This brief tutorial shows students and new users how to find all ports in use or listening ports when using Ubuntu Linux systems.
If you’re a server administrator or webmaster and want to make sure only approved ports are opened on your Ubuntu Linux server, the steps below should come in handy.
Most servers built for public access will have services on them which listen on their assigned ports for communication. In some cases, ports that are not in use will stay open which may lead to them being exploited.
Ubuntu comes with some default commands that can be used to scan your servers for open ports. The steps below will show you how to use some of these commands to identify listening ports and how find them.
Since you can’t have two services listening on the same port, it’s a good chance that you may have ports that you’re probably not using and you’ll want to close them.
Network port is identified by its number, the associated IP address, and the type of the communication protocol such as TCP or UDP.
To identify listening ports on Ubuntu follow the steps below:
Use the netstat Command
netstat is a command-line tool that can provide information about network connections, including IP addresses, ports and services communicating on these ports.
If you don’t already netstat tool installed, use the commands below to install it.
sudo apt install net-tools
If you want to list all ports available on a server, you run the commands below:
sudo netstat -tunlp
For detail command options, view the bullet below:
- -t Show TCP ports.
- -u Show UDP ports.
- -n Show numerical addresses instead of resolving hosts.
- -l Show only listening ports.
- -p Show the PID and name of the listener’s process.
When you run the command above with the options, you should see similar lines as below:
Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 486/systemd-resolve tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 2851/cupsd tcp6 0 0 ::1:631 :::* LISTEN 2851/cupsd udp 0 0 127.0.0.53:53 0.0.0.0:* 486/systemd-resolve udp 0 0 0.0.0.0:68 0.0.0.0:* 782/dhclient udp 0 0 0.0.0.0:631 0.0.0.0:* 2853/cups-browsed udp 0 0 0.0.0.0:5353 0.0.0.0:* 632/avahi-daemon: r udp 0 0 0.0.0.0:38568 0.0.0.0:* 632/avahi-daemon: r udp6 0 0 :::34687 :::* 632/avahi-daemon: r udp6 0 0 :::5353 :::* 632/avahi-daemon: r
That should give you a lot of information.
However, if you only want to see a specific service name or port, you can use the netstat command with the option above with grep.
Example below shows you to scan for open ports and only list port 22.
sudo netstat -tnlp | grep :22
You should see similar line as below:
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 25538/sshd tcp6 0 0 :::22 :::* LISTEN 25538/sshd
The command above using grep shows port 22 only and sshd service is listening on that port.
Use the ss Command
netstat is not install on Ubuntu by default. the ss command is installed as a replacement for netstat. As with netstat, the ss command is use to display network information on Linux systems.
netstat and ss command share almost the same command options. so if you’re use to netstat, ss command should work almost the same.
To view all listening ports on Ubuntu using the ss command, run the command below:
sudo ss -tunlp
You should see similar screen as shown below:
NetidState Recv-Q Send-Q Local Address:Port Peer Address:Port
udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:* users:(("systemd-resolve",pid=486,fd=12))
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* users:(("dhclient",pid=782,fd=6))
udp UNCONN 0 0 0.0.0.0:631 0.0.0.0:* users:(("cups-browsed",pid=2853,fd=7))
udp UNCONN 0 0 0.0.0.0:5353 0.0.0.0:* users:(("avahi-daemon",pid=632,fd=12))
udp UNCONN 0 0 0.0.0.0:38568 0.0.0.0:* users:(("avahi-daemon",pid=632,fd=14))
udp UNCONN 0 0 [::]:34687 [::]:* users:(("avahi-daemon",pid=632,fd=15))
udp UNCONN 0 0 [::]:5353 [::]:* users:(("avahi-daemon",pid=632,fd=13))
tcp LISTEN 0 128 127.0.0.53%lo:53 0.0.0.0:* users:(("systemd-resolve",pid=486,fd=13))
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=25538,fd=3))
tcp LISTEN 0 5 127.0.0.1:631 0.0.0.0:* users:(("cupsd",pid=2851,fd=7))
tcp LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=25538,fd=4))
tcp LISTEN 0 5 [::1]:631 [::]:* users:(("cupsd",pid=2851,fd=6))
The output above is similar to the netstat command we ran previously.
Use the lsof Command
The lsof command is another powerful utility available to Linux systems that allows you display networking information.
To list all listening TCP ports using the lsof command, run it with the options below:
sudo lsof -nP -iTCP -sTCP:LISTEN
You should see similar lines as shown below:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd-r 486 systemd-resolve 13u IPv4 15733 0t0 TCP 127.0.0.53:53 (LISTEN) cupsd 2851 root 6u IPv6 36958 0t0 TCP [::1]:631 (LISTEN) cupsd 2851 root 7u IPv4 36959 0t0 TCP 127.0.0.1:631 (LISTEN) sshd 25538 root 3u IPv4 77978 0t0 TCP *:22 (LISTEN) sshd 25538 root 4u IPv6 77980 0t0 TCP *:22 (LISTEN)
That should list open ports as well.
Now you know how to list listing ports on Ubuntu, you can use any of the commands above to find ports that are not in use and disable services to them.
