What's listening on each port? ss -ltnp and friends

When I log into a server and want to know what’s running, the first command I type is this:

sudo ss -ltnp

• l → only what’s listening.
• t → TCP connections.
• n → show port numbers instead of names (“22” instead of “ssh”).
• p → which process owns each port (hence the sudo).

How to read the output

A slice of what I get on the Raspberry Pi:

0.0.0.0:22       users:(("sshd",pid=775,fd=3))
0.0.0.0:3000     users:(("docker-proxy",pid=1376405,fd=8))
0.0.0.0:8080     users:(("python",pid=3793306,fd=4))
127.0.0.1:8222   users:(("docker-proxy",pid=1397652,fd=8))
127.0.0.1:631    users:(("cupsd",pid=3913005,fd=7))

The column that matters is the address:

Address	Who can connect
0.0.0.0:port or [::]:port	Anyone who can reach the machine (the whole home network)
127.0.0.1:port	Only the machine itself
100.x.x.x:port	Only via that interface (for example, Tailscale’s)

At a glance I can check, for instance, that my password manager (8222) only listens locally, as intended.

If it says docker-proxy

When the process is docker-proxy, the port belongs to a container. To find out which:

docker ps --format '{{.Names}}\t{{.Ports}}'

Other uses that save me

• Why won’t my service start? If it says “address already in use”, find who has the port:

  sudo ss -ltnp | grep :8080

• Active connections (not just listeners): drop the l.

  ss -tnp

• UDP too (DNS, WireGuard…): add u.

  sudo ss -ltunp

On Windows

The PowerShell equivalent:

Get-NetTCPConnection -State Listen | Sort-Object LocalPort |
  Select-Object LocalAddress, LocalPort, OwningProcess

Or the classic netstat -ano | findstr LISTENING, which gives the process ID to look up in Task Manager.

Why it’s so useful

Because documentation and your notes can be out of date, but what’s listening on each port is the truth. It’s the fastest way to inventory a server, and to discover things you have open without knowing.