How do I find what ports are open on my system?

To find open ports on your system, use the built-in command for your OS: on Linux run ss -tulpn, on macOS run sudo lsof -iTCP -sTCP:LISTEN -n -P, and on Windows run netstat -ano. Each lists the ports where a program is listening for incoming connections, along with the owning process. To see your machine the way an outsider does — probing across the network instead of reading the local socket table — run nmap localhost or nmap <your-ip>. Local tools show every bound socket; nmap shows only what actually answers.

That's the summary an AI overview gives you. What it can't give you is the part that trips people up: these tools measure different things, macOS silently rejects the Linux flags everyone copies, and a port "listening" in ss can still be invisible from the network. The table and diagram below map each method to what it actually reveals — and the rest of this guide covers how to read the output, find the process behind a port, and check what's exposed to the internet.

The one-command answer for each OS

Most of the time you don't need a deep scan — you need the single built-in command that lists what's listening. Here's the method per operating system, what each one actually shows, and the gotcha to know before you copy it:

OS	Command	What it shows	Notes / gotcha
Linux (modern)	ss -tulpn	TCP + UDP listening sockets, numeric ports, owning process/PID	The current standard (iproute2). Add sudo to see processes you don't own. -p = process, -l = listening only.
Linux (legacy)	netstat -tulpn	Same as above	Deprecated but familiar; may not be installed by default. ss is preferred.
macOS	sudo lsof -iTCP -sTCP:LISTEN -n -P	TCP listeners with process name and PID	macOS uses BSD netstat — the Linux -tuln flags do not work. lsof is the reliable path.
macOS (all sockets)	netstat -an -p tcp	Every TCP socket + state	BSD syntax; filter for LISTEN yourself. Use -p udp for UDP.
Windows	netstat -ano	All connections + listeners with PID	Pipe to findstr LISTENING for listeners only; map PID with tasklist.
Windows (PowerShell)	Get-NetTCPConnection -State Listen	TCP listeners as objects (scriptable)	Cleaner output; join with Get-Process to get the app name.
Any (network view)	nmap localhost or nmap <ip>	Ports that actually respond over the network	Probes packets, not the socket table — reveals what's reachable, not just bound. Only scan hosts you own.

The key distinction the table encodes: ss, lsof, and netstat read your machine's own socket table (including localhost-only services); nmap sends real packets and shows only what answers across the network. That's why a port can be "listening" locally yet invisible to nmap — it may be bound to 127.0.0.1 or blocked by a firewall.

Identifying Open Ports on Your System

Open ports represent potential entry points for attackers and often indicate which services are running on your system. Whether you're an IT administrator managing infrastructure, a security professional conducting network assessments, or a developer troubleshooting application connectivity, knowing how to identify open ports is a fundamental skill. This guide covers the most practical methods for discovering which ports are listening on your system.

The process of finding open ports involves querying your system to determine which ports have services actively listening for incoming connections. This differs from simply knowing which services you've installed—it reveals what's actually accessible over the network. Understanding your port landscape is the first step toward securing your systems properly.

Windows Methods for Identifying Open Ports

Using netstat Command

The netstat command is the most straightforward way to view listening ports on Windows:

netstat -ano

This command displays all connections and listening ports with detailed information:

• -a: Shows all connections and listening ports
• -n: Displays addresses and port numbers in numerical form
• -o: Includes the owning process ID (PID) associated with each connection

The output shows columns including Protocol, Local Address, Foreign Address, State, and PID. To identify which process is using a specific port, look up the PID in Task Manager or use:

tasklist /FI "PID eq XXXX"

Replace XXXX with the specific PID number. This correlates the port listener with the actual application.

For a more focused view of listening ports only:

netstat -ano | findstr LISTENING

This filters the output to show only ports in the LISTENING state, making it easier to identify active services.

Using PowerShell

Modern Windows systems support PowerShell, which provides more powerful commands:

Get-NetTCPConnection | Where-Object {$_.State -eq "Listen"} | Select-Object LocalAddress, LocalPort, OwningProcess

This PowerShell command provides a cleaner output than netstat and is more suitable for scripting and automation. You can even get the process name directly:

Get-NetTCPConnection | Where-Object {$_.State -eq "Listen"} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        LocalPort = $_.LocalPort
        Process = $proc.ProcessName
        PID = $_.OwningProcess
    }
}

Using netstat with More Details

For UDP ports specifically:

netstat -ano | findstr UDP

Or to see all TCP listening ports:

netstat -ano | findstr "LISTENING"

Resource Monitor GUI

Windows provides a graphical interface for viewing network connections:

1. Press Windows Key + R
2. Type "resmon" and press Enter
3. Navigate to the Network tab
4. Expand "Listening Ports" to view all open ports

This visual method helps identify which applications are using which ports.

netstat with Specific Port

To check if a specific port is listening:

netstat -ano | findstr :8080

Replace 8080 with your target port number.

