Cybersecurity Triage
Read-onlyList Listening TCP Sockets
You need to see which TCP sockets are listening and which process owns each one.
Command
ss -ltnpBefore you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not treat a listener as internet reachable without checking bind address and firewall policy together.
Expected output
Listening TCP sockets with local address, port, peer wildcard, and process info.
System impact
Read-only. Nothing changes. ss prints listening TCP sockets and process names where available.
Recovery / rollback: no state is changed.
When to use it
Use before changing firewall rules, debugging exposure, or confirming a service actually bound a port.
When not to use it
Do not treat a listener as internet reachable without checking bind address and firewall policy together.
next steps
Related commands
Find Listening Ports with ss
Before blaming the firewall, check whether anything is actually listening.
ss -ltnp
Find Public Listeners Not Allowed by UFW
The process was public, but the firewall did not mention it.
comm -13 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '$4 ~ /^(0[.]0[.]0[.]0|[[]::[]]|[*]):/ {n=split($4,a,":"); print a[n]}' | sort -u)
List Listening Ports on a VPS
Unexpected network listeners are first-response evidence.
ss -ltnp
Find Allowed Ports with No Listener
An open firewall rule can outlive the service it was created for.
comm -23 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '/LISTEN/ {n=split($4,a,":"); print a[n]}' | sort -u)
Check Whether SSH Is Publicly Bound
SSH can be locked down by source and still bind publicly.
ss -ltnp | awk '$4 ~ /:22$/ && $4 !~ /^127[.]/ {print}'
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.