How do I find what ports are open on my system?

Identifying Open Ports on Your System

Open ports represent potential entry points for attackers and often indicate which services are running on your system. Whether you're an IT administrator managing infrastructure, a security professional conducting network assessments, or a developer troubleshooting application connectivity, knowing how to identify open ports is a fundamental skill. This guide covers the most practical methods for discovering which ports are listening on your system.

The process of finding open ports involves querying your system to determine which ports have services actively listening for incoming connections. This differs from simply knowing which services you've installed—it reveals what's actually accessible over the network. Understanding your port landscape is the first step toward securing your systems properly.

Windows Methods for Identifying Open Ports

Using netstat Command

The netstat command is the most straightforward way to view listening ports on Windows:

netstat -ano

This command displays all connections and listening ports with detailed information:

• -a: Shows all connections and listening ports
• -n: Displays addresses and port numbers in numerical form
• -o: Includes the owning process ID (PID) associated with each connection

The output shows columns including Protocol, Local Address, Foreign Address, State, and PID. To identify which process is using a specific port, look up the PID in Task Manager or use:

tasklist /FI "PID eq XXXX"

Replace XXXX with the specific PID number. This correlates the port listener with the actual application.

For a more focused view of listening ports only:

netstat -ano | findstr LISTENING

This filters the output to show only ports in the LISTENING state, making it easier to identify active services.

Using PowerShell

Modern Windows systems support PowerShell, which provides more powerful commands:

Get-NetTCPConnection | Where-Object {$_.State -eq "Listen"} | Select-Object LocalAddress, LocalPort, OwningProcess

This PowerShell command provides a cleaner output than netstat and is more suitable for scripting and automation. You can even get the process name directly:

Get-NetTCPConnection | Where-Object {$_.State -eq "Listen"} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        LocalPort = $_.LocalPort
        Process = $proc.ProcessName
        PID = $_.OwningProcess
    }
}

Using netstat with More Details

For UDP ports specifically:

netstat -ano | findstr UDP

Or to see all TCP listening ports:

netstat -ano | findstr "LISTENING"

Resource Monitor GUI

Windows provides a graphical interface for viewing network connections:

1. Press Windows Key + R
2. Type "resmon" and press Enter
3. Navigate to the Network tab
4. Expand "Listening Ports" to view all open ports

This visual method helps identify which applications are using which ports.

netstat with Specific Port

To check if a specific port is listening:

netstat -ano | findstr :8080

Replace 8080 with your target port number.

Linux/macOS Methods for Identifying Open Ports

Using netstat Command

On Linux and macOS systems:

netstat -tuln

The flags mean:

• -t: Show TCP connections
• -u: Show UDP connections
• -l: Show only listening sockets
• -n: Show numeric addresses and ports

Using ss Command (Modern Linux)

The ss command is the modern replacement for netstat on newer Linux systems:

ss -tuln

This provides similar output to netstat but with better performance on systems with many connections.

Using lsof Command

lsof (list open files) can identify processes using network ports:

lsof -i -P -n | grep LISTEN

This shows listening ports with the associated process names and PIDs. The flags mean:

• -i: Selects IP sockets
• -P: Shows port numbers instead of service names
• -n: Shows IP addresses instead of hostnames

For a specific port:

lsof -i :8080

Using nmap (Network Mapper)

For a more comprehensive network scan of your local machine:

nmap localhost

Or with more detailed information:

nmap -sV localhost

The -sV flag attempts to identify service versions running on each port. This tool is powerful for understanding not just which ports are open, but what services are listening.

Using nc (netcat) for Port Testing

Test if a specific port is listening:

nc -zv localhost 8080

The flags mean:

• -z: Scan mode (without sending data)
• -v: Verbose output
• Replace 8080 with your target port

A successful connection indicates the port is open, while a connection refusal indicates it's not listening.

Comprehensive Port Scanning Tools

Using nmap for Deep Scanning

While the above methods check local systems, nmap can scan your external port visibility:

nmap -p- -A localhost

This comprehensive scan:

• -p-: Scans all 65535 ports (takes longer)
• -A: Enables aggressive scanning with OS detection, version detection, and script scanning

Online Port Scanning Services

For checking which ports are visible from the internet:

1. ShieldsIO: Visit shields.io for quick port scanning
2. CanYouSeeMe.org: Simple tool to check if a specific port is open from the internet
3. Shodan: More advanced tool for finding exposed services globally

These services scan your public IP address from the internet to determine which ports are actually visible outside your network.

Understanding Port States

When identifying open ports, you'll encounter several states:

LISTENING: The port is open and actively accepting incoming connections. The associated service is running and available.

ESTABLISHED: An active connection exists on this port. Data may be actively flowing.

CLOSE_WAIT: The connection is closing, with the remote system having closed its side first.

TIME_WAIT: The port is waiting before releasing the socket after connection closure.

SYN_RECEIVED: The system has received a connection request and is responding.

Securing Your Open Ports

Once you've identified your open ports, take these security steps:

Inventory Services: Document what service should legitimately be listening on each port. Any unexpected ports are immediately suspicious.

Close Unnecessary Ports: If a port isn't needed, disable the associated service or block it with a firewall rule.

Apply Firewall Rules: Restrict access to necessary ports only from trusted IP addresses or networks.

Keep Software Updated: Services on open ports should be running the latest patched versions.

Monitor Port Changes: Unexpected new listening ports might indicate a compromise. Use monitoring tools to alert on changes.

Change Default Ports: Moving services from default ports (like moving SSH from 22 to 2222) reduces automated attack attempts.

Best Practices for Port Management

Regular Scanning: Run port identification commands regularly (weekly or monthly) to detect unauthorized changes.

Automated Monitoring: Use tools like Nagios, Zabbix, or Prometheus to automatically monitor port availability and alert on changes.

Documentation: Keep detailed documentation of which ports should be open and what services use them.

Testing After Changes: Always verify that intended ports open and unintended ports close after system changes or firewall updates.

Principle of Least Privilege: Only open ports absolutely necessary for business operations.

Conclusion

Identifying open ports is a critical first step in understanding your system's network posture. Whether using simple command-line tools like netstat and ss, or more advanced scanning utilities like nmap, regular port discovery should be part of your security routine. By understanding what ports are open, why they're open, and what services use them, you can make informed decisions about network security, identify unauthorized access points, and ensure your systems are exposed only to the extent necessary for legitimate operations.