Who is listening on my ports

Published on 2007-01-13. Modified on 2020-01-25.

This is a mini tutorial in how to figure out what applications are listening on your ports on GNU/Linux, OpenBSD, and FreeBSD.

sockstat can be used on FreeBSD in order to see which programs that are actively listening on one or several ports on the computer. See man sockstat for further information.

In order to see, on FreeBSD, which programs that are actively listening now, and on which ports, you can type in the command:

# sockstat -l -4 -6

On OpenBSD you use the program netstat. See man netstat for further information.

# netstat -atn | grep LISTEN

On a GNU/Linux distribution use ss. See man ss for further instructions.

# ss -a -t -p

On my FreeBSD 6.1 Security, where Sendmail is disabled, I get the following results:

USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
root cupsd 500 2 tcp6 ::1:631 *:*
root cupsd 500 3 tcp4 127.0.0.1:631 *:*
root cupsd 500 5 udp4 *:631 *:*
root syslogd 431 6 udp6 *:514 *:*
root syslogd 431 7 udp4 *:514 *:*

I can see two programs listening "syslogd" and "cupsd".

USER indicates who has started the program. System programs and several services are started by the system as root. COMMAND is the program or service name. PID is the process number assigned to the program or service and FD is the type of communication.

Below PROTO you can see which port the program or service is listening on. In this example "cupsd" is listening on port 631.

If you want to know what program or service that is running on a specific port you can use the followin command:

# sockstat -4 -6 -p NUMBER

In which NUMBER is the number of the port you want to investigate.

Another method that works on all GNU/Linux distributions and BSD flavors is to use nmap. You need to install nmap with your package manager.

Then use the command:

# nmap -sT -PE -PT -v 127.0.0.1