Quick Answer
The Open Ports Explainer reads the output of ss -tulpn, ss -ltnpe, netstat -tulpn or lsof -i -P -n and explains every listening socket in plain English. For each one it shows the reachability scope from the Local Address column: 127.0.0.1 and ::1 are loopback only, 0.0.0.0 is every IPv4 interface, [::] or * is every interface, and a specific address is that interface only. It names the owner from the Process column, or from the systemd cgroup when you ran ss -e without root, adds a note for the port (systemd-resolved on 127.0.0.53:53, LLMNR on 5355, mDNS on 5353, Postgres on 5432), and flags the known problems: a database or the Docker API on a wildcard address, a published container port, an empty Process column, and a full accept queue. Each row gets the next command to run. Nothing is sent anywhere, and addresses are redacted in share links by default.
What is the difference between 0.0.0.0 and 127.0.0.1 in ss output?
127.0.0.1 is loopback: only programs on the same machine can connect, and every other machine gets "Connection refused". 0.0.0.0 means every IPv4 address the host has, including LAN, VPN and Docker bridge addresses. [::] is the IPv6 equivalent, and * is one socket for both families. Whether a 0.0.0.0 listener is reachable from outside still depends on your firewall and NAT, which ss cannot see.
Why is the Process column empty in ss -tulpn?
ss can only read the owning process of sockets that belong to your own user unless it runs as root, so rows owned by system services come back with no users:(( )) field. Run sudo ss -tulpn to see every process. Without root, ss -ltnpe adds uid and the cgroup, which names the systemd unit that owns the socket, such as systemd-resolved.service or docker.service.
What is listening on port 5355 and 127.0.0.53:53 on Linux?
Both are systemd-resolved. 127.0.0.53:53 and 127.0.0.54:53 are its local DNS stub resolvers, reachable only from the machine itself. Port 5355 on 0.0.0.0 and [::] is its LLMNR responder, which answers name lookups from the local network. If you do not need LLMNR, set LLMNR=no in a drop-in under /etc/systemd/resolved.conf.d/ and restart systemd-resolved.
What do Recv-Q and Send-Q mean on a LISTEN row?
On a listening TCP socket, Send-Q is the backlog limit the program asked for and Recv-Q is how many finished connections are waiting for the program to accept them. Recv-Q near zero is normal. Recv-Q at or above Send-Q means the queue is full: the service is running but not accepting, usually because it is hung or overloaded, and new clients wait or time out.
Does this tool scan my ports or send my output anywhere?
No. It never connects to any address; it only reads the text you paste, and the parsing runs in your browser. A share link carries the normalised rows in the URL fragment after the # sign, which browsers do not send to the server, and addresses other than loopback, wildcard and multicast are redacted in it by default.
An operational script system + a 30-function shared library + a 52-page field guide. The production layer the free snippets don't cover.
Get the Toolkit →Ten functions I source into every script on my own boxes — strict-mode setup, an ERR trap that names the failing line, lock and timeout wrappers, and cleanup that runs on every exit path. One email, no sequence.
beginner · ports
List All Open Ports on Linux
A bash script that maps every port your server is listening on, along with the process name holding it open — the first step in any security audit.
intermediate · ports
Audit Listening Ports and Alert on New Ones — Bash Script
A bash script that snapshots every listening TCP and UDP socket as CSV, diffs it against the previous run, and alerts once when a new listener appears.
beginner · ports
Port Is Listening but Connection Refused: Check the Bind Address — Bash Script
ss shows the port listening, yet other machines get Connection refused. The service is bound to 127.0.0.1. Check the bind address per port and fix it.
beginner · ports
Kill Process on Port
EADDRINUSE means something already holds your port. Find the process with lsof or ss and kill it safely, with confirmation and SIGTERM-to-SIGKILL escalation.
Parsed in your browser. Nothing is sent anywhere, and this tool never connects to a port. It shows who could reach each socket; your firewall, NAT and cloud security groups are invisible to it.