How to Check Open Ports on Linux: A Beginner’s Guide

Every service that accepts connections on your computer or server listens on a port. If you don’t know which open ports your system has, you can’t tell whether something is exposed that shouldn’t be. In this guide, you’ll learn how to check open ports on Linux with three simple tools, how to read the results, and how to close what you don’t need.

What Are Open Ports?

A port is a numbered “door” that lets network traffic reach a specific service. For example, SSH uses port 22, web servers use port 80 for HTTP and 443 for HTTPS, and DNS uses port 53. A port is open when a program is listening on it and ready to accept connections.

Open ports are not bad by themselves, because your system needs some of them to work. However, every unnecessary one gives attackers one more way in. For that reason, checking them regularly is a basic security habit. If you want a refresher on how networks work, read our guide to understanding your home network.

Method 1: Check Open Ports with ss

The ss command is the modern way to list listening ports, and it comes preinstalled on almost every distribution. Run:

bash

ss -tuln

Each letter in the command has a job:

• t shows TCP ports.
• u shows UDP ports.
• l shows only listening ports.
• n shows numbers instead of service names.

The output looks like this:

Netid  State   Local Address:Port
tcp    LISTEN  0.0.0.0:22
tcp    LISTEN  127.0.0.1:631
tcp    LISTEN  [::]:80

To see which program owns each port, add p and use sudo:

bash

sudo ss -tulnp

How to Read the Results

The Local Address column matters most, because it tells you who can reach the port:

• 0.0.0.0 or [::] means the service accepts connections from any network interface, including your local network and possibly the internet.
• 127.0.0.1 or [::1] means only your own computer can connect. This is much safer.

Therefore, pay the most attention to services listening on 0.0.0.0. Ask yourself whether you really need each one to be reachable from outside. With a little practice, you can spot suspicious open ports at a glance.

Method 2: Use lsof to Find What Uses a Port

Sometimes you already know a port and want to find out which program uses it. In that case, lsof is very handy:

bash

sudo lsof -i :80

You can also list every network connection and listening service at once:

bash

sudo lsof -i -P -n | grep LISTEN

This command shows the program name, the process ID (PID), and the port, so you can identify unknown services quickly. This makes lsof a great tool for tracking down unexpected open ports.

Method 3: Scan Your System with nmap

While ss and lsof look at your system from the inside, nmap shows what the network sees from the outside. The scan lists every open port it finds, along with the service that is probably running on it. First, install it:

bash

sudo apt install nmap

Then scan your own machine:

bash

nmap localhost

To scan another device on your home network, use its IP address:

bash

nmap 192.168.1.50

Only scan devices you own or have permission to test. Scanning other people’s networks can be illegal and may get you blocked by your provider.

Which Open Ports Are Normal?

Some common ports you will see on many systems:

Port	Service	Normal?
22	SSH	Only if you use remote access
53	DNS	Yes, on servers like Pi-hole
80 / 443	Web server	Only if you host a website
631	CUPS printing	Often unnecessary on servers
3306	MySQL	Should only listen on 127.0.0.1

You can look up any unknown port number in the IANA service name and port registry.

When in doubt, search for the port number before you decide to close it.

How to Close Unnecessary Open Ports

You have two main options to close them, and the best choice is often to combine both.

1. Stop the service. If you don’t need a program, disable it:

bash

sudo systemctl stop cups
sudo systemctl disable cups

2. Block the port with a firewall. UFW makes this easy on Ubuntu, Debian, and Raspberry Pi OS:

bash

sudo ufw status
sudo ufw deny 631
sudo ufw enable

Before you enable the firewall on a remote server, allow SSH first with sudo ufw allow 22. Otherwise, you could lock yourself out.

Good Habits to Keep Your Ports Safe

• Check your listening ports every few weeks and after installing new software.
• Keep your system updated, because updates fix vulnerabilities in services that listen on the network.
• Bind services to 127.0.0.1 whenever they don’t need outside access.
• Never forward ports on your router unless you really need to.

If you want to go further, our guide to securing your home network covers more steps like these.

Conclusion

Knowing which services listen on your system is one of the easiest ways to improve your security. With ss, lsof, and nmap, you can check open ports in a few seconds, understand what each one does, and close the ones you don’t need. Run sudo ss -tulnp on your own machine today and see what you find. You might be surprised.

For more details, read the ss manual page and the official nmap documentation.

Do you have questions about Linux security? Let us know through the Contact page.