Find what is listening on a port
sudo ss -tulpn # all listening TCP/UDP sockets with process
sudo lsof -i :8080 # which process owns port 8080
Port ranges
- 0–1023 — well-known ports (need root to bind)
- 1024–49151 — registered ports
- 49152–65535 — dynamic/ephemeral ports
"Risk" is how dangerous it usually is to expose the service directly to the internet. Databases, caches and management APIs should live on private networks or behind a VPN.