> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/linux-discovery/linux-network-enumeration.md).

# Linux Network Enumeration

## List listening services

### List services with lsof

Non-privileged

```bash
lsof -i
```

Privileged

```bash
sudo lsof -i
```

Only show information about a specific port, e.g. port 25

```bash
lsof -i :25
```

### Listening services with netstat

List TCP-services/ports

```bash
netstat -nlt
```

List UDP-services/ports

```bash
netstat -nlu
```

List TCP- and UPD-services with program/PID information

```bash
sudo netstat -nltup
```

List network connections and listening ports

```bash
sudo netstat -natup
```

We set **-n** to show numerical addresses instead of trying to determine symbolic host, port, or user names. The **-a** option will show both listening and non-listening sockets. Setting the **-t** option lists TCP connections. We'll use **-u** to list UDP connections as well. Finally, let's set **-p** to show the PID and name of the program to which each socket belongs.

### Listening services with ss

List TCP-services/ports in extended (`-e` ) format (with UID-info)

```bash
ss -nlte
```

List UDP-services/ports in extended (`-e` ) format (with UID-info)

```bash
ss -nlue
```

List TCP- and UPD-services with program/PID information

```bash
sudo ss -nltup
```

## Resources

**lsof** - Linux manual page: <https://man7.org/linux/man-pages/man8/lsof.8.html>

**netstat** - Linux manual page: <https://man7.org/linux/man-pages/man8/netstat.8.html>

**ps** - Linux manual page: <https://man7.org/linux/man-pages/man1/ps.1.html>

**ss** - Linux manual page: <https://man7.org/linux/man-pages/man8/ss.8.html>