Part II · Your system

19.1 Who listens on which port

alsoportsportopen portslisteninglistening portsssnetstataddress already in use

TL;DR

A program that accepts connections listens on a port: 22 for SSH, 443 for HTTPS.
On 0.0.0.0 or [::], it accepts connections from every network. On 127.0.0.1 or [::1], only from this machine.
ss lists them. Seeing which process owns another user's port needs root.

ss -tulpn          # TCP, UDP, listening, with processes, numeric
sudo ss -tulpn

On your machine

alice@laptopexample

$ atfq 19.1
  TCP       0.0.0.0:22      all interfaces     user root
  TCP       [::]:22         all interfaces     user root
  TCP       127.0.0.1:631   this machine only  user root
  TCP       127.0.0.1:8080  this machine only  supervisor (PID 4100)
  UDP       0.0.0.0:5353    all interfaces     user avahi
  note: the process of a socket owned by another user needs root: sudo ss
  -tulpn

An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.

Pitfalls

netstat is the old tool (package net-tools), often not installed: ss replaced it.
Listening on 0.0.0.0 doesn't mean reachable from the Internet: a firewall or your router can still block it.
Ports published by Docker bypass ufw rules, because Docker writes its own firewall rules.
Listening on a port under 1024 needs root or the CAP_NET_BIND_SERVICE capability.
"Address already in use" means another process holds the port: find it with sudo ss -ltnp 'sport = :8080'.

Deep dive 2 questions

TCP or UDP?

A TCP socket that waits for connections is in the LISTEN state, and each client then gets a connection of its own. UDP has no connections: a bound socket just receives packets from anyone. So for UDP, "listening" means bound and not connected to a single peer. DHCP clients (port 68) and mDNS (port 5353) are typical.

Where does the information come from?

/proc/net/tcp, tcp6, udp and udp6 list every socket with its owner and an inode number. To find the process, you look for that inode among the open files in /proc/PID/fd, which only root may read for other users' processes. ss asks the kernel directly over netlink instead.

Commands: ss
Paths: /proc/net/tcp
See also: 19. Network
15.2 setuid, setgid and sticky bit