Who is listening on my ports
Published on 2007-01-13. Modified on 2020-01-25.
This is a mini tutorial in how to figure out what applications are listening on your ports on GNU/Linux, OpenBSD, and FreeBSD.
sockstat can be used on FreeBSD in order to see which programs that are actively listening on one or several ports on the computer. See
man sockstat for further information.
In order to see, on FreeBSD, which programs that are actively listening now, and on which ports, you can type in the command:
# sockstat -l -4 -6
On OpenBSD you use the program
man netstat for further information.
# netstat -atn | grep LISTEN
On a GNU/Linux distribution use
man ss for further instructions.
# ss -a -t -p
On my FreeBSD 6.1 Security, where Sendmail is disabled, I get the following results:
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS root cupsd 500 2 tcp6 ::1:631 *:* root cupsd 500 3 tcp4 127.0.0.1:631 *:* root cupsd 500 5 udp4 *:631 *:* root syslogd 431 6 udp6 *:514 *:* root syslogd 431 7 udp4 *:514 *:*
I can see two programs listening "syslogd" and "cupsd".
USER indicates who has started the program. System programs and several services are started by the system as root.
COMMAND is the program or service name.
PID is the process number assigned to the program or service and
FD is the type of communication.
PROTO you can see which port the program or service is listening on. In this example "cupsd" is listening on port 631.
If you want to know what program or service that is running on a specific port you can use the followin command:
# sockstat -4 -6 -p NUMBER
In which NUMBER is the number of the port you want to investigate.
Another method that works on all GNU/Linux distributions and BSD flavors is to use
nmap. You need to install
nmap with your package manager.
Then use the command:
# nmap -sT -PE -PT -v 127.0.0.1