Cybersecurity Triage
Read-onlyFind Listening Ports with ss
You need to list local TCP services that are accepting connections.
Command
ss -ltnpBefore you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not assume a listening socket is externally reachable; firewall and bind address still matter.
Expected output
Listening TCP sockets with bind address, port, and process details when permissions allow. Use LISTEN rows for port-conflict questions; ESTABLISHED rows are active sessions and do not prove a service is accepting new connections.
System impact
Read-only. Nothing changes. The command displays listening TCP sockets.
Recovery / rollback: no state is changed.
When to use it
Use when a service should be reachable, or when you need to audit listening ports.
When not to use it
Do not assume a listening socket is externally reachable; firewall and bind address still matter.
Common misread
Do not kill the first process you see. Check whether the row is LISTEN, whether the bind address is localhost or public, and whether a supervisor such as systemd or Docker owns the process.
LISTEN vs ESTABLISHED
Use LISTEN rows for service reachability and port-conflict questions. Use ESTABLISHED rows when you are investigating active client sessions.
ss -ltnpss -tan state established
PID and program interpretation
The PID/program field tells you who owns the socket. If the owner is hidden, rerun with sudo. If the owner is systemd, Docker, or a process manager, inspect that owner before killing the PID.
sudo ss -ltnpps -fp 4242systemctl status nginx --no-pager --lines=30
Systemd and container context
A listener may be restarted by systemd or published by Docker. Check service status and container port mappings before moving ports or stopping processes.
systemctl status nginx --no-pager --lines=30docker ps --format 'table {{.Names}}\t{{.Ports}}'
next steps
Related commands
Find Allowed Ports with No Listener
An open firewall rule can outlive the service it was created for.
comm -23 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '/LISTEN/ {n=split($4,a,":"); print a[n]}' | sort -u)
List Listening TCP Sockets
Firewall rules matter after you know what is listening.
ss -ltnp
Find Public Listeners Not Allowed by UFW
The process was public, but the firewall did not mention it.
comm -13 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '$4 ~ /^(0[.]0[.]0[.]0|[[]::[]]|[*]):/ {n=split($4,a,":"); print a[n]}' | sort -u)
Check Whether Databases Listen Publicly
The fastest database security check is the listening address.
ss -ltnp | awk '$4 ~ /:(5432|3306)$/ {print}'
List Listening Ports on a VPS
Unexpected network listeners are first-response evidence.
ss -ltnp
next diagnostic step
Where to go from this command
- Port already in use problem hub Use this when a local listener blocks or explains a service.
- Open ports troubleshooting guide Check listener, bind address, firewall, and service owner in order.
- systemd service failed problem hub Use when a service failed because it could not bind its configured port.
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.