How to Check Open Ports on a Linux VPS

Network ports act as the communication gateways for your server. Every web application, database, SSH connection, and game server listens on a specific port. Auditing your open ports is essential for troubleshooting service accessibility and securing your server against unauthorized exposure.

In this guide, we will cover the best methods to check open and listening ports on your RivinCloud VPS.

1. Checking Listening Ports Locally with ss

The ss (Socket Statistics) utility is the modern, fast standard for inspecting network sockets on Linux, completely replacing the obsolete netstat tool.

Inspect All Listening TCP and UDP Ports

sudo ss -tulpn

Breakdown of flags:

• -t: Show TCP sockets.
• -u: Show UDP sockets.
• -l: Show only listening sockets (services waiting for connections).
• -p: Show the process name and PID owning each socket.
• -n: Show numeric port numbers instead of resolving service names.

Example Output:

Netid  State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port  Process
tcp    LISTEN  0       128            0.0.0.0:22          0.0.0.0:*      users:(("sshd",pid=684,fd=3))
tcp    LISTEN  0       511            0.0.0.0:80          0.0.0.0:*      users:(("nginx",pid=1120,fd=6))
tcp    LISTEN  0       128          127.0.0.1:3306        0.0.0.0:*      users:(("mariadbd",pid=850,fd=19))

[!TIP] Notice the difference between 0.0.0.0:80 (listening to the public Internet) and 127.0.0.1:3306 (listening only to local localhost requests). Binding sensitive services like databases to 127.0.0.1 prevents external attacks!

2. Checking Listening Ports with netstat

If your environment still uses legacy tools:

sudo netstat -plntu

3. Finding Ports Using lsof

The lsof (List Open Files) utility can filter specifically for network files:

sudo lsof -i -P -n | grep LISTEN

Or check a specific port:

sudo lsof -i :22

4. Scanning Ports Externally with nmap

Local tools show what the operating system is listening to, but firewall rules (such as UFW, iptables, or cloud security groups) might still block traffic from reaching the outside world.

To scan your server from another machine:

nmap -sT -p- your-server-ip

To scan the top 100 common ports quickly:

nmap your-server-ip

Common Mistakes

• Assuming a listening port is reachable externally: A service listening on 0.0.0.0:8080 will not accept external visitors if UFW or cloud firewalls block port 8080.
• Binding internal databases to 0.0.0.0: Exposing MySQL, Redis, or PostgreSQL to the entire Internet without strict IP whitelisting is a major security hazard.

Troubleshooting

• Port already in use error: When starting a service like Nginx or a Discord bot, you get Address already in use. Run sudo ss -tulpn | grep :<port> or sudo lsof -i :<port> to find and stop the existing process occupying that port.
• Service listening on ::1 only: The service is listening on IPv6 localhost instead of IPv4. Check your service configuration file to ensure it binds to IPv4 (0.0.0.0 or 127.0.0.1).

Best Practices

• Always audit open ports regularly to ensure unnecessary services (like RPC, CUPS, or unneeded testing servers) are disabled.
• Close all unused ports using the UFW firewall:

  sudo ufw default deny incoming
  sudo ufw allow 22/tcp
  sudo ufw enable
  

Frequently Asked Questions

What does 0.0.0.0 mean in the local address column?

0.0.0.0 means INADDR_ANY, meaning the service is listening on all available IPv4 network interfaces on the server.

What is the difference between TCP and UDP?

TCP is a connection-oriented, reliable transmission protocol used for websites (HTTP/HTTPS) and SSH. UDP is connectionless and faster, commonly used for DNS queries, VoIP, and gaming servers (such as Minecraft or CS:GO).

Conclusion

Understanding how to check open ports with ss -tulpn gives you complete visibility into which services are exposed on your RivinCloud VPS and ensures your infrastructure stays secure.