Unit 4: TCP, UDP and ports · Lesson 5 of 6 · 15 min

What is listening

Audit a server's listening sockets against its exposure policy.

mission

You are
The analyst auditing web01.
Situation
The admin of web01 sent you the output of ss -tulpn from the server, plus the approved exposure policy.
Goal
List every socket reachable from other machines and check each one against the policy.
Hand in
The process behind the unexplained port.
01

Read the snapshot

ss -tulpn lists TCP and UDP sockets that are listening, with the process behind each.

analyst@net-lab
cat listening.txt
Netid State  Recv-Q Send-Q   Local Address:Port  Peer Address:Port Process
udp   UNCONN 0      0              0.0.0.0:161        0.0.0.0:*     users:(("snmpd",pid=811,fd=6))
tcp   LISTEN 0      511            0.0.0.0:80         0.0.0.0:*     users:(("nginx",pid=902,fd=6))
tcp   LISTEN 0      511            0.0.0.0:443        0.0.0.0:*     users:(("nginx",pid=902,fd=7))
tcp   LISTEN 0      128            0.0.0.0:22         0.0.0.0:*     users:(("sshd",pid=744,fd=3))
tcp   LISTEN 0      50             0.0.0.0:8443       0.0.0.0:*     users:(("java",pid=1290,fd=41))
tcp   LISTEN 0      244          127.0.0.1:5432       0.0.0.0:*     users:(("postgres",pid=1011,fd=5))
tcp   LISTEN 0      4096     127.0.0.53%lo:53         0.0.0.0:*     users:(("systemd-resolve",pid=600,fd=14))

Reading the Local Address column

0.0.0.0:8443 127.0.0.1:5432
  1. 10.0.0.0every interface: reachable from the network
  2. 28443port
  3. 3127.0.0.1loopback only: this machine
  4. 45432port
02

Keep only what the network can reach

Drop loopback sockets. What remains is the real attack surface.

analyst@net-lab
grep -v 127.0.0 listening.txt | grep -v Netid
udp   UNCONN 0      0              0.0.0.0:161        0.0.0.0:*     users:(("snmpd",pid=811,fd=6))
tcp   LISTEN 0      511            0.0.0.0:80         0.0.0.0:*     users:(("nginx",pid=902,fd=6))
tcp   LISTEN 0      511            0.0.0.0:443        0.0.0.0:*     users:(("nginx",pid=902,fd=7))
tcp   LISTEN 0      128            0.0.0.0:22         0.0.0.0:*     users:(("sshd",pid=744,fd=3))
tcp   LISTEN 0      50             0.0.0.0:8443       0.0.0.0:*     users:(("java",pid=1290,fd=41))

you should see Five sockets: 161, 80, 443, 22 and 8443.

03

Compare with the policy

Every reachable port should appear in the policy. Anything else is either a missing rule or a service nobody meant to run.

analyst@net-lab
cat policy.txt
web01 exposure policy, approved 2026-09-02

from the internet:   tcp 80, tcp 443
from the office:     tcp 22 (admins), udp 161 (monitoring)
everything else:     drop and log
web01 never forwards traffic

you should see 8443 is not in the policy, yet the scan in the first unit found it open from the internet.

defender tip Bind admin consoles to 127.0.0.1 and reach them over SSH, or put them behind the VPN. Never expose them to everyone.

The fix for 8443

Now
tcp LISTEN 0.0.0.0:8443 java

Reachable by anyone who can reach web01.

After
tcp LISTEN 127.0.0.1:8443 java

Only reachable from web01 itself, for example through an SSH tunnel.

04

Turn the review into a check

Save the approved list of reachable ports for this server and compare every new snapshot against it. Anything new raises a ticket.

you should see A one-line check that runs after every change.

What a defender takes away

  1. 10.0.0.0 or :: means every interface; 127.0.0.1 means this machine only.
  2. 2Compare listening sockets with the written policy, line by line.
  3. 3Unlisted admin consoles are one of the most common real-world findings.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    grep 8443 listening.txt

  2. Show hint

    grep LISTEN listening.txt | grep -v 127.0.0 | wc -l