How to Check Open Ports in Linux: nmap, netcat, and Bash

When troubleshooting a network connection or configuring a firewall, the first question is whether a port is actually reachable. This guide covers three command-line methods for checking open ports in Linux: nmap, netcat, and the Bash /dev/tcp pseudo-device.

What Is an Open Port?

A listening port is one that a local application has bound to and is waiting for connections. An open port is a listening port that is also reachable from the network, meaning the firewall permits traffic through to it. A port can be listening locally but completely invisible to the outside if the firewall drops or rejects packets before they arrive.

When a firewall drops packets silently, nmap reports the port as filtered — it cannot determine whether anything is listening. When a firewall sends an active rejection, the client receives an immediate reset and nmap marks the port as closed. Knowing this distinction helps you interpret scan results correctly.

Every open port is a potential attack surface. Only expose the ports your application actually needs.

Check Open Ports in Linux with nmap

nmap is the most thorough option for port scanning. Beyond open/closed detection, it supports service detection, version probing, and host discovery.

To scan all 65535 TCP ports on a host:

bashsudo nmap -sT -p- 10.10.8.8

-sT runs a TCP connect scan. -p- scans all ports; without it, nmap covers only the 1000 most common ports, which is faster but not exhaustive for a complete audit.

PORT   STATE SERVICE22/tcp open  ssh80/tcp open  http

TCP connect scans (-sT) work as a regular user. SYN scans (-sS) and UDP scans (-sU) require sudo because they send raw packets.

UDP scanning is less reliable than TCP because UDP has no handshake. nmap marks ports as open|filtered when there is no response. Add -sV to probe for service versions and get a more definitive result:

bashsudo nmap -sU -sV -p- 10.10.8.8

Use netcat and Bash /dev/tcp for Lightweight Tests

netcat (nc) scans a port range quickly without a full report. To check TCP ports 20–80:

bashnc -z -v 10.10.8.8 20-80

-z puts nc in scan-only mode — no data is sent. -v enables verbose output. netcat writes connection status to stderr, not stdout, so redirect stderr before piping to grep:

bashnc -z -v 10.10.8.8 20-80 2>&1 | grep succeeded

This shows only the ports where a connection succeeded. Add -u for UDP.

Bash /dev/tcp lets you test a single port with no external tools. When Bash opens this pseudo-device, it attempts a TCP connection to the specified host and port:

bashif timeout 5 bash -c '</dev/tcp/kernel.org/443 &>/dev/null'; then  echo "Port is open"else  echo "Port is closed"fi

timeout is necessary because /dev/tcp has no built-in connection timeout limit. &>/dev/null suppresses all output from the connection attempt. To test a range:

bashfor PORT in {20..80}; do  timeout 1 bash -c "</dev/tcp/10.10.8.8/$PORT &>/dev/null" && echo "port $PORT is open"done

/dev/tcp is a Bash-only feature. It does not work in dash, sh, or other shells.

Use nmap for thorough audits, nc for quick range checks, and Bash /dev/tcp for single-port tests on systems where no extra tools are available. Leave a comment below if you run into any issues.