The ss command in Linux: who is listening on which port

MariaDB is installed properly in Lesson 56, on its own LVM volume, so this lab doesn’t install it. Two tiny Python web servers stand in for it instead, one on 3306 (the MariaDB and MySQL port) and one on 33060 (the MySQL X protocol port), which is all ss needs to see. You work on rocky01 as student, test from ubu01, and stop everything at the end.

Start with mkdir -p ~/lab23 && cd ~/lab23 on rocky01.

1List every listening socket

Run this on rocky01:

sudo ss -tulnp

You should see something like this:

Netid State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
udp   UNCONN 0      0          127.0.0.1:323       0.0.0.0:*    users:(("chronyd",pid=801,fd=5))
udp   UNCONN 0      0              [::1]:323          [::]:*    users:(("chronyd",pid=801,fd=6))
tcp   LISTEN 0      128          0.0.0.0:22        0.0.0.0:*    users:(("sshd",pid=1012,fd=7))
tcp   LISTEN 0      128             [::]:22           [::]:*    users:(("sshd",pid=1012,fd=8))

Read it as a table. Netid is the protocol, State is LISTEN for TCP servers and UNCONN for UDP ones. Local Address:Port is where the service waits: sshd on port 22 for every IPv4 and every IPv6 address, chronyd on UDP 323 for local commands only (chronyc talks to it there).

Peer Address is * because nobody is connected to a listening socket. The Process column gives the name, PID and file descriptor.

✅ Checkpoint: You can name the two programs listening on rocky01 and say which one can be reached from outside the VM.

2See what sudo and -n change

Run these two, without sudo:

ss -tlnp
ss -tl

You should see something like this:

State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*
LISTEN 0      128             [::]:22           [::]:*
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      128          0.0.0.0:ssh       0.0.0.0:*
LISTEN 0      128             [::]:ssh          [::]:*

Without sudo the Process column is empty, because ss can only show processes that belong to you; sshd runs as root. That’s why the runbook command always starts with sudo. Without -n, ss turns port numbers into names from /etc/services, so 22 becomes ssh and 3306 would show as mysql, which makes grep for a number miss the line.

✅ Checkpoint: You know why the Process column was empty and why the second command printed “ssh” instead of 22.

3Find who owns port 3306

Start the two stand-ins in the background:

cd ~/lab23
python3 -m http.server --bind 0.0.0.0 3306 > /dev/null 2>&1 &
python3 -m http.server --bind 0.0.0.0 33060 > /dev/null 2>&1 &

You should see something like this:

[1] 2611
[2] 2612

Now the command from the old runbook:

sudo ss -tulnp | grep :3306

You should see something like this:

tcp   LISTEN 0      5            0.0.0.0:33060      0.0.0.0:*    users:(("python3",pid=2612,fd=3))
tcp   LISTEN 0      5            0.0.0.0:3306       0.0.0.0:*    users:(("python3",pid=2611,fd=3))

You asked about one port and got two lines, because grep looks for the text “:3306”, and “:33060” contains it. On a real MySQL 8 server both ports belong to the same mysqld, so nobody notices, until the day 33060 belongs to something else. Let ss do the matching instead, because its filter compares the port as a number:

sudo ss -tlnp 'sport = :3306'
sudo ss -tulnp | grep -E ':3306\b'

You should see something like this:

State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      5            0.0.0.0:3306      0.0.0.0:*    users:(("python3",pid=2611,fd=3))
tcp   LISTEN 0      5            0.0.0.0:3306       0.0.0.0:*    users:(("python3",pid=2611,fd=3))

sport is the source (local) port, dport the destination (remote) port, and the colon in front of the number is required. The single quotes keep the shell away from the filter. If you prefer grep, -E ':3306\b' adds a word boundary, so 33060 no longer matches.

You can also combine filters:

ss -tln '( sport = :3306 or sport = :33060 )'

You should see something like this:

State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess
LISTEN 0      5            0.0.0.0:33060      0.0.0.0:*
LISTEN 0      5            0.0.0.0:3306       0.0.0.0:*

Try it yourself: build the “who listens on this port” command in the Command Builder.

✅ Checkpoint: The filtered command shows one line, python3 with your PID for 3306, and nothing for 33060.

4Ask lsof the same question

Run this:

sudo dnf install -y lsof
sudo lsof -i :3306
sudo lsof -nP -iTCP:3306 -sTCP:LISTEN

You should see something like this:

COMMAND  PID    USER FD   TYPE DEVICE SIZE/OFF NODE NAME
python3 2611 student  3u  IPv4  31482      0t0  TCP *:mysql (LISTEN)
COMMAND  PID    USER FD   TYPE DEVICE SIZE/OFF NODE NAME
python3 2611 student  3u  IPv4  31482      0t0  TCP *:3306 (LISTEN)

lsof (“list open files”) sees sockets as open files, so it shows the same PID with the user that owns it. Plain -i :3306 prints the port name (mysql) and also lists connected clients; -nP keeps numbers for IPs and ports, and -iTCP:3306 -sTCP:LISTEN limits it to the listener. On Ubuntu lsof is already installed.

