Linux Shell Scripting Cookbook - Third Edition

Tracing applications listening on ports

A service on your system will open a socket in the listen mode to accept network connections from a remote site. The SSHD application does this to listen for SSH connections, http servers do this to accept HTTP requests, and so on.

If your system has been hacked, it might have a new application listening for instructions from its master.

The -l option to ss will list sockets that are open in the listen mode. The -u option specifies to report UDP sockets. A -t option reports TCP sockets.

This command shows a subset of the listening UDP sockets on a Linux workstation:

$ ss -ul
State          Recv-Q  Send-Q      Local Address:Port         Peer Address:Port   
UNCONN         0       0           *:sunrpc                   *:*       
UNCONN         0       0           *:ipp                      *:*       
UNCONN 0 0 *:ntp *:* ...