Nmap is a great port scanner, but sometimes you want something more authoritative. You can ask the kernel what processes have which ports open by using the
me@myhost:~$ sudo netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 1004/dnsmasq
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 380/sshd
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 822/cupsd
tcp6 0 0 :::22 :::* LISTEN 380/sshd
tcp6 0 0 ::1:631 :::* LISTEN 822/cupsd
The options I have given are:
-t TCP only
-l Listening ports only
-n Don't look up service and host names, just display numbers
-p Show process information (requires root privilege)
In this case, we can see that
sshd is listening on any interface (
0.0.0.0) port 22, and
cupsd is listening on loopback (
127.0.0.1) port 631. Your output may show that
telnetd has a local address of
192.168.1.1:23, meaning it will not answer to connections on the loopback adapter (e.g. you can't
There are other tools that will show similar information (e.g.
/proc), but netstat is the most widely available. It even works on Windows (
netstat -anb). BSD netstat is a little different: you'll have to use sockstat(1) to get the process information instead.
Once you have the process ID and program name, you can go about finding the process and killing it if you wish to close the port. For finer-grained control, you can use a firewall (iptables on Linux) to limit access to only certain addresses. You may need to disable a service startup. If the PID is "-" on Linux, it's probably a kernel process (this is common with NFS for instance), so good luck finding out what it is.
Note: I said "authoritative" because you're not being hindered by network conditions and firewalls. If you trust your computer, that's great. However, if you suspect that you've been hacked, you may not be able to trust the tools on your computer. Replacing standard utilities (and sometimes even system calls) with ones that hide certain processes or ports (a.k.a. rootkits) is a standard practice among attackers. Your best bet at this point is to make a forensic copy of your disk and restore from backup; then use the copy to determine the way they got in and close it off.