Once you have a PID, ask ps who started it and when:

ps -o pid,user,lstart,cmd -p 2611

You should see something like this:

    PID USER                      STARTED CMD
   2611 student  Tue Oct 27 11:20:14 2026 python3 -m http.server --bind 0.0.0.0 3306

✅ Checkpoint: lsof and ss agree on the PID, and ps shows the full command line that started it.

5Test the port locally with nc and curl

Install ncat (Rocky’s nc) and test:

sudo dnf install -y nmap-ncat
nc -zv 127.0.0.1 3306
curl -sI http://127.0.0.1:3306/

You should see something like this:

Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Connected to 127.0.0.1:3306.
Ncat: 0 bytes sent, 0 bytes received in 0.01 seconds.
HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.12.11
Date: Tue, 27 Oct 2026 05:51:02 GMT
Content-type: text/html; charset=utf-8
Content-Length: 187

-z connects and hangs up without sending data, -v prints the result. On Rocky, nc is Ncat from the nmap project, so its messages start with “Ncat:”. On Ubuntu, nc is the OpenBSD netcat with shorter messages, as you’ll see in the next step. curl goes one step further and speaks HTTP: -I asks for headers only and -s hides the progress bar.

A real MariaDB doesn’t speak HTTP, so for a database port nc is the right test and curl is for web ports.

✅ Checkpoint: nc says “Connected” and curl shows “HTTP/1.0 200 OK” from the stand-in.

6Open the firewall and test from ubu01

On rocky01, open 3306 for this session only:

sudo firewall-cmd --add-port=3306/tcp
sudo firewall-cmd --list-ports

You should see something like this:

success
3306/tcp

On ubu01, test it:

nc -zv -w 3 10.10.10.11 3306
timeout 3 bash -c '</dev/tcp/10.10.10.11/3306' && echo "port open" || echo "port closed or filtered"

You should see something like this:

Connection to 10.10.10.11 3306 port [tcp/mysql] succeeded!
port open

Without --permanent the rule lives in memory only and disappears at the next reload or reboot, which is what you want for a test. -w 3 gives up after 3 seconds instead of waiting for the system timeout. The second line is a handy fallback on servers where nc isn’t installed: bash itself opens the connection through its /dev/tcp feature. Lesson 34 covers firewalld and ufw properly.

Try it yourself: build the remote port test in the Command Builder.

✅ Checkpoint: ubu01 reports the connection to 10.10.10.11 port 3306 succeeded.

7Watch a live connection

On ubu01, open a connection and leave it open:

nc 10.10.10.11 3306

On rocky01, while it is open:

sudo ss -tnp state established '( sport = :3306 )'
ss -tno state established '( sport = :22 )'

You should see something like this:

Recv-Q Send-Q   Local Address:Port    Peer Address:Port Process
0      0          10.10.10.11:3306     10.10.10.21:50614 users:(("python3",pid=2611,fd=4))
Recv-Q Send-Q   Local Address:Port    Peer Address:Port Process
0      0          10.10.10.11:22        10.10.10.1:51322 timer:(keepalive,118min,0)

The first line is ubu01 (10.10.10.21) connected from a random high port, 50614, to your stand-in. It has fd 4, a new socket next to the listening one on fd 3. With a state filter, ss drops the State column because every line has the same state.

The second command shows your own SSH session arriving through the VirtualBox port forward, and -o adds its keepalive timer: sshd will probe the connection if it stays silent. Press Ctrl+C on ubu01 to close the connection.

✅ Checkpoint: You saw 10.10.10.21 as the peer on port 3306, and the line was gone after Ctrl+C on ubu01.

8See socket activation on Ubuntu

On ubu01, run this:

sudo ss -tlnp 'sport = :22'
systemctl is-active ssh.socket ssh.service

You should see something like this:

State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      4096         0.0.0.0:22        0.0.0.0:*    users:(("sshd",pid=1104,fd=3),("systemd",pid=1,fd=111))
LISTEN 0      4096            [::]:22           [::]:*    users:(("sshd",pid=1104,fd=4),("systemd",pid=1,fd=112))
active
active

On Ubuntu 24.04 and later, OpenSSH uses systemd socket activation: ssh.socket makes systemd (PID 1) open port 22, and the first connection starts ssh.service, which takes over the socket. That’s why ss shows two owners. Before anyone connects after a boot, it shows only systemd, and people think sshd is missing.

The listen address and port come from /etc/ssh/sshd_config through a generator, so after changing Port you run sudo systemctl daemon-reload and sudo systemctl restart ssh.socket. Rocky runs sshd as a normal service, so there you only see sshd.

Clean up on rocky01:

kill %1 %2
sudo firewall-cmd --remove-port=3306/tcp
sudo ss -tln '( sport = :3306 or sport = :33060 )'

✅ Checkpoint: The last ss command prints only its header line, and sudo firewall-cmd --list-ports prints an empty line.