How to Check Open Ports: ss, netstat, nmap, telnet

Open ports are checked from two sides: locally, to see which services are listening (ss -tulpn, netstat -tulpn), and externally, to see which ports are actually reachable through the firewall (nmap, telnet). The difference matters — a port can be listening on the server and still be blocked by a firewall. Below are the exact commands for both checks.

Local check: what the server is listening on

ss — the modern tool

Show every listening TCP and UDP port together with its process:

ss -tulpn

What the flags mean:

Find what occupies a specific port:

ss -tulpn | grep :443

netstat — the classic option

If the net-tools package is installed:

netstat -tulpn

External check: what is reachable from outside

A local check ignores the firewall. To find out whether a port is reachable from the internet, scan the server from another host.

nmap

Check the common ports:

nmap 203.0.113.10

Check one specific port:

nmap -p 443 203.0.113.10

Scan a range and detect services:

nmap -p 1-1000 -sV 203.0.113.10

Port states in nmap output:

telnet — a quick single-port check

telnet 203.0.113.10 443

If the connection is established, the port is open. “Connection refused” means closed or not listening, while a hang usually means a firewall is dropping the packets.

The PowerShell equivalent, without telnet:

Test-NetConnection -ComputerName 203.0.113.10 -Port 443

A check with nc (netcat):

nc -zv 203.0.113.10 443

Who is connected: active connections

Besides listening ports, it helps to see established connections — for example, to know who is talking to the server right now:

ss -tnp state established

Count connections per remote IP, a simple way to spot anomalies:

ss -tn state established | awk '{print $4}' | cut -d: -f1 | sort | uniq -c | sort -rn

On Windows the equivalent view is:

Get-NetTCPConnection -State Established | Sort-Object RemoteAddress

Default ports of common services

When troubleshooting, it helps to remember which ports belong to which services by default:

If a port is being held by a service you did not expect, that is a reason to review the configuration or check the system for unwanted processes.

A standard troubleshooting order

1. On the server: ss -tulpn | grep :PORT — is the service listening?
2. If it is not listening, start or configure the service.
3. If it is listening but unreachable from outside, check the firewall (ufw status, iptables -L).
4. From outside: nmap -p PORT IP — a filtered state points at a firewall.

Frequently asked questions

ss shows the port, but it is unreachable from outside — why? The service is listening, but inbound traffic is being dropped by a firewall. Check ufw status or your iptables rules and open the port.

Why is ss better than netstat? ss is faster and ships in the current iproute2 package. netstat is deprecated and often not installed by default.

nmap says filtered — what does that mean? Packets never reach the port because a firewall blocks them, either on the server or in the provider’s network. The port is not “closed”, it is filtered.

Can I scan someone else’s server? Scan only your own systems, or systems whose owner explicitly permitted it — otherwise you may be breaking both policy and law.

How do I check a port without installing nmap? Use telnet IP PORT, nc -zv IP PORT, or Test-NetConnection in PowerShell.

Need a server where you fully control the ports and the firewall? Deploy a Linux VPS in the VPS hosting section or order server administration.