Finding listening ports and the process behind them with ss

Goal

List which processes are listening on which addresses and ports on a Linux host, as a first step before deciding a service is exposed correctly or not.

Prerequisites

ss from the iproute2 package (present by default on RHEL, Debian and Ubuntu). -p (show the owning process) needs root to attribute every socket; without it, only sockets of processes running as your own user show a process, the rest have a blank process column.

Steps

1. Run ss -tulpn: -t TCP, -u UDP, -l listening sockets only, -p show the owning process, -n show numeric addresses/ports instead of resolving names (faster, and avoids a DNS lookup hanging the command).
2. Read the "Local Address:Port" column:
   • 0.0.0.0:PORT (or a specific IPv4 address): listening on IPv4, on all interfaces (0.0.0.0) or one interface.
   • 127.0.0.1:PORT: loopback only — not reachable from another host.
   • [::]:PORT: IPv6 wildcard (all interfaces). Current iproute2 prints this form for sockets with IPV6_V6ONLY set, i.e. IPv6 only.
   • *:PORT: an IPv6 wildcard socket without IPV6_V6ONLY — dual-stack, it also accepts IPv4 connections (the Linux default while net.ipv6.bindv6only=0). Older ss versions may print [::] or ::: for these too, so a lone IPv6 wildcard line never proves IPv4 is closed.
3. Narrow with filters: ss -tlpn state listening 'sport = :22' for one port, or ss -tn state established to see active connections instead of listeners.
4. Cross-check with the process column (users:(("nginx",pid=1234,fd=6))) against ps -p 1234 -o cmd= if the name alone is ambiguous.
5. A listener with no process shown even as root is usually owned by the kernel (for example the NFS server or WireGuard). Container listeners live in another network namespace and do not appear in the host's list at all (published ports show up as a proxy process or only as NAT rules); nsenter --net=/proc/<pid>/ns/net ss -tulpn lists them from inside.

Expected result

A table of listening sockets, each attributed to a bind address (telling you the exposure) and a process (telling you the owner), ready to compare against a firewall ruleset or an intended service list.

Limits and test basis

0.0.0.0 as a bind address meaning "all local interfaces" is documented for INADDR_ANY in the ip(7) manual page's discussion of the socket API; ss(8) itself documents the -p/--processes flag and the state/port filter syntax used above.