$ Linux One Liners
Back to commands

Cybersecurity Triage

Read-only

Show Publicly Bound Listeners

You need to filter listening sockets down to services bound on all interfaces or IPv6 wildcard addresses.

Command

ss -ltnp | awk 'NR==1 || $4 ~ /^(0[.]0[.]0[.]0|[[]::[]]|[*]):/'

Before you run this

System impact: Read-only. Low when scoped to the shown target.

When not to use it: Do not ignore IPv6, container ports, or cloud firewalls on real hosts; this is the host-level socket view.

Expected output

The ss header plus listeners bound to public wildcard addresses.

System impact

Read-only. Nothing changes. awk filters socket output by bind address.

Recovery / rollback: no state is changed.

When to use it

Use when you need a quick public-exposure worklist before comparing against firewall policy.

When not to use it

Do not ignore IPv6, container ports, or cloud firewalls on real hosts; this is the host-level socket view.

next steps

Related commands

Cybersecurity Triage Read-only

Show Local-Only Database Listeners

The database was listening, but only on localhost.

ss -ltnp | awk '$4 ~ /^127[.]0[.]0[.]1:(5432|3306|6379)$/ {print}'
Cybersecurity Triage Sensitive output

Find Public Listeners Not Allowed by UFW

The process was public, but the firewall did not mention it.

comm -13 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '$4 ~ /^(0[.]0[.]0[.]0|[[]::[]]|[*]):/ {n=split($4,a,":"); print a[n]}' | sort -u)
Cybersecurity Triage Read-only

Check Whether SSH Is Publicly Bound

SSH can be locked down by source and still bind publicly.

ss -ltnp | awk '$4 ~ /:22$/ && $4 !~ /^127[.]/ {print}'
Cybersecurity Triage Sensitive output

Find Allowed Ports with No Listener

An open firewall rule can outlive the service it was created for.

comm -23 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '/LISTEN/ {n=split($4,a,":"); print a[n]}' | sort -u)
Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

  • LPIC-1 style command-line practice
  • LFCS style performance-task practice
  • Linux+ style troubleshooting review

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.