Linux/macOS Methods for Identifying Open Ports

Using netstat Command

On Linux, the classic invocation is:

netstat -tuln

The flags mean:

• -t: Show TCP connections
• -u: Show UDP connections
• -l: Show only listening sockets
• -n: Show numeric addresses and ports

Important — this does not work on macOS. macOS ships the BSD version of netstat, where -t, -u, and -l do not have these meanings, so netstat -tuln will error or return unexpected output. On a Mac, use lsof (below) or the BSD syntax:

netstat -an -p tcp    # all TCP sockets; filter for LISTEN yourself

To scope the modern Linux netstat to a single protocol, drop the flag you don't need — netstat -tln for TCP only, netstat -uln for UDP only.

Using ss Command (Modern Linux)

The ss command is the modern replacement for netstat on newer Linux systems:

ss -tulpn

The flags: -t (TCP), -u (UDP), -l (listening only), -p (show the owning process/PID — run with sudo to see processes you don't own), -n (numeric ports). This provides similar output to netstat but reads socket state directly from the kernel, giving much better performance on systems with thousands of connections.

Using lsof Command

lsof (list open files) can identify processes using network ports:

lsof -i -P -n | grep LISTEN

This shows listening ports with the associated process names and PIDs. The flags mean:

• -i: Selects IP sockets
• -P: Shows port numbers instead of service names
• -n: Shows IP addresses instead of hostnames

For a specific port:

lsof -i :8080

Using nmap (Network Mapper)

For a more comprehensive network scan of your local machine:

nmap localhost

Or with more detailed information:

nmap -sV localhost

The -sV flag attempts to identify service versions running on each port. This tool is powerful for understanding not just which ports are open, but what services are listening.

Using nc (netcat) for Port Testing

Test if a specific port is listening:

nc -zv localhost 8080

The flags mean:

• -z: Scan mode (without sending data)
• -v: Verbose output
• Replace 8080 with your target port

A successful connection indicates the port is open, while a connection refusal indicates it's not listening.

Comprehensive Port Scanning Tools

Using nmap for Deep Scanning

While the above methods check local systems, nmap can scan your external port visibility:

nmap -p- -A localhost

This comprehensive scan:

• -p-: Scans all 65535 ports (takes longer)
• -A: Enables aggressive scanning with OS detection, version detection, and script scanning

Online Port Scanning Services

For checking which ports are visible from the internet:

1. ShieldsIO: Visit shields.io for quick port scanning
2. CanYouSeeMe.org: Simple tool to check if a specific port is open from the internet
3. Shodan: More advanced tool for finding exposed services globally

These services scan your public IP address from the internet to determine which ports are actually visible outside your network.

Understanding Port States

When identifying open ports, you'll encounter several states:

LISTENING: The port is open and actively accepting incoming connections. The associated service is running and available.

ESTABLISHED: An active connection exists on this port. Data may be actively flowing.

CLOSE_WAIT: The connection is closing, with the remote system having closed its side first.

TIME_WAIT: The port is waiting before releasing the socket after connection closure.

SYN_RECEIVED: The system has received a connection request and is responding.

Securing Your Open Ports

Once you've identified your open ports, take these security steps:

Inventory Services: Document what service should legitimately be listening on each port. Any unexpected ports are immediately suspicious.

Close Unnecessary Ports: If a port isn't needed, disable the associated service or block it with a firewall rule.

Apply Firewall Rules: Restrict access to necessary ports only from trusted IP addresses or networks.

Keep Software Updated: Services on open ports should be running the latest patched versions.

Monitor Port Changes: Unexpected new listening ports might indicate a compromise. Use monitoring tools to alert on changes.

Change Default Ports: Moving services from default ports (like moving SSH from 22 to 2222) reduces automated attack attempts.

Best Practices for Port Management

Regular Scanning: Run port identification commands regularly (weekly or monthly) to detect unauthorized changes.

Automated Monitoring: Use tools like Nagios, Zabbix, or Prometheus to automatically monitor port availability and alert on changes.

Documentation: Keep detailed documentation of which ports should be open and what services use them.

Testing After Changes: Always verify that intended ports open and unintended ports close after system changes or firewall updates.

Principle of Least Privilege: Only open ports absolutely necessary for business operations.

Conclusion

Identifying open ports is a critical first step in understanding your system's network posture. Whether using simple command-line tools like netstat and ss, or more advanced scanning utilities like nmap, regular port discovery should be part of your security routine. By understanding what ports are open, why they're open, and what services use them, you can make informed decisions about network security, identify unauthorized access points, and ensure your systems are exposed only to the extent necessary for legitimate operations.