sudo netstat -tulpn

  • sudo ufw status

2
  • I change the answer to nmap again, the usability of netstat is crap.
    – Jonas
    Mar 23, 2014 at 17:28
  • 2
    @Jonas: see my comment under the nmap answer. It won't list services that bind to localhost only. Jan 18, 2017 at 17:59
31

To list open ports use the netstat command.

For example:

    $ sudo netstat -tulpn | grep LISTEN
    tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      5452/dnsmasq    
    tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1037/cupsd      
    tcp6       0      0 ::1:631                 :::*                    LISTEN      1037/cupsd

In the above example three services are bound to the loopback address.

IPv4 services bound to the loopback address "127.0.0.1" are only available on the local machine. The equivalent loopback address for IPv6 is "::1". The IPv4 address "0.0.0.0" means "any IP address", which would mean that other machines could potentially connect to any of the locally configured network interfaces on the specific port.

Another method is to use the lsof command:

    $ sudo lsof -nP -i | grep LISTEN
    cupsd     1037   root    9u  IPv6  11276      0t0  TCP [::1]:631 (LISTEN)
    cupsd     1037   root   10u  IPv4  11277      0t0  TCP 127.0.0.1:631 (LISTEN)
    dnsmasq   5452 nobody    5u  IPv4 212707      0t0  TCP 127.0.0.1:53 (LISTEN)

For more details see man netstat or man lsof.

2
  • 3
    I thought the -l option was to list LISTENing ports. So the grep would be superfluous here?! Oct 8, 2016 at 18:53
  • 1
    thanks for the hint with lsof which is available in a fresh Ubuntu installation, so could be used if you face some connection issues and can't use apt yet.
    – Wolfson
    Apr 16, 2021 at 8:48
27

This is enough to show that there is a process listening on IP address 0.0.0.0 (needed so it will reply to any request) on port 80 (standard web server port number). In my case this shows it is the web server lighttpd

$ sudo netstat -ntlp | grep :80
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN          2495/lighttpd

If you later want to make sure that the only thing you allow through your firewall is port 80 I often use ShieldsUp from www.grc.com to perform a firewall test.

11

sudo iptables -L will list the port rules for your pc. Note that if you are using ufw or shorewall firewalls the output maybe be hard to read. In that case rather use sudo ufw status for example.

This is not very useful on its own as even if a port is open access will still be denied if there is no process listening on that port.

5

If you are looking for continuous monitoring of ports for server machines or local I think you can also use graphical version of nmap i.e Zenmap for more detailed version

Zenmap is the official graphical user interface (GUI) for the Nmap Security Scanner.

Supports available (Linux, Windows, Mac OS X, BSD, etc.)

Have a look to this tool view:

enter image description here

4

In latest Linux distro, most probably you won't find netstat command anymore.

$ netstat

Command 'netstat' not found, but can be installed with:

sudo apt install net-tools

$ 

However, if you want to use it, go ahead and install it with sudo apt install net-tools command.

Fyi, netstat is obsolete (refer to the man page), so you should use ss intead of netstat.

This program is obsolete. Replacement for netstat is ss.
Replacement for netstat -r is ip route. Replacement for netstat -i is ip -s link. Replacement for netstat -g is ip maddr.

E.g.

$ ss -lnt
State      Recv-Q Send-Q        Local Address:Port          Peer Address:Port
LISTEN     0      5                 127.0.1.1:53                       *:*
LISTEN     0      128               127.0.0.1:631                      *:*
LISTEN     0      128                     ::1:631                     :::*

Description

ss = another utility to investigate sockets

-l, --listening Display only listening sockets (these are omitted by default).

-n, --numeric Do not try to resolve service names.

-t, --tcp Display TCP sockets.

3

ss: Print: network connections routing tables interface statistics masquerade connections multicast memberships

Install:
    sudo apt install net-tools

Example:
    ~$ ss -ntlp | grep LISTEN
    >
    LISTEN   0        4096             127.0.0.53%lo:53              0.0.0.0:*                                                                                      
    LISTEN   0        5                    127.0.0.1:631             0.0.0.0:*                                                                                      
    LISTEN   0        5                        [::1]:631                [::]:*                                                                                      
    LISTEN   0        50          [::ffff:127.0.0.1]:9614                  *:*
1
  • Are you sure? net-tools provide netstat. iproute2 provide ss. Check with dpkg -S $(which ss) Aug 26, 2020 at 7:45
1

assuming u wanna check port 3000: netstat -na | grep 3000

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .