I need to find out how many services are listening to my interfaces (ipv4 only, not localhost)

$ ifconfig

ens192: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet  netmask  broadcast
        inet6 dead:beef::250:56ff:feb9:8c07  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::250:56ff:feb9:8c07  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:b9:8c:07  txqueuelen 1000  (Ethernet)
        RX packets 3644  bytes 330312 (330.3 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3198  bytes 679711 (679.7 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet  netmask
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 15304  bytes 895847 (895.8 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 15304  bytes 895847 (895.8 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

$ nmap

Starting Nmap 7.60 ( https://nmap.org ) at 2020-12-05 05:23 UTC
Nmap scan report for
Host is up (0.000086s latency).
Not shown: 991 closed ports
21/tcp  open  ftp
22/tcp  open  ssh
80/tcp  open  http
110/tcp open  pop3
139/tcp open  netbios-ssn
143/tcp open  imap
445/tcp open  microsoft-ds
993/tcp open  imaps
995/tcp open  pop3s

Nmap done: 1 IP address (1 host up) scanned in 10.57 seconds

I thought the answer was 9 but there must be a way to find the correct answer. Cheers in advance!

netstat -tunleep4 | grep -v "127\.0\.0"
  • man netstat will shed light on all the options. grep LISTEN is not necessary – Artem S. Tashkinov Dec 5 '20 at 8:00

From man netstat:

This program is mostly obsolete. Replacement for netstat is ss.

At this point, I think this will be the best option:

ss -l -4 | grep -v "127\.0\.0" | grep "LISTEN" | wc -l


  • -l: show only listening services
  • -4: show only ipv4
  • -grep -v "127.0.0": exclude all localhost results
  • -grep "LISTEN": better filtering only listening services
  • wc -l: count results
netstat -tunleep4 | grep -v "127.0.0" | awk '{print $6}' | grep LISTEN | wc -l
$6 might be different among OS

Update from comments

netstat -tunleep4 | grep -v "127.0.0" | awk '{print $6}' | grep -c LISTEN
  • 3
    Rarely does one need a mix of grep, awk, and sed. For example, netstat -ln4 | awk '$6 == "LISTEN" && $4 !~ /^127\./ { k++ } END { print k }' which uses awk to perform the equivalent of the two grep commands (and the wc -l since it can) – roaima Dec 17 '20 at 10:02
  • at least replace grep LISTEN | wc -l by grep -c LISTEN – Archemar May 7 at 5:35
netstat -ln4 | grep LISTEN | grep -v 127 | wc -l


-l, --listening          display listening server sockets
-n, --numeric            don't resolve names

   --protocol=family, -A
       Specifies  the  address  families  (perhaps  better described as low level protocols) for which connections are to be
       shown.  family is a comma (',') separated list of address family keywords like inet, inet6, unix, ipx, ax25,  netrom,
       econet,  ddp,  and bluetooth.  This has the same effect as using the --inet|-4, --inet6|-6, --unix|-x, --ipx, --ax25,
       --netrom, --ddp, and --bluetooth options.

       The address family inet (Iv4) includes raw, udp, udplite and tcp protocol sockets.

       The address family bluetooth (Iv4) includes l2cap and rfcomm protocol sockets.

grep LISTEN - just lines with the LISTEN word

grep -v 127 - just lines without the 127

wc -l - count result lines

Visual explaining here - https://explainshell.com/explain?cmd=netstat+-ln4+%7C+grep+LISTEN+%7C+grep+-v+127+%7C+wc+-l

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.