What is listening on my server?

Being a sysadmin, you'll probably often need to find out what is running on a server. There are several ways to do this on Linux:

# netstat -nlptu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      15118/nginx
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      905/sshd
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      982/master
tcp        0      0 127.0.0.1:3306              0.0.0.0:*                   LISTEN      15328/mysqld
tcp        0      0 :::22                       :::*                        LISTEN      905/sshd
tcp        0      0 ::1:25                      :::*                        LISTEN      982/master

If you prefer, you can use lsof:

# lsof -i -n -P
COMMAND   PID  USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
sshd      905  root    3u  IPv4     7895      0t0  TCP *:22 (LISTEN)
sshd      905  root    4u  IPv6     7897      0t0  TCP *:22 (LISTEN)
master    982  root   12u  IPv4     8102      0t0  TCP 127.0.0.1:25 (LISTEN)
master    982  root   13u  IPv6     8104      0t0  TCP [::1]:25 (LISTEN)
sshd    10670  root    3u  IPv4 65255903      0t0  TCP 178.62.94.245:22->151.231.154.186:54262 (ESTABLISHED)
nginx   15118  root    6u  IPv4 65276878      0t0  TCP *:80 (LISTEN)
nginx   15120 nginx    6u  IPv4 65276878      0t0  TCP *:80 (LISTEN)
mysqld  15328 mysql   10u  IPv4 65277629      0t0  TCP 127.0.0.1:3306 (LISTEN)

Also, there is the 'ss' command:

# ss -lnp
State       Recv-Q Send-Q                                                          Local Address:Port                                                            Peer Address:Port
LISTEN      0      128                                                                         *:80                                                                         *:*      users:(("nginx",15118,6),("nginx",15120,6))
LISTEN      0      128                                                                        :::22                                                                        :::*      users:(("sshd",905,4))
LISTEN      0      128                                                                         *:22                                                                         *:*      users:(("sshd",905,3))
LISTEN      0      100                                                                       ::1:25                                                                        :::*      users:(("master",982,13))
LISTEN      0      100                                                                 127.0.0.1:25                                                                         *:*      users:(("master",982,12))
LISTEN      0      50                                                                  127.0.0.1:3306                                                                       *:*      users:(("mysqld",15328,10))

Another way to find out what is running on a port is to use the 'fuser' command:

# fuser 80/tcp -uv
                     USER        PID ACCESS COMMAND
80/tcp:              nobody     1732 F.... (nobody)haproxy
                     root      32677 F.... (root)nginx
                     vagrant   32678 F.... (vagrant)nginx
                     vagrant   32679 F.... (vagrant)nginx

Does that help you out?