How to Actually Tell What's Listening

~15 min · lsof, ss, audit

Level 0Greenhorn

0 XP0/53 lessons0/14 achievements

0/100 XP to next level100 XP to go0% complete

You cannot reason about your network surface without seeing it. Three commands answer the question "what is currently exposed?"

1. `lsof -i` — what processes are listening

Run this on a fresh login. You will be surprised. Common offenders: a forgotten Jupyter on 0.0.0.0:8888, an Ollama on 0.0.0.0:11434, a Vite dev server on 0.0.0.0:5173 from a project you closed three weeks ago.

2. `ss -tlnp` (Linux) — same idea, modern tool

3. From outside — what is actually reachable

What's bound is one thing; what a router actually forwards is another. From a phone on cellular (NOT your Wi-Fi), test reachability of suspect ports.

4. The once-a-quarter audit

Set a calendar reminder. Every 90 days, run lsof from inside and a port scan from outside. Compare to last quarter. Anything new is worth understanding before you forget why you opened it.

Code

Listening sockets (macOS / Linux)·bash

# macOS / Linux: list listening ports with binding interface
sudo lsof -iTCP -sTCP:LISTEN -P -n

# Look for *:PORT      — the asterisk means 0.0.0.0 (everything)
# Look for 127.0.0.1:PORT — loopback only (safe)
# Look for 100.64.x.x:PORT — Tailscale only (safe)
# Look for 192.168.x.x:PORT — LAN only (medium)

Linux ss alternative·bash

sudo ss -tlnp
# tlnp = TCP, listening, numeric, processes

External reachability test (run from cellular, not your Wi-Fi)·bash

# Use your public IP (find at https://ifconfig.me from your home network)
nc -zv YOUR_PUBLIC_IP 8888 11434 5432 22 80 443

# Or use https://www.shodan.io/host/YOUR_PUBLIC_IP after a few days
# Shodan re-scans your IP within hours of changes

External links

Exercise

Run sudo lsof -iTCP -sTCP:LISTEN -P -n on your dev machine RIGHT NOW. Count the rows that bind to *:PORT (i.e., 0.0.0.0). For each, decide: is that intentional? If not, restart the service with a tighter bind. The list is usually longer than you expected.

Progress

Progress is local-only — sign in to sync across devices.

← PreviousWhy Tutorials Tell You 0.0.0.0 (and Why They're Wrong For You)Next →The Gotchas — IPv6, UPnP, and 'Localhost Only' Lies

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.