Netstat and SS: Check Listening Ports

Luke Hebert

- 2 minutes read - 399 words

When you need to figure out which services are bound to which ports on a Linux host, two commands do the heavy lifting: netstat and ss. Both show socket states, but ss is faster and more modern. Here is a quick reference for the flags and what to look for in the output.

Checking Listening Ports

The most common invocation for both tools:

netstat -tunap
ss -tunap

Breaking down the flags:

  • -t - TCP sockets
  • -u - UDP sockets
  • -n - Show numeric addresses (skip DNS reverse lookups, which slow things down)
  • -a - All sockets, not just listening
  • -p - Show the PID and process name owning each socket (requires root)

Reading the Output

A typical line looks like this:

Proto  Recv-Q  Send-Q  Local Address:Port  Peer Address:Port  State  Process
tcp    0       0       0.0.0.0:22         0.0.0.0:*          LISTEN 1234/sshd
  • Local Address:Port - The address and port the service is bound to. 0.0.0.0 means all interfaces; 127.0.0.1 means localhost only.
  • Peer Address:Port - For listening sockets this is *. For established connections it shows the remote endpoint.
  • State - LISTEN means the port is open and waiting. ESTABLISHED means an active connection.
  • Process - The PID and command name. If this column is blank, you likely need to run the command as root.

Filtering for a Specific Port

To check whether port 443 is in use:

ss -tunap | grep ':443'

Or with netstat:

netstat -tunap | grep ':443'

netstat vs ss

ss is part of the iproute2 package and is generally preferred on modern distributions because it reads socket data directly from the kernel, making it significantly faster on systems with thousands of connections. netstat comes from the older net-tools package and is still widely available, but some distros (like newer Fedora and Arch) no longer ship it by default.

Note

If you are on a minimal container image, ss is more likely to be present than netstat. Check with which ss or which netstat before assuming either is available.

Quick Troubleshooting Tips

  • Port already in use? Run the command above, note the PID, then inspect the process with ps -fp <PID>.
  • Service not reachable? Confirm the port is in LISTEN state and bound to the correct interface (not just 127.0.0.1 if you need external access).
  • Firewall check: A listening port does not guarantee external reachability. Verify with iptables -L -n or nft list ruleset as needed.