Skip to main content
To check open ports on Linux, run sudo ss -tulpn. It lists every TCP and UDP port the server is listening on, the address it listens on and the program that owns it. To check one port, add a filter: sudo ss -tlnp 'sport = :80'. On older systems sudo netstat -tulpn gives the same list. A listening port is only reachable from outside if your firewall allows it.

​
Before you start

  • Connect with SSH. ss works for any user, but only shows which program owns a port when run with sudo (root can leave it out).
  • A port is a numbered door a program uses for network traffic: SSH uses 22, websites 80 and 443. A port is listening when a program waits for connections on it.

​
How to list all listening ports with ss

Example output:

​
How to read the Local Address column

In the example, MariaDB on 127.0.0.1:3306 is safe: nothing outside can reach it. A database on 0.0.0.0 is reachable by anyone your firewall lets through.

​
How to check one port

If the command prints only the header line, nothing is listening on that port.

​
Which program is using a port?

Use this when a program fails with “Address already in use”. Stop the other program, or move one of them to a different port. If you want to end it, see kill a process.

​
How to use netstat (older systems)

netstat is part of the older net-tools package, which may not be installed. The options are the same:
Prefer ss: it is installed everywhere (package iproute2 / iproute) and is faster.

​
How to see active connections

The first lists open TCP connections with the remote IP and port. ss -s prints totals, which helps when you suspect a flood of connections.

​
Is a listening port actually open to the internet?

A port in ss is listening on the server. Whether the internet can reach it also depends on your firewall:
On a VPS, rules you set in the FREAKHOSTING Firewall panel also apply. To test from outside, see check if a port is open from outside.
When you open a port, add the rule for the new port before removing an old one, and never remove the rule for your SSH port while connected. If a firewall change locks you out of a VPS, use the VNC console. Don’t open database ports (3306, 5432, 6379, 27017) to the whole internet; allow only the IP addresses that need them.

​
How to check it worked

Start a test listener and look for it:
You see a LISTEN line on 0.0.0.0:8080 owned by python3. After kill %1 it is gone.

​
Frequently asked questions

​
What is the difference between ss and netstat?

Both list sockets. ss is the modern tool from iproute2, installed by default and faster on busy servers. netstat comes from the older net-tools package. The options -tulpn work in both.

​
Why don’t I see the process name?

Run the command with sudo. Without root rights, ss and netstat hide process names for other users’ programs.

​
How do I find which ports are open from the outside?

Run a scan from another machine you own, for example nmap -Pn 203.0.113.10, or use the steps in check if a port is open from outside. Only scan servers you are responsible for.

​
Why does port 53 show on 127.0.0.53 or 127.0.0.54?

That is systemd-resolved, the local DNS cache on Ubuntu. It only listens on the loopback address, so it isn’t reachable from outside.

VPS and dedicated server guides

Every server guide in one place.

Check if a port is open from outside

Test from the internet.

Set up a firewall with UFW

Open and close ports on Ubuntu.

Set up a firewall with firewalld

Open and close ports on AlmaLinux.

Kill a process

Free a port that is in use.
Checked against the ss(8) manual from iproute2 on 4 November 2026; ss, netstat and lsof tested on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026