Picture this: you glance at your system monitor and notice your CPU is humming along even though you're not running anything demanding. Or maybe your internet feels sluggish for no obvious reason. A small, uneasy thought creeps in — is someone else on my machine right now?
For Linux users, this isn't something you have to wonder about. Linux ships with a powerful set of built-in tools that let you see exactly who's connected, who's logged in, and what your network is doing at any given moment. You don't need to be a security expert to use them — you just need to know where to look.
This guide walks you through the practical, no-nonsense steps to check for unauthorized connections on your Linux system, with real commands you can run right now.
Why Monitoring Network Connections Matters
Every device on a network — including your own Linux machine — communicates using an IP address. When another device or user connects to your system, that connection shows up as a trackable entry, whether it came from your local network or from somewhere across the internet.
Think of it like your home's front door. You wouldn't be comfortable not knowing who has a key or who's walked in recently. Your Linux machine deserves the same level of attention. Regularly checking your active connections, logged-in users, and open ports is one of the simplest habits you can build to keep your system secure.
Let's go through the tools, one at a time.
1. Checking Connections with netstat
netstat has been a go-to network diagnostic tool on Linux for decades. Even though newer tools like ss are replacing it on many distributions, it's still widely available and easy to use.
# Show all listening and established TCP/UDP connections
netstat -tuln
Here's what each flag does:
-t→ show TCP connections-u→ show UDP connections-l→ show only listening sockets-n→ show numerical addresses instead of resolving hostnames (much faster)
If you want to see who is actively connected rather than just what's listening, drop the -l flag and add -p to see the process using each connection:
sudo netstat -tunp
Sample output:
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 192.168.1.10:22 203.0.113.55:51322 ESTABLISHED 1432/sshd
tcp 0 0 192.168.1.10:80 198.51.100.23:44210 ESTABLISHED 2201/nginx
Any line showing ESTABLISHED is a live connection. Pay close attention to the "Foreign Address" column — if you spot an IP you don't recognize connected to a sensitive port (like SSH on port 22), it's worth investigating immediately.
2. Checking Connections with ss
ss (short for "socket statistics") is the modern replacement for netstat. It's faster and gives you more detail, especially on newer distributions where netstat may not even be installed by default.
# Show listening TCP/UDP sockets
ss -tuln
To see currently established connections with process info:
sudo ss -tunp
You can also filter results to only show established connections:
ss -t state established
This is a great one to bookmark — it cuts straight to "who is actively talking to my machine right now" without extra noise.
3. Seeing Who's Logged In with who and w
While netstat and ss show network-level connections, sometimes you just want to know: who is logged into this machine right now?
who
Sample output:
alice pts/0 2026-07-26 09:14 (192.168.1.42)
bob pts/1 2026-07-26 09:20 (203.0.113.10)
That third column showing an IP address is key — it tells you where each session is connecting from. An unfamiliar IP next to a username you don't recognize is a red flag.
For more detail — including what each user is currently doing — use w instead:
w
09:31:02 up 3 days, 4:12, 2 users, load average: 0.15, 0.09, 0.05
USER TTY FROM LOGIN@ IDLE WHAT
alice pts/0 192.168.1.42 09:14 0.00s w
bob pts/1 203.0.113.10 09:20 2:15 nano notes.txt
4. Reviewing Login History with last
Real-time checks are useful, but sometimes you need to look backward. The last command shows a full login history — who logged in, from where, and for how long.
last
alice pts/0 192.168.1.42 Fri Jul 26 09:14 still logged in
bob pts/1 203.0.113.10 Fri Jul 26 09:20 still logged in
root pts/2 203.0.113.99 Thu Jul 25 02:41 - 02:52 (00:11)
That last line is exactly the kind of thing you're looking for — a root login at 2:41 AM from an unfamiliar IP address is worth investigating right away.
You can also check specifically for failed login attempts, which is often even more telling than successful ones:
sudo lastb
A long list of failed attempts from the same IP address is a strong sign someone is trying to brute-force their way into your system.
5. Digging Deeper with tcpdump
If you want to go beyond "who's connected" and actually see the traffic flowing through your network interfaces, tcpdump is the tool for the job.
# Install it if it's not already available
sudo apt install tcpdump # Debian/Ubuntu
sudo dnf install tcpdump # Fedora/RHEL
# Capture all traffic on all interfaces
sudo tcpdump -i any
That command can be a firehose of information, so it helps to narrow it down. A few practical examples:
# Only show traffic to/from a specific IP
sudo tcpdump -i any host 203.0.113.55
# Only show SSH traffic (port 22)
sudo tcpdump -i any port 22
# Save captured traffic to a file for later analysis
sudo tcpdump -i any -w capture.pcap
That .pcap file can then be opened in Wireshark for a much more visual, digestible breakdown — Wireshark is especially useful if you're not comfortable reading raw terminal output and want to click through packets instead.
6. Checking Your Firewall Rules
None of the monitoring above matters much if your firewall isn't actively filtering out unwanted traffic in the first place. Most Linux systems use iptables under the hood, though many distributions now offer more user-friendly front-ends like ufw (Uncomplicated Firewall).
Checking iptables rules:
sudo iptables -L -v -n
This lists every rule currently in effect, along with packet and byte counters — handy for spotting rules that are (or aren't) actually being triggered.
If you're using ufw (common on Ubuntu):
# Check firewall status
sudo ufw status verbose
# Enable the firewall if it's not already active
sudo ufw enable
# Allow only the ports you actually need
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
# Deny everything else by default
sudo ufw default deny incoming
A well-configured firewall dramatically shrinks your attack surface, since it blocks unsolicited connections before they ever reach an open port.
7. Bonus: Checking Open Ports with nmap
It's worth occasionally scanning your own machine the way an outsider would. nmap lets you do exactly that.
# Install nmap
sudo apt install nmap
# Scan your own machine's open ports
nmap localhost
# Scan a specific IP on your local network
nmap 192.168.1.10
If a port shows up as open and you don't recognize the service running on it, that's a strong signal to investigate — and potentially close it.
Putting It All Together: A Quick Security Checklist
Here's a simple routine you can run periodically (or automate) to keep tabs on your system:
echo "== Active network connections =="
sudo ss -tunp
echo "== Logged in users =="
who
echo "== Recent login history =="
last -a | head -20
echo "== Failed login attempts =="
sudo lastb | head -20
echo "== Firewall status =="
sudo ufw status verbose
Save this as a script (e.g., check_security.sh), and you've got a one-command health check for your machine.
Frequently Asked Questions
Is it normal to see multiple "established" connections in netstat?
Yes — every open browser tab, app, or background service that talks to the internet will show up as an established connection. The key is looking for ones tied to unfamiliar processes or IP addresses, not the total number.
What should I do if I find an unauthorized connection? Disconnect from the network if possible, note the IP address and process involved, kill the suspicious process, change your passwords (especially SSH keys and root credentials), and review your firewall rules. If it's a shared or work machine, loop in your IT/security team right away.
Do I need both netstat and ss?
Not really — ss is the modern, faster alternative and is preinstalled on most current distributions. netstat is still worth knowing since it's common in tutorials and older systems, but ss should be your daily driver.
Can someone connect to my Linux machine without me noticing? It's possible if your firewall is misconfigured or a service is exposed with weak credentials — which is exactly why regularly checking active connections and login history matters, rather than assuming everything is fine.