How to Check Open Ports on Windows, Linux and Mac

To check open ports on your own computer, list the listening sockets with netstat -ano or Get-NetTCPConnection on Windows, ss -tulpn on Linux and lsof -nP -iTCP -sTCP:LISTEN on macOS. To see whether a port is reachable from another machine, test it with Test-NetConnection, nc or nmap against a host you own or administer, or use an online checker that probes your public IP from outside.

The difference between those two questions — «what is listening here» and «what can the outside world reach» — causes most confusion, so this guide keeps them separate. You will also see how to read nmap port states, why a port can be open locally and closed from the internet, and which ports proxies typically use. An important limit before we start: scan only systems you own or have written permission to test. Probing other people's servers without consent may be illegal in many countries and breaks the terms of most providers.

Ports in One Paragraph

An IP address identifies a machine; a port number (0–65535) identifies a service on it. Web servers wait on 80 and 443, SSH on 22, remote desktop on 3389, and proxy servers on whatever port their operator chose. A port is «open» when some program is listening on it and the firewall lets packets through. If you want to brush up on how hosts and addresses fit together, our explainer on the proxy hostname is a quick refresher.

Step 1. List Listening Ports on Your Own Machine

Windows

In Command Prompt:

netstat -ano | findstr LISTENING

The last column is the process ID. To see which program owns it, run tasklist /FI "PID eq 4312" with your PID. In PowerShell the same check is more readable:

Get-NetTCPConnection -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess,
    @{n='Program'; e={(Get-Process -Id $_.OwningProcess).ProcessName}} |
  Sort-Object LocalPort

Linux

sudo ss -tulpn

The flags mean TCP, UDP, listening, show process, numeric ports. sudo lsof -i -P -n | grep LISTEN gives a similar view on systems without ss.

macOS

sudo lsof -nP -iTCP -sTCP:LISTEN

Pay attention to the local address column. A service bound to 127.0.0.1 accepts connections only from the same computer, while 0.0.0.0 or [::] means every network interface, which is what exposes it to the network.

Step 2. Test a Single Port From Another Machine

Once you know a service is listening, check that clients can actually reach it.

# Windows PowerShell: look for TcpTestSucceeded : True
Test-NetConnection 192.0.2.40 -Port 3128

# Linux / macOS: -z just probes, -v prints the result
nc -zv 192.0.2.40 3128

A refused connection means the host answered but nothing listens on that port. A timeout usually means a firewall silently drops the packets. Both look like «closed» to a user, but they point to different fixes.

Step 3. Scan Your Own Host With Nmap

Nmap checks many ports at once and reports their state. Install it from the official site or your package manager, then run it against your server or lab machine:

# the 100 most common TCP ports
nmap --top-ports 100 192.0.2.40

# a specific range plus service and version detection
nmap -p 1-1024 -sV 192.0.2.40

# UDP needs root and is slower
sudo nmap -sU -p 53,123,161 192.0.2.40

How to read the results:

If the host does not answer ping, add -Pn so nmap skips host discovery and scans anyway. Run scans from a network you are allowed to use; cloud providers often require notice even for testing your own instances.

Step 4. Check What the Internet Sees

Online port checkers connect to your public IP from their own servers, so they show the outside view. They are handy when you host a game server or a self-managed proxy at home. If a port is open locally but the checker reports it closed, the usual suspects are:

• Router NAT. Incoming traffic does not know which home computer to reach until you set up port forwarding on the router.
• Carrier-grade NAT. Many mobile and some home providers put customers behind a shared address; inbound connections are impossible without a public IP from the provider.
• Firewalls. Windows Defender Firewall, ufw or firewalld on Linux, or the provider's own filtering may block the port.

Ports and Proxies

Proxy servers are services like any other, and they listen on a port:

Commercial providers often use non-standard high ports, so always take the number from your dashboard rather than guessing. When a proxy connection fails, the port test from Step 2 quickly tells you whether the port is reachable at all before you start debugging logins. Then try a real request through it:

curl -x socks5h://user-7f3k:Pw55x@192.0.2.40:1080 https://api.ipify.org

If you run your own proxy, make sure it listens only where needed and requires authorization: an open proxy on a public port will be found by scanners and abused within hours. The differences between protocols on those ports are explained in SOCKS5 vs HTTP proxies, and ready-made SOCKS5 proxies save you from exposing a server of your own.

How to Close a Port You Don't Need

1. Find the program from Step 1 and stop or uninstall it; a port with no listener is closed by definition.
2. If the service is needed locally, bind it to 127.0.0.1 in its configuration.
3. Add a firewall rule that blocks inbound traffic on that port, or allows it only from trusted addresses.
4. Remove unused port-forwarding rules on the router.
5. Re-run the checks from Steps 2–4 to confirm.

A filtering layer in front of services adds another barrier; our article on the proxy firewall shows how application-level filtering works. Teams that run regular audits of their own perimeter can read about proxies in cybersecurity tasks.