LFCS Networking Practice Question
A technician must verify which network services are listening on TCP ports and which processes own them on a production server. Which command provides this information directly?
⚠ Common exam trap
The trap here is picking a legacy or single-purpose tool like netstat or lsof when ss -tlnp is the modern command that lists all listening TCP sockets with their processes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ss -tlnp
The ss utility with the -tlnp flags enumerates TCP listening sockets, keeps addresses numeric, and shows the owning process for each. This single command answers both parts of the requirement: which ports are listening and which processes hold them. The other tools either display unrelated tables or cover only a single port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
lsof -i :22
Why it's wrong here
The lsof -i :22 command lists processes with open files related to port 22 only. It is useful for checking a single port but does not enumerate all listening TCP services across the system. The requirement is to see every listening TCP port and its owner, which this narrow query does not satisfy.
- ✗
netstat -rn
Why it's wrong here
The netstat -rn command prints the kernel routing table in numeric form. It shows routes and gateways, not listening sockets or their owning processes. While netstat is a legacy tool, this particular flag combination does not provide the socket and process information the technician needs.
- ✓
ss -tlnp
Why this is correct
The ss command from iproute2 displays socket statistics. The flags -t, -l, -n, and -p select TCP sockets, listening state, numeric addresses, and the owning process respectively. This combination directly lists listening TCP ports along with the process names and PIDs that hold them, matching the requirement.
- ✗
ip neigh show
Why it's wrong here
The ip neigh show command displays the ARP or neighbor cache, mapping IP addresses to link-layer addresses on the local network. It has nothing to do with listening TCP ports or the processes that own them. It is used for troubleshooting layer-2 adjacency issues instead.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LFCS question from scratch — 406 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Linux Foundation exam blueprint
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.