86

What is the command to display a list of open ports on a Debian server?

I tried netstat -a | egrep 'Proto|LISTEN' but I would like something more specific that actually lists the port number.

8 Answers 8

113
 netstat -pln

-l will list listening ports, -p will also display the process, -n will show port numbers instead of names. Add -t to only show TCP ports.

1
  • 17
    For the -p to work properly, you need to run this as root, so sudo netstat -tpln, otherwise the process column will not be particularly useful, unless you're the user whose process is listening on a given port.
    – cjc
    Commented Feb 6, 2012 at 18:21
33

lsof -i -P

Check the man page for lsof as there is no shortage of options. -P lists the port number rather than the name taken from /etc/services Run as root, though, this will provide you with a list of all active network connections and their status (listening, established, etc).

2
  • This should be the correct answer. Netstat isn't installed by default
    – José
    Commented Dec 21, 2018 at 14:04
  • To speed this up, add -n to prevent slow reverse name resolution of every host you have a connection to.
    – Bink
    Commented Apr 2 at 16:11
17

I'm a big fan on netstat -ntlp and lsof -i, both mentioned already.

A new(er) command to me is ss.

The invocation is like:

ss -l

It's good to have options, in terms of commands and flags.

2
  • 1
    options are especially good since the mongo docker container (and presumably many others) had ss but not netstat or lsof
    – Foon
    Commented Nov 14, 2016 at 1:23
  • I started using this as an interview question. Probably asked 40 different people. So far not one has mentioned ss. I ask it like the OP, then if they answer, I say, "ok, I take away X, now how can you do it." Until the run out of ideas.
    – dmourati
    Commented Jun 29, 2017 at 4:14
13

What almost everybody wants (TCP and UDP) is netstat -tunlp.

I use it every day, maybe every hour. The 'lsof' hack is more portable (works on Solaris too), but on Debian it's not an essential package, you have to install it.

3
  • Yes, and run it via sudo. Commented Feb 7, 2012 at 23:09
  • 2
    My friend taught me to remember this command with a flower name netstat -tulpen Flag e gives additional information.
    – Deele
    Commented Dec 15, 2012 at 14:37
  • 3
    And now, in 2018, my fresh Debian box doesn't have netstat but does have lsof. :)
    – Jason
    Commented Nov 11, 2018 at 20:58
7

You can do:

netstat -an | egrep 'Proto|LISTEN'

or simply:

netstat -anl

which will give you all listening sockets on the system.

1
  • 2
    This would be the best solution (where "best" is defined as "works on the broadest range of systems" (BSD, Linux, AIX, Solaris, I believe HP-UX))
    – voretaq7
    Commented Feb 6, 2012 at 22:31
2

Listening ports are not the same as ports open from the outside. You need to consider the firewall. If you try a program like nmap from another computer then you will be able to see the open ports not blocked by firewall.

0

TechRepulic has a decent article that you can find here. It has some similar commands as you listed above but also a few variations. I would also highly recommend using nmap to do a port scan of the computer in question so you can see from an external perspective what ports are open and listening.

3
  • Could you please tell me why this was down voted? As I simply provided a link with a lot of the solutions above which were approved along with a different perspective of doing an external scan as well. Thanks.
    – Eric
    Commented Feb 6, 2012 at 19:10
  • 8
    I didn't downvote, but on serverfault like most stack-exchange we generally expect you to to put the answer here, and not just a link to somewhere else. Links go away over time, but we want content on SF to still be valuable when the links die.
    – Zoredache
    Commented Feb 6, 2012 at 22:55
  • The only line of code that the above article link has is sudo nmap -T4 -A -v 192.168.1.1/24 everything else is go do this - go do that without any details... Its like reading the back cover of a book - lots of words without meat. Commented Apr 1, 2016 at 14:37
0

I prefer to use instead:

netstat -antp 
lsof -i 
netstat -lptu
netstat -tulpn

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .