How do you see which ports are listening and which process owns them?
Run sudo ss -tulpn. It lists TCP and UDP listening sockets with numeric ports and the owning process name and PID. ss has replaced the older netstat on modern Linux, and you can filter with grep or an expression like sport = :8080.
Explain it simply
Think of a building's intercom panel listing every flat and who answers it. ss shows the sockets on your machine and which program is behind each.
ss -tulpn breaks down as:
-tTCP,-uUDP-lonly listening sockets-pshow the process (needs sudo for other users' processes)-nnumbers instead of names, so 22 instead of ssh
Columns include State, Local Address:Port and Process. A local address of 0.0.0.0:80 or *:80 means all interfaces; 127.0.0.1:5432 means reachable only from this machine, which is how a private database should look.
To find who is using port 8080: sudo ss -tulpn | grep :8080 or ss -ltnp 'sport = :8080'. ss -s prints a summary. netstat does a similar job but is deprecated and slower.
Example
sudo ss -tulpn | head -4
# Netid State Local Address:Port Process
# tcp LISTEN 0.0.0.0:22 users:(("sshd",pid=812,fd=3))
# tcp LISTEN 127.0.0.1:5432 users:(("postgres",pid=990,fd=5))What to say in the interview
"ss -tulpn lists listening TCP and UDP sockets with numeric ports and owning processes. I check whether a service listens on 0.0.0.0 or only 127.0.0.1, and use grep :PORT to find what holds a port. ss replaced netstat."
Common mistakes
- Forgetting sudo and seeing no process names.