adminSS Socket and Listening Port Inspection Checklist
ss shows which services are listening on which ports. This is essential for debugging Nginx, SSH, databases, Docker apps, internal APIs and reverse proxy problems.
Core principle
A network service must listen on an address and port before other systems can reach it. If nothing is listening, DNS and firewall changes will not fix the application.
Checklist
- List listening TCP ports.
- Identify process names and PIDs.
- Check whether Nginx listens on 80 and 443.
- Check whether SSH listens on the expected port.
- Check whether database ports are private.
- Check whether internal app ports are localhost-only or public.
- Compare listening ports with firewall rules.
- Compare Docker published ports with ss output.
- Close or protect unexpected public ports.
- Document the port map.
Reusable lesson
ss applies to VPS hardening, reverse proxy debugging, Docker deployment, database exposure checks, webhook services and cloud firewall design.
When to Use This Checklist
Use this checklist when checking what services are listening on a VPS and whether they should be public or private.
Required Tools
SSH access, ss, UFW, Docker if used, service list, Nginx config
Before You Start
Do not open firewall ports before confirming the service is listening and should be publicly reachable.
Structured Checklist Steps
- List listening ports.
- Identify processes.
- Check web ports.
- Check SSH port.
- Check database ports.
- Check app ports.
- Compare firewall.
- Compare Docker ports.
- Protect unexpected exposure.
- Document port map.
Verification Steps
- Listening services are known.
- Unexpected public ports are reviewed.
- Database is not exposed publicly.
- Firewall rules match real services.
- Port map is documented.
Rollback Plan
If closing or changing a port breaks a service, restore the previous firewall or service config and redesign exposure with reverse proxy or private access.
Common Mistakes
- Opening ports without checking listeners.
- Forgetting Docker published ports.
- Exposing databases publicly.
- Confusing localhost with public access.
- No port documentation.
Related Commands
sudo ss -tulpn
sudo ss -ltnp
sudo ss -tulpn | grep nginx
sudo ss -tulpn | grep 3306
sudo ufw status numbered
docker ps