How do I see which services are listening on a Linux server?
Use ss to identify local listening sockets before investigating external firewall access. A service bound to 127.0.0.1 accepts local IPv4 connections only; a wildcard binding may accept traffic arriving on other interfaces if routing and firewall rules permit it. A listener alone does not prove that a remote client can connect.
Before you start
- Sudo access if you need process details belonging to other users.
Instructions
1. List TCP and UDP listeners
Run the unprivileged listing first. Numerical output avoids confusing port names with the actual configured port. UDP does not use the TCP listening handshake, so interpret its sockets separately.
ss -lntuThe flags select listening sockets, numerical addresses, TCP and UDP.
2. Identify one owning process
Use the port of the affected service. The example checks TCP 443. Sudo may be required to display another user’s process; missing process details without sudo do not mean no process exists.
sudo ss -lntp 'sport = :443'Filters TCP listeners by local source port and includes PID/process information where permitted.
3. Compare with the intended exposure
Check whether the socket is on loopback, the expected private address, or a wildcard. Containers may publish ports through NAT rules, so also inspect the container’s port mappings when Docker is involved.
Check the result
- The expected service owns the intended port and address.
- Test the service from an authorised external client to verify the complete network path.
Troubleshooting
- Nothing is listening
- Inspect the service status and its configuration. Opening a firewall port cannot start an application.
- IPv6 shows a wildcard listener
- Check the service’s dual-stack setting and test IPv4 and IPv6 separately instead of assuming one socket accepts both.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.