every open port is a door, find your listeners

every open port is a door

you lock your front door. you probably check your windows before bed. but do you know how many doors your computer has left wide open right now, quietly waiting for someone to walk in? most people don't, and that's not a character flaw, it's just that network ports are invisible until you go looking. so let's go looking.

the command for this is simple, and it fits in a tweet:

ss -tulpn | grep LISTEN

run it. actually run it before you keep reading. i'll wait.

what you're actually looking at

this command lists every process on your machine that's actively listening for incoming network connections. that's the key word, listening. not "connected to." listening means the process has told your operating system "hey, if anything comes knocking on this port, send it to me." that's a door. someone doesn't need to be inside your house for a door to be a risk, they just need the door to exist and be unlocked.

here's the breakdown of the flags so it's not just magic incantation:

-t   show tcp sockets
-u   show udp sockets
-l   show only listening sockets
-p   show the process name and pid using that socket
-n   show numeric ports instead of resolving service names

and the grep LISTEN at the end just filters the output down to, well, listening sockets. it cuts the noise so you're not scrolling through every active connection your browser has open.

reading the output without panicking

the output has columns like netid, state, local address:port, and process. the part you care about most is the local address and the process attached to it.

two things to check for every line:

1. is this bound to 127.0.0.1 or 0.0.0.0? a service listening on 127.0.0.1 is only reachable from your own machine. that's a door inside your house, not one facing the street. a service listening on 0.0.0.0 is reachable from anywhere that can route to your machine, including your local network and potentially the whole internet if there's no firewall in the way. that distinction alone explains most "wait why is this exposed" moments.

2. do you actually recognize the process? a lot of software opens listening ports as a side effect of being installed, print services, media sharing daemons, database servers you forgot you set up two years ago for a project you abandoned. none of these are inherently malicious, but every one of them is a door you didn't consciously decide to leave open.

finding your actual exposure

running the command locally tells you what's listening. it doesn't tell you what's reachable from outside your network, because your router or firewall might already be blocking that door at the perimeter. to know your real exposure you have to check both layers.

for the local layer, cross reference what ss shows you against what you expect to be running. if you see a port tied to a service you never installed on purpose, that's your first lead, not your last step. look up the process name, check if it's something a package pulled in as a dependency, and decide if you need it running at all.

for the external layer, you want to know what your public ip actually exposes, since your router's nat and firewall rules change the picture completely. an internal port doesn't automatically mean the internet can see it.

the fix, not just the finding

once you've spotted a door you don't want open, you have three real options, in order of preference:

# stop the service entirely if you don't need it
sudo systemctl stop servicename
sudo systemctl disable servicename

# or, if you need the service locally but not externally,
# rebind it to 127.0.0.1 in its config file instead of 0.0.0.0

# or, block it at the firewall if you can't touch the config
sudo ufw deny 1234/tcp

disabling beats blocking, and blocking beats hoping nobody notices. a firewall rule on a service that shouldn't be running at all is just a second lock on a door you should've bricked over.

the takeaway

this isn't a one time check. install new software, spin up a docker container, set up a homelab project, and your listener list changes without you noticing. make ss -tulpn | grep LISTEN part of your regular maintenance, same as checking your logs or updating your packages. every door you find and decide to keep open should be a decision, not an accident. the goal isn't zero open ports, it's zero surprise open ports.