# How to Check Open Ports (Windows, Linux, macOS)

> How to check open ports on Windows, Linux and macOS with netstat, ss, lsof, Get-NetTCPConnection and Test-NetConnection — plus how to test a remote port.

- Page URL: https://itinsighthub.com/guides/check-open-ports/
- Markdown variant of this page: append `?format=md` to any URL on this site or send `Accept: text/markdown`.
- Full site index for AI assistants: https://itinsighthub.com/llms.txt
- Full site export: https://itinsighthub.com/llms-full.txt

# How to Check Open Ports

The commands to list listening ports on Windows, Linux and macOS — and to test whether a specific port is reachable across the network.

Published August 29, 2026

The short version: Windows → netstat -ano or Get-NetTCPConnection -State Listen · Linux → ss -tulpn · macOS → lsof -i -P -n | grep LISTEN · test a remote port → nc -zv host port.

## Listing open ports on your own machine

An "open port" on your own machine means a process is **listening** on that port, waiting for connections. Each OS ships a tool for this — the goal is always the same: *which port, which process, which interface.*

### Windows

netstat — the classic, built into every Windows since forever

```
netstat -ano | findstr LISTENING

# -a  all connections and listening ports
# -n  numeric addresses (no DNS lookups)
# -o  show the owning process ID (PID)
```

Map a PID to a process name with `tasklist /FI "PID eq 1234"`, or use PowerShell to do it all in one step:

PowerShell — the object-oriented way

```
Get-NetTCPConnection -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess,
    @{n="Proc";e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}
```

### Linux

ss — the modern replacement for netstat (iproute2)

```
ss -tulpn

# -t  TCP
# -u  UDP
# -l  listening only
# -p  show the owning process
# -n  numeric ports (skip service-name lookup)
```

`netstat -tulpn` still works on most distributions but `ss` is the recommended tool — it reads kernel state directly and is faster and more accurate with modern sockets. To see only one port: `ss -tulpn | grep ':443'`.

### macOS

lsof — list open files (and sockets are files)

```
sudo lsof -i -P -n | grep LISTEN

# -i  network files (sockets)
# -P  numeric ports
# -n  numeric addresses (skip DNS)
```

macOS ships `netstat` too, but its flags differ from Linux and the output is terse; `lsof` is the reliable, portable choice. It needs `sudo` to see processes owned by other users.

## Testing a port on another machine

Listing local ports is one thing; the more common question is "can I reach *that* host on *that* port?" — a firewall, routing or service-down question.

The four standard tests, easiest first

```
# Windows — PowerShell, checks TCP reachability
Test-NetConnection -ComputerName example.com -Port 443

# macOS / Linux — netcat; 0 exit code means success
nc -zv example.com 443

# Anywhere — PowerShell alternative
tnc example.com -Port 443

# Scan several ports at once with nmap
nmap -p 80,443,22 example.com
```

Success means a TCP handshake completed — something is listening and reachable. Failure means one of three things, which you narrow down in order: the service is down, a firewall is blocking you, or the host itself is unreachable. Check the host first with `ping` or `Test-Connection`, then move inward.

## Frequently asked questions

**What is the difference between a listening and an established port?**

A listening port has a server waiting for incoming connections (shown as LISTEN in netstat/ss). An established port belongs to an active connection that has already completed its handshake. When you "check open ports" on a server you usually mean the listening ones.

**What does it mean when a port is filtered or closed?**

Closed means the host replied "nothing is listening here". Filtered (the common firewall result) means there was no reply at all — a firewall dropped the packet — so you cannot tell whether a service exists. That is why a port can look "closed" from outside while the service is fine and simply firewalled.

**Why do I need sudo to see the process name?**

Listing ports is usually allowed for any user, but mapping a port to a process owned by another user (root, or a service account) requires elevated privileges. On Linux add sudo to ss -tulpn; on macOS lsof needs sudo for the same reason.

**How do I find which process is using a specific port?**

Windows: netstat -ano | findstr :443 then tasklist /FI "PID eq ". Linux: ss -tulpn | grep ':443' shows the process inline. macOS: sudo lsof -i :443. All three give you the process name and PID.

## Related references

- [Common TCP/UDP ports](https://itinsighthub.com/common-ports/) — an IANA-checked table of the ports you will recognize.
- [PowerShell one-liners](https://itinsighthub.com/powershell/one-liners/) — includes port and connection cmdlets.
- [Linux networking cheat sheet](https://itinsighthub.com/linux/linux-networking/) — ss, ip, ping and friends in context.

---

© 2026 ITInsightHub · [About](https://itinsighthub.com/about/) · [Contact](https://itinsighthub.com/contact/) · [Privacy](https://itinsighthub.com/privacy/)