ITInsightHub

How to Check Open Ports

The commands to list listening ports on Windows, Linux and macOS — and to test whether a specific port is reachable across the network.

Published

The short version: Windows → netstat -ano or Get-NetTCPConnection -State Listen · Linux → ss -tulpn · macOS → lsof -i -P -n | grep LISTEN · test a remote port → nc -zv host port.

Listing open ports on your own machine

An "open port" on your own machine means a process is listening on that port, waiting for connections. Each OS ships a tool for this — the goal is always the same: which port, which process, which interface.

Windows

netstat — the classic, built into every Windows since forever
netstat -ano | findstr LISTENING

# -a  all connections and listening ports
# -n  numeric addresses (no DNS lookups)
# -o  show the owning process ID (PID)

Map a PID to a process name with tasklist /FI "PID eq 1234", or use PowerShell to do it all in one step:

PowerShell — the object-oriented way
Get-NetTCPConnection -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess,
    @{n="Proc";e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

Linux

ss — the modern replacement for netstat (iproute2)
ss -tulpn

# -t  TCP
# -u  UDP
# -l  listening only
# -p  show the owning process
# -n  numeric ports (skip service-name lookup)

netstat -tulpn still works on most distributions but ss is the recommended tool — it reads kernel state directly and is faster and more accurate with modern sockets. To see only one port: ss -tulpn | grep ':443'.

macOS

lsof — list open files (and sockets are files)
sudo lsof -i -P -n | grep LISTEN

# -i  network files (sockets)
# -P  numeric ports
# -n  numeric addresses (skip DNS)

macOS ships netstat too, but its flags differ from Linux and the output is terse; lsof is the reliable, portable choice. It needs sudo to see processes owned by other users.

Testing a port on another machine

Listing local ports is one thing; the more common question is "can I reach that host on that port?" — a firewall, routing or service-down question.

The four standard tests, easiest first
# Windows — PowerShell, checks TCP reachability
Test-NetConnection -ComputerName example.com -Port 443

# macOS / Linux — netcat; 0 exit code means success
nc -zv example.com 443

# Anywhere — PowerShell alternative
tnc example.com -Port 443

# Scan several ports at once with nmap
nmap -p 80,443,22 example.com

Success means a TCP handshake completed — something is listening and reachable. Failure means one of three things, which you narrow down in order: the service is down, a firewall is blocking you, or the host itself is unreachable. Check the host first with ping or Test-Connection, then move inward.

Frequently asked questions

What is the difference between a listening and an established port?

A listening port has a server waiting for incoming connections (shown as LISTEN in netstat/ss). An established port belongs to an active connection that has already completed its handshake. When you "check open ports" on a server you usually mean the listening ones.

What does it mean when a port is filtered or closed?

Closed means the host replied "nothing is listening here". Filtered (the common firewall result) means there was no reply at all — a firewall dropped the packet — so you cannot tell whether a service exists. That is why a port can look "closed" from outside while the service is fine and simply firewalled.

Why do I need sudo to see the process name?

Listing ports is usually allowed for any user, but mapping a port to a process owned by another user (root, or a service account) requires elevated privileges. On Linux add sudo to ss -tulpn; on macOS lsof needs sudo for the same reason.

How do I find which process is using a specific port?

Windows: netstat -ano | findstr :443 then tasklist /FI "PID eq ". Linux: ss -tulpn | grep ':443' shows the process inline. macOS: sudo lsof -i :443. All three give you the process name and PID.