Which command checks web server port listening?

A systems administrator is investigating why users cannot reach a Linux web server with a browser but can ping the server IP. The server is online, the web server process is running, and the link to the switch is up. Which of the following commands should the administrator run on the server first?

traceroute
netstat Source Reference Answer
tcpdump
arp

Community Votes

67%

33%

67% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The test focuses on distinguishing between Layer 3 connectivity (ping) and Layer 4 service availability; the trap is immediately using tcpdump instead of first verifying the listening socket.

For a Linux web server that can be pinged but not reached via browser, netstat is the first command to verify the web service is listening on port 80/443. Community consensus favors netstat for checking listening ports and associated processes.

The most common wrong answer is tcpdump, chosen by 33% of voters, because it captures packets but is not the first step when the web server process is already running; netstat quickly confirms whether the server is listening on the expected port.

Community Discussion (6 comments)

buscan422 👍 8 Selected: B

With netstat he can check if port 80 and 443 are running

huradazimi 👍 2 Selected: B

The administrator should run the netstat command first. This will help check if the web server is listening on the correct port (usually port 80 for HTTP or port 443 for HTTPS) and if there are any established connections or issues with network sockets.

Marinos_89 👍 3 Selected: C

When users can ping the server IP but cannot access the web server via a browser, it indicates that basic network connectivity is present, but there may be issues with the specific service (HTTP/HTTPS) or the traffic reaching the server. Using tcpdump allows the systems administrator to capture and analyze network packets on the server. By running tcpdump, the administrator can check if requests to the web server (typically on ports 80 for HTTP or 443 for HTTPS) are reaching the server. This is crucial for diagnosing whether the web server is receiving traffic from clients.

AnotherFatITGuy 👍 4

B. netstat The command netstat -tulpn | grep 80 -t: Shows TCP connections. -u: Shows UDP connections. -l: Shows only listening sockets. -p: Shows the process ID and name of the process using the socket. -n: Shows numerical addresses instead of resolving hostnames. grep 80 filters the output to show only lines containing port 80 and which process is associated with it.

Bunaventi 👍 2 Selected: C

C. tcpdump When investigating why users cannot reach a Linux web server with a browser but can ping the server IP, the administrator should run the tcpdump command on the server first. Tcpdump is a packet analyzer that allows the administrator to capture and analyze network traffic in real-time. By running tcpdump, the administrator can inspect the packets arriving at the server, which can provide insights into whether the server is receiving HTTP traffic and whether there are any issues with the communication. Options A (traceroute), B (netstat), and D (arp) are useful for different purposes but may not directly help diagnose the issue at hand. Traceroute shows the path taken by packets, netstat displays network statistics and connections, and arp resolves IP addresses to MAC addresses. Tcpdump is better suited for capturing and analyzing the actual traffic arriving at the server, helping identify potential issues with web traffic.

Soullifespirit 👍 2

C tcpdump tcpdump is a packet analyzer tool used to capture and display TCP/IP and other packets being transmitted or received over a network. By running tcpdump on the Linux web server, the administrator can examine the incoming network traffic and check if requests to the web server are reaching the server and if the server is responding to those requests. This can help identify any potential issues with the network traffic flow or the web server configuration.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

netstat -tulpn shows TCP/UDP listening ports, the process ID, and the process name. Since the web server process is running, the issue may be that it is not bound to the expected port or interface. Running netstat first confirms whether port 80 or 443 is listening before performing any packet capture. Comment [1] and [2] support this by mentioning netstat's ability to check if ports 80 and 443 are active.

Why the Other Options Are Wrong

traceroute checks the network path, but connectivity already works because users can ping the server IP. tcpdump is useful for deep packet inspection but should be used after verifying the listening socket; comment [3] suggests tcpdump but misses the 'first' priority. arp resolves MAC addresses and is irrelevant to service or port issues. Therefore, netstat is the most logical first command in this scenario.

Community Comment Notes

Comment [2] provides detailed netstat flags (tulpn) and explains how to filter for port 80, which is extremely helpful. Comment [1] simply states that netstat checks if ports 80 and 443 are running. Comment [3] and [5] recommend tcpdump, but their reasoning about analyzing incoming packets is premature if the server is not listening on the correct port. The vote distribution (67 for B) strongly supports netstat as the correct answer.

Official Reference

Exam Strategy

Use the OSI model when troubleshooting: first verify Layer 4 listening sockets before capturing packets. Memorize netstat -tulpn to quickly identify which process is listening on which port, and filter for the expected web port (80/443).

Related Analysis

← Back to N10-008 Study Guide