How to check the opened/closed ports on my computer?
I used netstat -a on command line.
- Does the port status "LISTENING" indicate that the port is open?
- Is any port, that is not shown in the output, closed?
8 Answers
There's a few parameters to netstat that are useful for this :
-lor--listeningshows only the sockets currently listening for incoming connection.-aor--allshows all sockets currently in use.-tor--tcpshows the tcp sockets.-uor--udpshows the udp sockets.-nor--numericshows the hosts and ports as numbers, instead of resolving in dns and looking in /etc/services.
You use a mix of these to get what you want. To know which port numbers are currently in use, use one of these:
netstat -atn # For tcp
netstat -aun # For udp
netstat -atun # For both
In the output all port mentioned are in use either listening for incoming connection or connected to a peer** all others are closed. TCP and UDP ports are 16 bits wide (they go from 1-65535)
** They can also be connecting/disconnecting from the peer.
You can use this command:
netstat -tulnp | grep <port no>
If it shows some process its used. Its closed(not used) if there is no output.
answered Oct 17, 2014 at 12:45
Another alternative command line easy to use to find out which process is using a port:
lsof -n -i4TCP:$PORT | grep LISTEN
I added the next function in my .bash_profile,
function pslisten {
echo `lsof -n -i4TCP:$1 | grep LISTEN`
}
and now run "pslisten 5060" to see who is grabing my SIP port.
It's work with Apple Mac OS X too.
answered Mar 13, 2015 at 7:22
Is the port status "LISTENING" indicated that the port is opened?
Yes. It means that some service is listening to that port on your computer for incoming connection i.e. this port is open for establishing new connections.
Any port that are not shown in the output indicated that it's closed?
Yes. Remember netstat -a will show all active (listening) and passive (non-listening) connections i.e. the ports that are acting as both server (some services are listening to these ports for connections from a different machine/process) and established (connections are established on these ports regardless of the fact the host/a service can be a server or client)
All TCP and UDP ports belong to a category called sockets and there are a whole lot of those. To view socket info you can check man ss.
-
Thanks. you wrote that
-ameans server and established. Does "server" means ports that are being listened at by some services? Does "established" mean ports where there are existing connections regardless of it is a client or server's port? Then what kinds of ports does-anot show?– TimCommented Aug 21, 2018 at 19:28 -
I don't think the
-aoption means "all active" sockets; it just means "all". netstat shows all active sockets by default, but leaves out the passive sockets (open, listening). By using the-aoption both active and passive sockets are shown. Commented Sep 22, 2018 at 8:28 -
-
@heemayl The second part of your answer is still not correct. A TCP socket in the "listening" state can never be a connection; it is not connected to anything, it is only listening. Listening TCP sockets are also called passive sockets because of this. If a client attempts to connect to a (listening) socket on a server, a new socket will be created on the server to establish a connection with the client. A socket which is part of an established connection is called an active socket. Commented Sep 25, 2018 at 20:37
Another option is ss. It's much easier to use....
The below command will only output a list of current listening sockets.
root@server:~# ss -l
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
u_dgr UNCONN 0 0 * 23353 * 23352
u_dgr UNCONN 0 0 * 568 * 362
u_dgr UNCONN 0 0 * 14836 * 14837
u_dgr UNCONN 0 0 * 20446 * 369
u_dgr UNCONN 0 0 * 22877 * 369
u_dgr UNCONN 0 0 * 504 * 347
u_dgr UNCONN 0 0 * 16298 * 369
u_dgr UNCONN 0 0 * 23343 * 369
u_dgr UNCONN 0 0 * 24125 * 369
u_dgr UNCONN 0 0 * 24617 * 369
u_dgr UNCONN 0 0 * 23352 * 23353
u_dgr UNCONN 0 0 * 23334 * 369
u_dgr UNCONN 0 0 * 17113 * 369
u_dgr UNCONN 0 0 * 16957 * 369
u_dgr UNCONN 0 0 * 14793 * 362
u_dgr UNCONN 0 0 * 23345 * 362
u_dgr UNCONN 0 0 * 24070 * 369
udp UNCONN 0 0 *:sunrpc *:*
udp UNCONN 0 0 *:981 *:*
udp UNCONN 0 0 :::sunrpc :::*
udp UNCONN 0 0 :::981 :::*
tcp LISTEN 0 128 127.0.0.1:85 *:*
tcp LISTEN 0 128 *:ssh *:*
tcp LISTEN 0 128 *:3128 *:*
tcp LISTEN 0 100 127.0.0.1:smtp *:*
tcp LISTEN 0 128 *:8006 *:*
tcp LISTEN 0 128 *:sunrpc *:*
tcp LISTEN 0 128 :::ssh :::*
tcp LISTEN 0 100 ::1:smtp :::*
tcp LISTEN 0 128 :::sunrpc :::*
Actually there is a better way to see what ports you have open. The issue with netstat or lsof is that they query network stack and actually do not connect to the machine but instead trying to see what is running on the system. The better approach is to use nmap like so:
nmap -sT -O localhost
To see open ports.
Or this might help by using watch, then play around with what you want to see.
sudo watch -d -n0 "netstat -atnp | grep ESTA"
sudo watch -d -n0 "netstat -tulnp | grep ESTA"
-
1-a conflicts with -l, -a grabs all whether ESTABLISHED or LISTENING, and -l just grabs LISTENING, so in reality it is '-ltnp' tcp, '-lunp' udp or '-ltunp' tcp+udp Commented Jul 2, 2017 at 23:31
Try this to get a list of opened ports in that range.
for p in {1..1023} do (echo >/dev/tcp/localhost/$p) >/dev/null 2>&1 && echo "$p open" doneAnd this command will show what is it!
cat /etc/services | grep {PORTNumber}
nmapis a tool to check for open ports on another host. If you can runnetstaton a machine, it's much faster and reliable to use it.netstat, so I learned that. It says in the link that it should be used from another host, though. Thanks!