How to check open ports on Windows, Linux and macOS

Listening ports on Windows

In Command Prompt or PowerShell:

netstat -ano | findstr LISTENING

The last column is the process ID (PID). To see which program it is:

tasklist /FI "PID eq 4321"

In PowerShell you can get the program name in one step:

Get-NetTCPConnection -State Listen |
  Select-Object LocalAddress, LocalPort,
    @{n='Process';e={(Get-Process -Id $_.OwningProcess).Name}} |
  Sort-Object LocalPort

Listening ports on Linux

sudo ss -tulpn

The flags mean TCP, UDP, listening only, show the process, and numeric ports. Without sudo you won't see process names for other users' programs. Alternatives:

sudo lsof -i -P -n | grep LISTEN
sudo netstat -tulpn          # older systems

Listening ports on macOS

sudo lsof -iTCP -sTCP:LISTEN -n -P
sudo lsof -i :8080           # what is using port 8080?

Read the local address column

The address a program listens on decides who can connect:

• 0.0.0.0 or [::] or *: every network interface. Reachable from other machines if the firewall allows it.
• 127.0.0.1 or [::1]: this machine only. Nothing outside can connect, whatever your firewall or router says.
• A specific address such as 192.168.1.50: only that interface.

tcp  LISTEN  0.0.0.0:22       users:(("sshd",pid=812))     reachable on every interface
tcp  LISTEN  127.0.0.1:5432   users:(("postgres",pid=990)) this machine only

Test a port from the internet

A listening port is only open to the internet if the machine's firewall, your router and your provider all let traffic through. The only reliable check comes from outside your network.

Use your public address from What is my IP. If the port is listening locally but the test times out, the traffic is being stopped on the way in. The port forwarding guide covers router rules, double NAT and CGNAT.

Test a port on another machine in your network

# Windows PowerShell
Test-NetConnection 192.168.1.50 -Port 22

# macOS and Linux
nc -zv 192.168.1.50 22

"Succeeded" or "open" means something answered. A refusal means the host is up but nothing listens on that port. A timeout usually means a firewall dropped the packet.

Scan a range of ports

nmap checks many ports at once on a host you manage:

nmap -p 1-1024 192.168.1.50   # TCP ports 1 to 1024
nmap -sU -p 53,123 192.168.1.50   # some UDP ports (needs sudo)

Only scan machines you own or are responsible for. Scanning other people's networks can break providers' terms of service and, in some countries, the law.

Close a port you do not need

1. Find the program with the commands above.
2. Stop the service, or set it to listen on 127.0.0.1 if only local programs need it.
3. Remove any router forwarding rule pointing at it.
4. Block the port in the host firewall as a second line of defence.

Common ports