How to Watch TCP and UDP Ports in Real-time in Linux?

In computer networks, services running on Linux systems communicate using protocols like TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) along with specific port numbers. Monitoring these ports in real-time helps system administrators track network activity, troubleshoot connectivity issues, and ensure security.

List of Open Ports

To view all currently open ports that are listening for connections, use the netstat command with specific flags ?

$ sudo netstat -tulpn

The flags have the following meanings ?

• t − Enable listing of TCP ports
• u − Enable listing of UDP ports
• l − Print only listening (open) sockets
• p − Print the process name and PID
• n − Print port numbers instead of service names

Running the above command produces the following output ?

Active Internet connections (only servers)
Proto   Recv-Q   Send-Q   Local Address      Foreign Address    State       PID/Program name
tcp     0        0        127.0.1.1:53       0.0.0.0:*          LISTEN      966/dnsmasq
tcp     0        0        0.0.0.0:22         0.0.0.0:*          LISTEN      941/sshd
tcp     0        0        127.0.0.1:631      0.0.0.0:*          LISTEN      11450/cupsd
tcp6    0        0        :::22              :::*               LISTEN      941/sshd
tcp6    0        0        ::1:631            :::*               LISTEN      11450/cupsd
udp     0        0        0.0.0.0:50228      0.0.0.0:*                      792/avahi-daemon
udp     0        0        0.0.0.0:5353       0.0.0.0:*                      792/avahi-daemon
udp     0        0        127.0.1.1:53       0.0.0.0:*                      966/dnsmasq
udp     0        0        0.0.0.0:68         0.0.0.0:*                      949/dhclient
udp     0        0        0.0.0.0:631        0.0.0.0:*                      11452/cups-browsed

Real-Time Port Monitoring

To monitor ports in real-time and observe changing statistics like bytes sent and received, use the watch command combined with netstat ?

$ sudo watch netstat -tulpn

This command refreshes the output every 2 seconds by default, allowing you to see real-time changes in port status and network activity.

Alternative Commands

Using ss Command

The ss command is a modern replacement for netstat with faster performance ?

# List all listening ports
$ sudo ss -tulpn

# Real-time monitoring with ss
$ sudo watch ss -tulpn

Using lsof Command

The lsof command shows which processes are using specific ports ?

# List all network connections
$ sudo lsof -i

# Monitor specific port (e.g., port 80)
$ sudo lsof -i :80

Understanding the Output

The output columns provide important information about each connection ?

Conclusion

Use netstat -tulpn to list open ports and watch netstat -tulpn for real-time monitoring. The ss command offers better performance for modern systems, while lsof provides detailed process information for network troubleshooting.